Name: Macro.Word.Inla Category: Viruses Description: Details Macro.Word.Inlay This is a German-specific Word macro virus. It contains eleven macros: InnLib, FileOpen, FileSave, HilfeInfo, Innocence(AutoOpen), FileSaveAs, ToolsMacro, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, ExtrasMakro. All infection routines are placed in InnLib macro, all other macros call InnLib for necessary routines. On opening a document the virus checks it for the macro viruses: Atom Boom:De Buero:De Cap:De Clock:De Colors Concept Darkside Friday:De Gangsterz Hot Imposter Lazy NF NomVir:De Friends:De Nuclear Nop:De Pheew Spooky:De Stryx Target Tele Wazzu Zero:De Xenixos:De Outlaw If any virus is found, the "Inlay" virus displays the MessageBox: Innocence meldet: Die Datei enth lt einen Makrovirus . Identifiziert als: KEINE PANIK: Innocence wird nun versuchen, diesen Virus zu entfernen. Ihr Dokument wird nicht besch digt. The "Inlay" virus calculates the number of detected viruses in the WIN.INI file in the section "[Intl]" in string "Killed". In string " "Inlay" it keeps the month of latest infection. The virus also creates the INLAY file which adds to the NORMAL.DOT and registers in the "pfad" string. On entering the Tools/Macro menu the virus saves "backup" of the current document to the NORMAL.DOC, removes all its macros and loads original not infected file