Name: Macro.Word.Concep Category: Viruses Description: Details Macro.Word.Concept This is the first WinWord virus found "in the wild". The virus contains five macros: AAAZAO, AAAZFS, AutoOpen, PayLoad, FileSaveAs. It infects the files that are SaveAs'ed (FileSaveAs). There are the text strings in the infected document: see if we're already installed iWW6IInstance AAAZFS AAAZAO That's enough to prove my point and other. The WINWORD6.INI on infected system contains the file: WW6I= 1 On the first execution of the virus code (i.e. on the first opening of the infected file) the MessageBox appears with digit "1" inside, and "Ok" button. Macro.Word.Concept.e This virus contains four macros: Load, AAAZAO, AAAZFS, AutoOpen. Macro.Word.Concept.f This is an ancrypted virus. It contains seven macros: K, a678, PARA, SITE, I8U9Y13, PayLoad, AutoOpen. Macro.Word.Concept.ab This virus contains three macros: Documents NORMAL.DOT MSConcept MSConcept sAevaSeliF FileSaveAs AutoOpen nepOotuA It contains the comments: Presenting The Microsoft Concept Virus. Updated by Pyro [VBB] (Author of Word97.NightShade) Macro.Word.Concept.s This is Japanese version of standard "Concept", it contains the same set of macros: AAAZAO, AAAZFS, AutoOpen, PayLoad.