%%File: VIRS0844.TXT
%%Name/Aliases: Colors, Wordmacro Colors, macro
%%Platform: Win, Win NT, Mac
%%Type: Macro., 
%%Disk Location: WinWord documents
%%Features: Direct acting.
%%Damage: 
%%Size: Adds Macros to Word document files
%%See Also: WordMacro.Nuclear, Concept, FormatC , Colors, DMV, Hot, 
Imposter, Irish, Infezione, Wazzu, Atom, Xenixos, Polite, Boom, 
Friendly, NOP, Pheew, Lbynj
%%Notes: This virus uses the macro capability built into Microsoft Word 
(WordBasic) to add a virus to a Word document. Since this virus is 
written in the macro language, it is not platform specific, but will 
execute on any platform that runs Word 5 or later.

When you open an infected document, its auto open macro runs and 
installs an auto execute macro in your global macro file (normal.dot). 
Once that is done, the virus code is executed every time you startup 
Word. The virus code then writes copies of itself onto every document 
you save with Word. 

When the virus triggers, it messes with your color tables.

When it is installed, it adds the following macros to your system: 

AutoClose, AutoExec, AutoOpen, FileExit, FileNew, FileSave, FileSaveAs, 
Macros, ToolsMacro.

It replaces the menu items with the indicated macros, making it 
difficult to see that you have an infiction. The ToolsMacro command no 
longer lists the macros in a system. To see the files,  choose the File 
Templates command and click the Organizer button to see the macros. 

The Microsoft protection for the Concept virus does not work.
F-Prot 2.21  detects it.

The only protection y ou have is to disable all autoexecute macros.

Create a global macro named MyDisableAutoMacros.
Insert the following code in it:

Main
   DisableAutoMacros 1
End Sub

In the program group,  select the word icon and choose the File 
Properties command. In the Command line box, change the command line to 
the following (leave the path pointing to your copy of winword): 
      c:\msoffice\winword\winword.exe /mMyDisableAutoMacros

Note that this will only disable automacros if you start word with the 
icon. If you start it by double clicking a document, the 
MyDisableAutoMacros macro does not run and you are not protected. You 
must hold down the Alt key when opening a document to disable  all the 
automacros but AutoExecute. AutoExecute only runs when you start Word.

To clean a document once you have it open, use the Organizer to delete 
the macros from the file then save it. Organizer can also be used to 
delete any virus macros stored in the global macro file,  normal.dot.


Removal: Mac: SAM  4.0.8 finds and removes this virus.
PC: F-PROT 2.21 detects