%%File: VIRS0858.TXT
%%Name/Aliases: WinWord.Concept , Word Prank Macro, Concept, macro
%%Platform: Win, Win NT, Mac
%%Type: Macro., 
%%Disk Location: WinWord documents
%%Features: Direct acting.
%%Damage: No damage, only replicates.
%%Size: Adds Macros to Word document files
%%See Also: WordMacro.Nuclear, Concept, FormatC , Colors, DMV, Hot, 
Imposter, Irish, Infezione, Wazzu, Atom, Xenixos, Polite, Boom, 
Friendly, NOP, Pheew, Lbynj
%%Notes: This virus uses the macro capability built into Microsoft Word 
(WordBasic) to add a virus to a Word document. Since this virus is 
written in the macro language, it is not platform specific, but will 
execute on any platform that runs Word 5 or later.

When you open an infected document, its auto open macro runs and 
installs an auto execute macro in your global macro file (normal.dot). 
Once that is done, the virus code is executed every time you startup 
Word. The virus code then writes copies of itself onto every document 
you save with Word. 


This is the first virus discovered of this type. It does nothing but 
replicate itslef. You can detect the virus the first time it executes, 
because a dialog box appears containing the single digit 1. After the 
first infection, you can detect an infection by looking for the 
following line in the WINWORD6.INI file in the WINDOWS directory.

WW6I= 1

Microsoft has made a disinfector available to detect and remove this 
virus from a system and from infected documents. The disinfector is a 
document named scan831.doc. It is available directly from Microsoft at :

The Microsoft World Wide Web site at http://www.microsoft.com/msoffice 
MSN(tm), The Microsoft Network using go word: wordprankfix 
The Word forums on other on-line services such as CompuServe¨ and 
America Online¨ 
Customers can also get the tool by calling Microsoft's Product Support 
Services at 206-462-9673 for Word for Windows, and 206-635-7200 for Word 
for the Macintosh. 


Removal: Mac: SAM 4.0.8 finds and removes this virus.
PC: F-PROT 2.20 detects