Macro.Word97.Nori
Description Macro.Word97.Nori
Nori is a dangerous macro virus that infects Microsoft Word documents upon opening or creating. As a result of the virus' activity the file "Iron.tmp" may appear in root folder of drive "C:".
On April 1st the virus checks the system registry's RegisteredOrganization key - if it is equal to "IRON" the virus destroys all files on drive "C:".
If the RegisteredOrganization key contains any other value the virus wipes out (deletes) the content of any document opened on April 1st.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.CheckF
Description Macro.Word.CheckF
This virus contains only one macro named ChekFuk in documents and AutoClose in the NORMAL.DOT. The virus infects documents on closing (AutoClose). It infects the global macros area on entering the form field in an infected document - the virus creates a form field in documents and sets the ChekFuk macro as entry-macro for this form field. This method allows the virus do not create auto-macro in documents.
The virus sets the "ChekWarez" password to modify documents' properties, including viewing macros in Tools/Macro menu. On 15th of any month the virus displays the MessageBox:
Do you use ChekMate/ChekWord?
Depending on user's reply the virus then displays one of MessageBoxes:
ChekFuk Virus
Do NOT use ChekWord or ChekMate.
They suck!
ChekFuk Virus
Thank you for NOT using ChekWare.
Macro.Word.Chill
Description Macro.Word.Chill
This is an encrypted macro virus. It contains two macros: AutoOpen, ToolsMacro (stealth). It writes itself to the global macros area and documents on opening (AutoOpen). It contains the text:
Chill Word Macro Virus
|