         AntiViral Toolkit Pro identifies a NEW computer Virus!
         ======================================================
         

 The computer virus infects the WinWord documents
 ------------------------------------------------

New computer virus has been discovered - the virus that infects (not 
overwrites!) the DOC-files of the WinWord ver.6 format. That virus has 
been 
named as WW6MACRO.

The virus uses a absolutely new and unusual infection routine. It does 
not
hit executables (COM, [New] EXE, SYS or BAT) files, is does not overwrite 
the 
system boot sectors. That virus infects Word Document files only.

The system gets infected while READING the infected file.  To infect the 
computer is it necessary only to run WinWord ver.6 and open the infected 
file.  Then the virus infects all the newly created DOC files.  After 
sending the newly created and infected file to another (clear) computer 
that file can infect that computer too (while opening in WinWord).

Fortunately, the virus does not call any dangerous trigger routine, the 
place for that routine contains only the string:

 That's enough to prove my point

But it is not clear that the virus is free of other "deep" effects 
(i.e. is that virus 100% compatible with WinWord or not). Anyway, the 
virus is a VERY FAST INFECTOR. The DOC files are sent/received more often 

than executables.  

So, be careful with documents!


Tech part
---------

While opening a Word Document file WinWord executes the internal file 
macros. If that document is infected, WinWord executes the *infected*
macros, i.e. the virus code. The virus copies the macros into the Global
Macros area, defines FileSaveAs macro, and then it copies its macros into
all the newly created documents (i.e. documents are saves with "Save as"
command). The virus also converts the Microsoft Document files into
Template format while saving.

On exiting from WinWord the Global Macros are automatically saved into 
system DOT-files (NORMAL.DOT or other).  So on next WinWord execution the 

virus receives control before reading of the first document, it infects 
the 
environment while loading the Global Macros from DOT file.

The infected files contains the strings:

 see if we're already installed
 iWW6IInstance
 AAAZFS
 AAAZAO
 That's enough to prove my point

and other.

The WINWORD6.INI on infected system contains the file:

 WW6I= 1

On the first execution of the virus code (i.e. on the first opening of 
the 
infected file) the MessageBox with digit "1" appears.


Comments
--------

1. The virus can hit the WinWord6 files on any computer, not only IBM-PC.
The virus works very well under WinWord7 and WinWord6 for NT  


The latest update for AntiViral Toolkit Pro will detect this virus in
Redundant mode. A FREEWARE special disinfection routine for your
WinWord DOC files has been release by Eugene Kaspersky author of
AntiVIral Toolkit Pro.  You may obtain a copy from the ftp site listed
below.

Contact your nearest AVP distributor if you suspect this infection.



=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Keith A. Peer                 Phone: 216-273-2820
Central Command Inc.
P.O. Box 856                  USA Distributor for
Brunswick, Ohio 44212        AntiViral Toolkit Pro
E-Mail: keith@command-hq.com
Ftp: ftp.command-hq.com /pub/command
WWW: http://www.command-hq.com/command
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
