The messages that F/WIN 3.11 produces for the various KNOWN macro viruses and trojans appear below. If the infected file has a .DOC file extension, an additional message will be produced that says: - Contains macros but is named .DOC WordMacro.Boom ============== - Contains 4 macros (2863 bytes) - Contains macros but is named .DOC - System macros: AUTOOPEN, AUTOEXEC, FILESAVEAS - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses 'Organize .Copy' to copy macros - Uses the 'FileSaveAs' macro command - Disables NORMAL.DOT write access warnings - Enables the quick save option Seems to be infected with a macro virus! WordMacro.Colors ================ - Contains 9 macros (6470 bytes) - System macros: AUTOOPEN, AUTOCLOSE, AUTOEXEC, FILEEXIT, FILESAVE, FILESAVEAS, FILENEW, TOOLSMACRO - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command - Reenables auto macro processing - Disables NORMAL.DOT write access warnings Seems to be infected with a macro virus! WordMacro.Concept ================= - Contains 4 macros (1968 bytes) - System macros: AUTOOPEN - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! WordMacro.Date ============== - Contains 1 macro (1042 bytes) - Contains macros but is named .DOC - System macros: AUTOOPEN - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses 'Organize .Copy' to copy macros - Uses the 'FileSaveAs' macro command - Disables NORMAL.DOT write access warnings Seems to be infected with a macro virus! WordMacro.Devina ================ - Contains 1 macro (2357 bytes) - Contains macros but is named .DOC - System macros: AUTOCLOSE - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses 'Organize .Copy' to copy macros - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! WordMacro.DMV ============= - Contains 1 macro (3002 bytes) - System macros: AUTOCLOSE - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! WordMacro.Doggie ================ - Contains 3 macros (610 bytes) - Contains macros but is named .DOC - System macros: AUTOOPEN, FILESAVEAS - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! Winword.Trojan.FormatC ====================== - Contains 1 macro (81 bytes) - System macros: AUTOOPEN - Contains execute-only macros (encrypted macros) - Execute other DOS or Windows programs! (Shell) Seems to contain a trojan macro! WordMacro.Guess =============== - Contains 1 macro (1126 bytes) - Contains macros but is named .DOC - System macros: AUTOOPEN - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! WordMacro.Hot ============= - Contains 4 macros (5515 bytes) - System macros: AUTOOPEN - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! WordMacro.Imposter ================== - Contains 2 macros (907 bytes) - System macros: AUTOCLOSE - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! WordMacro.KillDLL ================= - Contains 1 macro (284 bytes) - Contains macros but is named .DOC - System macros: AUTOOPEN - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command - Deletes other files! (Kill) Seems to be infected with a macro virus! WordMacro.LBYNJ =============== - Contains 7 macros (22256 bytes) - System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILEOPEN, FILENEW - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command - Execute other DOS or Windows programs! (Shell) - Writes into other files directly (Write) - Reenables auto macro processing Seems to be infected with a macro virus! WordMacro.Nuclear ================= - Contains 8 macros (10712 bytes) - System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILESAVEAS - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command - Execute other DOS or Windows programs! (Shell) - Writes into other files directly (Write) - Deletes other files! (Kill) - Disables NORMAL.DOT write access warnings - Changes DOS attributes of other files Seems to be infected with a macro virus! WordMacro.Wazzu =============== - Contains 1 macro (644 bytes) - System macros: AUTOOPEN - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command Seems to be infected with a macro virus! WordMacro.Xenios ================ - Contains 11 macros (31342 bytes) - System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILESAVE, FILEOPEN, FILESAVEAS, TOOLSMACRO - Contains execute-only macros (encrypted macros) - Copy macros into the global template ('CopyMacro') - Uses the 'FileSaveAs' macro command - Execute other DOS or Windows programs! (Shell) - Writes into other files directly (Write) - Reenables auto macro processing - Disables NORMAL.DOT write access warnings - Changes DOS attributes of other files Seems to be infected with a macro virus! Here's a quick-reference chart sorted in the following order: 1st - by number of macros F/WIN found 2nd - by how many bytes all the macros utilize Virus Name Nbr Macros/Bytes ---------- ---------------- Winword.KillDLL Contains 1 macro (284 bytes) Winword.Wazzu Contains 1 macro (644 bytes) Winword.Date Contains 1 macro (1042 bytes) Winword.Guess Contains 1 macro (1126 bytes) Winword.Devina Contains 1 macro (2357 bytes) Winword.Imposter Contains 2 macros (907 bytes) Winword.Doggie Contains 3 macros (610 bytes) Winword.Atom Contains 4 macros (1029 bytes) Winword.Concept Contains 4 macros (1968 bytes) Winword.Boom Contains 4 macros (2863 bytes) Winword.Hot Contains 4 macros (5515 bytes) Winword.Colors Contains 9 macros (6470 bytes) Winword.Nuclear Contains 9 macros (10556 bytes) Winword.Xenios Contains 11 macros (31342 bytes) If the infected Word template contained macros in it before it was infected, then some of those original harmless macros could still be present. In that case, the counts above would not match the counts you'd normally see for each particular virus. For instance, if a template contained 2 macros totaling 1000 bytes before being infected with the Concept virus, F/WIN's count would include those original macros plus those that were copied into the file by the Concept virus. So in this example, F/WIN might produce the following line for Concept: - Contains 6 macros (2968 bytes)