home *** CD-ROM | disk | FTP | other *** search
- [ATOM WordMacro Virus Information]
- ----------------------------------------------------
-
- WordMacro/ATOM
-
- ATOM consists of 4 macros - AutoOpen, FileOpen,
- FIleSaveAs, and ATOM - all of which are
- execute-only.
-
- When an infected document is opened, ATOM infects
- the global template. If the auto macros are
- disabled, the virus is rendered ineffective. ATOM
- does not turn off the prompting when saving the
- global template, so if prompting is turned on you
- will be prompted to save changes to the global
- template at the end of the session.
-
- After the global template is infected, ATOM calls
- its first destructive payload. If the current date
- is December 13, the virus deletes all files in the
- current directory.
-
- Once the virus is active (i.e., it has infected the
- global template), it infects all documents which are
- saved via the FileSaveAs command or which are opened
- via the FileOpen command. If the seconds field of
- the current time is 13 at the time of infection ,
- the virus encrypts the document being saved with the
- password "ATOM#1".
-
- WordMacro/ATOM is not known to be in the wild.
-