F-Secure Virus Descriptions : Angus
For background information on Word macro viruses, see the description of
the WordMacro/Concept virus.
This is a complex Word macro virus. It activates on the 23rd of
October. At this date it encrypts accessed Word documents with a
random password.
It also might insert the following texts to documents:
NAENBGOURSG
Hello from GREECE.
On 24th of October the virus creates a file called PCGURU4.BAT to the
current directory. This file contains the following lines:
@echo off
Rem PcGuru4 virus by NAENBGOURSG
Rem Golden Version 4.3
type PcGuru4.bat >> PcGuru4.bat
The virus also contains the following text:
'by NAENBGOURSG
'SO.HT.AI.KS
'231076 -- GREECE
'VRD 23-4-1997
'VRP A.U.A
[Analysis: Mikko Hypponen, F-Secure]
|
