For background information on Word macro viruses, see the description of the WordMacro/Concept virus.
This is a complex Word macro virus. It activates on the 23rd of October. At this date it encrypts accessed Word documents with a random password.
It also might insert the following texts to documents:
NAENBGOURSG Hello from GREECE.
On 24th of October the virus creates a file called PCGURU4.BAT to the current directory. This file contains the following lines:
@echo off Rem PcGuru4 virus by NAENBGOURSG Rem Golden Version 4.3 type PcGuru4.bat >> PcGuru4.bat The virus also contains the following text: 'by NAENBGOURSG 'SO.HT.AI.KS '231076 -- GREECE 'VRD 23-4-1997 'VRP A.U.A
Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.
Description Created: Mikko Hypponen, F-Secure