1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar







For background information on Word macro viruses, see the description of the WordMacro/Concept virus.

This is a complex Word macro virus. It activates on the 23rd of October. At this date it encrypts accessed Word documents with a random password.

It also might insert the following texts to documents:

        Hello from GREECE.

On 24th of October the virus creates a file called PCGURU4.BAT to the current directory. This file contains the following lines:

   @echo off
     Rem PcGuru4 virus by NAENBGOURSG
     Rem Golden Version 4.3
     type PcGuru4.bat >> PcGuru4.bat
     The virus also contains the following text:
     '231076 -- GREECE
     'VRD 23-4-1997
     'VRP A.U.A

Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Description Created: Mikko Hypponen, F-Secure

Submit a sample

Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.