Summary
For background information on Word macro viruses, see the description of the WordMacro/Concept virus.
This is a complex Word macro virus. It activates on the 23rd of October. At this date it encrypts accessed Word documents with a random password.
It also might insert the following texts to documents:
NAENBGOURSG
Hello from GREECE.
On 24th of October the virus creates a file called PCGURU4.BAT to the current directory. This file contains the following lines:
@echo off
Rem PcGuru4 virus by NAENBGOURSG
Rem Golden Version 4.3
type PcGuru4.bat >> PcGuru4.bat
The virus also contains the following text:
'by NAENBGOURSG
'SO.HT.AI.KS
'231076 -- GREECE
'VRD 23-4-1997
'VRP A.U.A
Disinfection & Removal
Allow F-Secure Anti-Virus to disinfect the relevant files.
For more general information on disinfection, please see Removal Instructions.
Description Created: Mikko Hypponen, F-Secure
Submit a sample
Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)
F-Secure Community
Give advice. Get advice. Share the knowledge on our free discussion forum.