Summary

For more information on Word macro viruses, see WordMacro/Concept.

WordMacro/Appder consists of three macros. It also contains a destructive activation routine. After 20 infected files, the virus tries to delete the following files:

     C:\DOC\*.EXE
     C:\DOC\*.COM
     C:\WINDOWS\*.EXE
     C:\WINDOWS\SYSTEM\*.TTF
     C:\WINDOWS\SYSTEM\*.FOT

If the virus succeedes, Windows will not boot after this.

WordMacro/Appder contains this text:

        Virus - NTTHNTA

WordMacro/Appder has been reported in the wild during 1997.

[Analysis: Mikko Hypponen, F-Secure]