Summary

WordMacro/Counter virus was found in October 1997.

The virus contains a counter displaying the generation number of the virus. This counter is incremented with every infection.

Additional Details

The virus contains 6 macros: Generation, ToolsMacro, FileTemplate, FileSave, FileClose and FileExit (or FileExit0 in Normal.Dot). The last tree macros begin with the following text:

      ' ----------------------------
      ' | Written by Guy Incognito |
      ' |     Bedford, England     |
      ' |       on 26/09/97        |
      ' ----------------------------

To protect itself the virus disables Tools/Macro and File/Templates menus.

Some macros contain the following text lines as comments:

      But all I wanna do is reproduce, man!

      A generation counter

      You didn't say the magic word.

      Not in this house.

Probably the virus was written with idea to encrypt infected files when seconds are not 30, with password equals to amount of available disk space in bytes, but this part of virus body has been commented out.

[Analysis: Katrin Tocheva, F-Secure Ltd]