Category: Malware

Type: -

Aliases: Angus


For background information on Word macro viruses, see the description of the WordMacro/Concept virus.

This is a complex Word macro virus. It activates on the 23rd of October. At this date it encrypts accessed Word documents with a random password.

It also might insert the following texts to documents:


Hello from GREECE.

On 24th of October the virus creates a file called PCGURU4.BAT to the current directory. This file contains the following lines:

 @echo off

Rem PcGuru4 virus by NAENBGOURSG

Rem Golden Version 4.3

type PcGuru4.bat >> PcGuru4.bat

The virus also contains the following text:



'231076 -- GREECE

'VRD 23-4-1997



Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.