     WinWord.Concept (WW6MACRO) - The Computer Virus that infects WinWord
     Documents
   
     A new computer virus has been discovered - the virus infects (but
     does not overwrite!) the DOC-files of the WinWord ver.6 format. This
     virus has been named as WinWord.Concept.
     
     The virus uses an absolutely new and unusual infection way. It does
     not hit executable (COM, [New] EXE, SYS or BAT) files, it does not
     overwrite the system boot sectors. It infects Word Document files.
     
     The system gets infected while READING the infected file. To infect
     the computer it is necessary to run WinWord ver.6 and open the
     infected file. Then the virus infects all newly created DOC files.
     After sending the newly created and infected file to another (clear)
     computer that file can infect that computer too (while opening in
     WinWord).
     
     Fortunately, this virus does not call any dangerous trigger routine.
     The place for that routine contains only the string:

 That's enough to prove my point

     But it is not clear up to now if that virus is free of other "deep"
     effects (i.e. is that virus 100% compatible with WinWord or not).
     Anyway, that virus is a VERY FAST INFECTOR. DOC files are
     sent/received more often than executables.
     
     So, be careful with documents!
     
    Tech part
    
     While opening the Word Document file WinWord executes the internal
     file macros. If that document is infected, WinWord executes
     *infected* macros, i.e. the virus code. The virus copies the macros
     into the Global Macros area, defines FileSaveAs macro, and then it
     copies its macros into all the newly created documents (i.e.
     documents which are saved with "Save as" command).
     The virus also converts the MicrosoftDocument files into Template
     format while saving.
     
     On exiting from WinWord the Global Macros are automatically saved
     into system DOT-files (NORMAL.DOT or other). So on the next WinWord
     execution the virus receives control before reading of the first
     document, it infects the environment while loading the Global Macros
     from the DOT file.
     
     The infected files contain the strings:

 see if we're already installed
 iWW6IInstance
 AAAZFS
 AAAZAO
 That's enough to prove my point

     and other.
     
     The WINWORD6.INI on infected system contains the file:

 WW6I= 1

     On the first execution of the virus code (i.e. on the first opening
     of the infected file) the MessageBox with digit "1" appears.
     
     &copy; Copyright 1995 Eugene V. Kaspersky - All Rights reserved.
     GV240895
