RE: Word Macro virus called Concept (also known as the Prank
Virus), which affects Microsoft Word 6.0 for Windows and Word 6.0
and 6.0.1 for Macintosh users.
Please find outlined below the cause, symptoms, repair and
prevention of the virus for the Macintosh and PC workstations.
Cause:
===================
This virus is a non-destructive, but annoying, prank macro that
replicates itself in Microsoft Word's macro programming language.
This virus only affects Word documents, NOT the Word program.
Document content remains intact and is not changed in any way.
The macro copies itself into the Normal Template and then
replicates itself into the new files, which it saves as
templates.
These infected Word documents can be transmitted through our
e-mail system, through sharing of documents on diskettes or
accessing infected documents on a server.
Symptoms:
===================
The prank virus is not easily detected. When you open a Word
document the data content and formatting appear normal. The real
problem occurs when you edit an infected document and try to
perform a save or save as operation. Outlined below are some
ways to detect the presence of the prank virus.
- When you either save a Word mail attachment or pull across a
Word file from an Appleshare or ethernet connection and see that
the icon appears as a piece of paper with a `W' AND an arrow
pointing to right (indicating a template file). Normal Word
document icons appear as a piece of paper with lines of text and
a `W'.
- O R -
- When you try to save a document with either the File/Save or
File/SaveAs command and Word prompts you to save the file as a
Template.
- O R -
- When you open your macro list under Tools/Macro and see any of
the following files that did not appear in the list before:
AAAZAO, AAAZFS, AutoOpen or FileSaveAs. The macro PayLoad is
unaffected and therefore, should not be deleted.
Repair:
===================
1. To rid your application of the prank virus, you must remove
the macros as outlined below:
- Open the infected document.
- On the Tools menu, choose the Macro option.
- In the `Macros Available In' list, choose All Active Templates.
- Click on the macro named AAAZAO.
- Click on the Delete button. Click Yes when asked if you want
to delete the macro.
- Repeat these steps for the macros named AAAZFS, AutoOpen and
FileSaveAs.
Note: Please leave the macro named PayLoad in the template.
2. To correct any affected documents:
For the Macintosh:
==================
- Open a document that has been infected by the Concept virus (as
outlined in the symptoms section above).
- Select the entire document by pressing Apple+A or by selecting
Edit/Select All.
- Eliminate the document's final paragraph mark from the
selection by pressing Shift+Left Arrow.
- Choose Edit/Copy or Apple+C.
- Close the infected document with File/Close.
- Choose File/New. Select the template you want to use (usually
Normal) and click OK.
- Choose Edit/Paste or Apple+V.
- Save the document. (Be sure to delete the old infected
document!)
For the PC:
===========
- Open a document that has been infected by the Concept virus (as
outlined in the symptoms section above).
- Select the entire document by pressing Ctrl+A or by selecting
Edit/Select All.
- Eliminate the document's final paragraph mark from the
selection by pressing Shift+Left Arrow.
- Choose Edit/Copy or Ctrl+C.
- Close the infected document with File/Close.
- Choose File/New. Select the template you want to use (usually
Normal) and click OK.
- Choose Edit/Paste or Ctrl+V.
- Save the document. (Be sure to delete the old infected
document!!)
Hope this helps those who caught this bug... I seem to have
killed mine using the above process.
Good Luck
Gordon
