
The messages that F/WIN 3.11 produces for the various KNOWN macro
viruses and trojans appear below.  If the infected file has a .DOC file
extension, an additional message will be produced that says:

- Contains macros but is named .DOC


          WordMacro.Boom
          ==============

- Contains 4 macros (2863 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN, AUTOEXEC, FILESAVEAS
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses 'Organize .Copy' to copy macros
- Uses the 'FileSaveAs' macro command
- Disables NORMAL.DOT write access warnings
- Enables the quick save option
  Seems to be infected with a macro virus!


          WordMacro.Colors
          ================

- Contains 9 macros (6470 bytes)
- System macros: AUTOOPEN, AUTOCLOSE, AUTOEXEC, FILEEXIT, FILESAVE,
                 FILESAVEAS, FILENEW, TOOLSMACRO
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Reenables auto macro processing
- Disables NORMAL.DOT write access warnings
  Seems to be infected with a macro virus!


          WordMacro.Concept
          =================

- Contains 4 macros (1968 bytes)
- System macros: AUTOOPEN
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!


          WordMacro.Date
          ==============

- Contains 1 macro (1042 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses 'Organize .Copy' to copy macros
- Uses the 'FileSaveAs' macro command
- Disables NORMAL.DOT write access warnings
  Seems to be infected with a macro virus!


          WordMacro.Devina
          ================

- Contains 1 macro (2357 bytes)
- Contains macros but is named .DOC
- System macros: AUTOCLOSE
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses 'Organize .Copy' to copy macros
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!


          WordMacro.DMV
          =============

- Contains 1 macro (3002 bytes)
- System macros: AUTOCLOSE
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!


          WordMacro.Doggie
          ================

- Contains 3 macros (610 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN, FILESAVEAS
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!


          Winword.Trojan.FormatC
          ======================

- Contains 1 macro (81 bytes)
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Execute other DOS or Windows programs! (Shell)
  Seems to contain a trojan macro!


          WordMacro.Guess
          ===============

- Contains 1 macro (1126 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!



          WordMacro.Hot
          =============

- Contains 4 macros (5515 bytes)
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!


          WordMacro.Imposter
          ==================

- Contains 2 macros (907 bytes)
- System macros: AUTOCLOSE
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!


          WordMacro.KillDLL
          =================

- Contains 1 macro (284 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Deletes other files! (Kill)
  Seems to be infected with a macro virus!



          WordMacro.LBYNJ
          ===============

- Contains 7 macros (22256 bytes)
- System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILEOPEN, FILENEW
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Execute other DOS or Windows programs! (Shell)
- Writes into other files directly (Write)
- Reenables auto macro processing
  Seems to be infected with a macro virus!


          WordMacro.Nuclear
          =================

- Contains 8 macros (10712 bytes)
- System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILESAVEAS
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Execute other DOS or Windows programs! (Shell)
- Writes into other files directly (Write)
- Deletes other files! (Kill)
- Disables NORMAL.DOT write access warnings
- Changes DOS attributes of other files
  Seems to be infected with a macro virus!


          WordMacro.Wazzu
          ===============

- Contains 1 macro (644 bytes)
- System macros: AUTOOPEN
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
  Seems to be infected with a macro virus!


          WordMacro.Xenios
          ================

- Contains 11 macros (31342 bytes)
- System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILESAVE, FILEOPEN,
                 FILESAVEAS, TOOLSMACRO
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Execute other DOS or Windows programs! (Shell)
- Writes into other files directly (Write)
- Reenables auto macro processing
- Disables NORMAL.DOT write access warnings
- Changes DOS attributes of other files
  Seems to be infected with a macro virus!




Here's a quick-reference chart sorted in the following order:

1st - by number of macros F/WIN found
2nd - by how many bytes all the macros utilize


     Virus Name               Nbr Macros/Bytes
     ----------               ----------------

     Winword.KillDLL          Contains 1 macro (284 bytes)
     Winword.Wazzu            Contains 1 macro (644 bytes)
     Winword.Date             Contains 1 macro (1042 bytes)
     Winword.Guess            Contains 1 macro (1126 bytes)
     Winword.Devina           Contains 1 macro (2357 bytes)
     Winword.Imposter         Contains 2 macros (907 bytes)
     Winword.Doggie           Contains 3 macros (610 bytes)
     Winword.Atom             Contains 4 macros (1029 bytes)
     Winword.Concept          Contains 4 macros (1968 bytes)
     Winword.Boom             Contains 4 macros (2863 bytes)
     Winword.Hot              Contains 4 macros (5515 bytes)
     Winword.Colors           Contains 9 macros (6470 bytes)
     Winword.Nuclear          Contains 9 macros (10556 bytes)
     Winword.Xenios           Contains 11 macros (31342 bytes)

     If the infected Word template contained macros in it before
     it was infected, then some of those original harmless macros
     could still be present.  In that case, the counts above
     would not match the counts you'd normally see for each
     particular virus.  For instance, if a template contained 2
     macros totaling 1000 bytes before being infected with the
     Concept virus, F/WIN's count would include those original
     macros plus those that were copied into the file by the
     Concept virus.  So in this example, F/WIN might produce the
     following line for Concept:

     - Contains 6 macros (2968 bytes)

