RE: Concent Virus V6?

["Joe Pluta" <joepluta@xxxxxxxxxxxxxxxxx>]

> From: Chuck Lewis
>
> Joe,
>
> That was the FIRST virus written for Microsoft Word and is very
> common. It uses the marco stuff in MS...


Concept was indeed one of the earliest viruses, Chuck, but there have been a
million variants since (McAfee lists about 50).  This is the first time I've
seen this particular strain.  It's much more potent than a simple word
macro; the payload is an exe file that updates the registry, among other
things.

Here are some of the strings I found in the payload.  You can see that it's
a little more aggressive than a simple Word macro:

   System\CurrentControlSet\Services\VxD\MSTCP NameServer
   SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

And note the Copyright (C)2001 in the tagline:

   Concept Virus(CV) V.6, Copyright(C)2001, (This's CV, No Nimda.)