Macro Virus: WordMacro/Atom

WordMacro/Atom was found in February 1996. Its operating system and some code parts are quite similar to WordMacro/Concept, with the following differences:

• All the macros of this virus are encrypted (Word's execute-only feature);
• The virus replicates during file openings as well, in addition to saving files;
• The virus has 2 destructive payloads.

First activation happens on December 13. On this date, the virus attempts to delete all files in the current directory.

Second activation happens when a File/Save As command is issued and the seconds of the clock are equal to 13. At this point, the virus will password-protect the document, making it inaccessible to the user in the future. The password is set to be ATOM#1.

It is not easy to give a search string for this virus: some of the replicants are found in files password-protected by the virus, and thus contain no user-definable search strings.

Disabling automacros or the "Prompt to save GLOBAL.DOT" setting will make Atom unable to spread.