WordMacro/Atom
is another macro virus discovered in February 1996.Atom consists of 4 macros - AutoOpen, FileOpen, FIleSaveAs, and ATOM - all of which are executeonly.
When an infected document is opened, Atom infects the global template. If the auto macros are disabled, the virus is rendered ineffective. Atom does not turn off the prompting when saving the global template, so if prompting is turned on you will be prompted to save changes to the global template at the end of the session.
After the global template is infected, Atom calls its first destructive payload. If the current date is December 13, the virus deletes all files in the current directory.
Once the virus is active (i.e., it has infected the global template), it infects all documents which are saved via the FileSaveAs command or which are opened via the FileOpen command. If the seconds of the current time are equal to 13 at the time of infection , the virus encrypts the document being saved with the password ATOM#1.
It is not easy to give a search string for this virus: some of the replicants are usually in files passwordprotected by the virus, and thus contain no constant userdefinable search string.
WordMacro/Atom is not known to be in the wild.
