NPAD VIRUS

Information about the NPad virus:

This virus infects Word documents, templates and the NORMAL.DOT file of Word 6 and Word for Windows 95. The virus code is contained in one macro named "AutoOpen". The macro code of NPad is encrypted.

When the first infected document is opened by Word the virus gets control and it checks whether the Global Template file (NORMAL.DOT) is infected. If it is not infected then the virus copies its macros to NORMAL.DOT and there by infecting it. Then onwards the virus will be infecting all the new document files created in that computer.

NPad virus stores the number of files infected by it in a counter in the WIN.INI file. When the counter reaches 23 the virus will display the string "D0EUNPAD94, v.2.21, (C)Maret 1996, Bandung, Indonesia" on the status bar of Word. The counter will be set to zero then and the process starts all over again.

NPad virus first appeared in 1996 and it is in the wild.

Other names of NPad virus :
This worm is also known as WM/NPad, Indonesia, Jakarta and Word.NPad.