Macro Virus: Wordmacro/ColorsName: WordMacro/Colors
Type: Word Macro Virus
This macro virus was posted to a Usenet newsgroup on the 14th of October, 1995. It is also known as the Rainbow virus. Colors most likely comes from Portugal.
This macro virus infects Word documents in a similar manner as the previous Word macro viruses, except that it does not rely only on the auto-execute macros to operate. The virus can propagate even with AutoMacros being disabled (e.g. by invoking Word as : WINWORD.EXE /mDisableAutoMacros or by using one of Microsoft's recent antivirus template tools).
As soon as a user chooses File/New, File/Save, File/SaveAs, File/Exit or Tools/Macro, the virus gets control and infects NORMAL.DOT.
Colors contains the following macros:
When an infected document is opened, the virus will execute when user:
It is important not to use the Tools/Macro command to check if you are infected with this virus, as you will just execute the virus while doing this. Instead, use File/Templates/Organizer/Macros command to detect and delete the offending macros. Do note that a future macro virus will probably subvert this command as well.
The virus maintains a generation counter in WIN.INI, where a line "countersu =" in the [windows] part is increased during the execution of the macros. After every 300rd increments the virus will modify the system color settings; the colors of different Windows objects will be changed to random colors after next boot-up. This activation routine will not work under Microsoft Word for Macintosh.
WordMacro/Colors seems to be carefully written; The virus even has a debug mode built-in.
F-PROT Professional is able to detect the WordMacro/Colors macro virus, by directly copying the following lines to a file called USER.DEF in your F-PROT for DOS directory:
To scan for the user-defined virus string, either configure F-PROT to scan all files, or add the filename extension ".DO?" to the list of files F-PROT should scan.
It is recommended that you simply scan all files in case a non-standard filename extension is used for documents. Under the Targets menu item turn on User-defined Virus Strings.