Fandom

Malware Wiki

NOP

1,336pages on
this wiki
Add New Page
Comments0 Share


NOP is a family of language-specific word macro viruses.

Behavior

NOP consists of two macros, AUTOOPEN and NOP. When an infected file is opened, these macros are written to NORMAL.DOC as NOP and DATEISPEICHERN. When documents are saved afterword, they become infected with the virus.

Variants

The original NOP was specific to the German language version of Microsoft Word. It may spread only under the German version, but the payloads function regardless of the language. Later variants were created for other language versions.

The original had no payload. NOP.B inserted the text "Testvirus" into newly infected documents. NOP.E replaces all instances of the text ". SAP" with ". SÅP".

Name

NOP is also the name of an Assembly instruction, which stands for "No Operation. Specifically, it means that after the instruction there is no change to the machine state. This instruction is commonly used in cracking software that checks for serial numbers. A technique used in buffer overflow and other exploits using this instruction is called the "NOP Slide". It is uncertain whether or not the creator(s) of this virus had this in mind when creating the virus.

Sources

McAfee Antivirus. Virus Profile: WM/NOP.A.

Kaspersky Labs. (SecureList) Virus.MSWord.Nop.

Original Article

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.