Newhope is a macro virus on Microsoft Windows with Microsoft Word.

There are 5 variants:

  • Virus.MSWord.NewHope
  • Virus.MSWord.NewHope.b
  • Virus.MSWord.NewHope.d
  • Virus.MSWord.NewHope.f
  • Virus.MSWord.NewHope.i


This macro virus replaces the default template NORMAL.DOT in Microsoft Word, so that every time a new document is saved, the virus would insert its viral code into these files.

Newhope, Newhope.d and Newhope.f would also delete files from the directory:

Trend PC-cillin 98

But it is disabled by the creator.


The virus activates in a random month, determined by the random number generator in the code.

Newhope and Newhope.d

When an infected document is opened, there will have to lines of message at the top of the document, with green font color and flashing border:


(something else may be displayed because of mojibake)

Translation (from Chinese Traditional):

There's always a dream, there's always a hope.

Additionally, every time the user attempts to type a symbol like comma, full-stop, the virus appends the following instead:


Translation (from Chinese Traditional):

New Taiwan. New country. New hope.

Newhope.b and f

These variants do not draw anything on the document.


This variant would display a message box on load:


Translation (from Chinese Traditional):

May be there exists the Bian's virus?

Other details

Newhope and Newhope.d contain the internal text string:


Newhope.i contains the internal text string:



The name of the virus mentioned in Newhope.i might not exist, however the person who is pointing to is the former president of Taiwan, Chen Shui-bian, resigned due to corruption. Many Taiwanese called him as "阿扁" instead of something like "陳總統" (President Chen).




Newhope macro virus review by danooct1