FANDOM


Newhope is a macro virus on Microsoft Windows with Microsoft Word.

There are 5 variants:

  • Virus.MSWord.NewHope
  • Virus.MSWord.NewHope.b
  • Virus.MSWord.NewHope.d
  • Virus.MSWord.NewHope.f
  • Virus.MSWord.NewHope.i

Behavior

This macro virus replaces the default template NORMAL.DOT in Microsoft Word, so that every time a new document is saved, the virus would insert its viral code into these files.

Newhope, Newhope.d and Newhope.f would also delete files from the directory:

Trend PC-cillin 98

But it is disabled by the creator.

Payload

The virus activates in a random month, determined by the random number generator in the code.

Newhope and Newhope.d

When an infected document is opened, there will have to lines of message at the top of the document, with green font color and flashing border:

有夢最美.希望相隨

(something else may be displayed because of mojibake)

Translation (from Chinese Traditional):

There's always a dream, there's always a hope.

Additionally, every time the user attempts to type a symbol like comma, full-stop, the virus appends the following instead:

新台灣.新國家.新希望

Translation (from Chinese Traditional):

New Taiwan. New country. New hope.

Newhope.b and f

These variants do not draw anything on the document.

Newhope.i

This variant would display a message box on load:

可能有阿扁病毒喔?

Translation (from Chinese Traditional):

May be there exists the Bian's virus?

Other details

Newhope and Newhope.d contain the internal text string:

有夢最美.希望相隨

Newhope.i contains the internal text string:

砍死你!阿扁病毒

Trivia

The name of the virus mentioned in Newhope.i might not exist, however the person who is pointing to is the former president of Taiwan, Chen Shui-bian, resigned due to corruption. Many Taiwanese called him as "阿扁" instead of something like "陳總統" (President Chen).

Videos

Virus.MSWord

Virus.MSWord.Newhope

Newhope macro virus review by danooct1