Fandom

Malware Wiki

Surround

1,321pages on
this wiki
Add New Page
Comments0 Share

Surround is a macro virus on Microsoft Word for Microsoft Windows.

It tries to delete the critical Win.com. However, due to the fact it only checks for the "WIN" directory, it will usually fail to do its payload otherwise.

PayloadEdit

When the document opens, it will talk about an upcoming concert. However, a passage of Basic code has been attached and has been activated. On the 29th of December, the worm is supposed to delete Win.com. However, it only checks if the directory is called "WIN" to delete win.com from there. If it does not find it, this fails with a run-time error. Through correction to the right directory if it is not named "WIN", the user can see the payload if it does not work.

The worm will display a message box "You have been surrounded". Attempting to restart will in turn destroy Windows 9x (Windows 95 and 98) and make it refuse to boot. The user would have to replace Win.com to restore function.

This virus has no effect on Windows NT based operating systems (like Windows NT 4.0 and 2000) (except deleting win.com if it is found. However, it is not a startup file on Windows NT and the computer will still boot) and seems to do little on Windows ME (as win.com is no longer the startup file for Windows)

VideosEdit

Surround Macro Virus01:20

Surround Macro Virus

Surrround Macro Virus: Credit to danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.