| NOP | |
|---|---|
| Type | Macro virus |
| Creator | |
| Date Discovered | 1996.06 |
| Place of Origin | Germany |
| Source Language | |
| Platform | MS Word |
| File Type(s) | .doc |
| Infection Length | 2 macro modules |
| Reported Costs | |
NOP is a family of language-specific word macro viruses.
Behavior
NOP consists of two macros, AUTOOPEN and NOP. When an infected file is opened, these macros are written to NORMAL.DOC as NOP and DATEISPEICHERN. When documents are saved afterword, they become infected with the virus.
Variants
The original NOP was specific to the German language version of Microsoft Word. It may spread only under the German version, but the payloads function regardless of the language. Later variants were created for other language versions.
The original had no payload. NOP.B inserted the text "Testvirus" into newly infected documents. NOP.E replaces all instances of the text ". SAP" with ". SÅP".
Name
NOP is also the name of an Assembly instruction, which stands fo
r "No Operation. Specifically, it means that after the instruction there is no change to the machine state. This instruction is commonly used in cracking software that checks for serial numbers. A technique used in buffer overflow and other exploits using this instruction is called the "NOP Slide". It is uncertain whether or not the creator(s) of this virus had this in mind when creating the virus.
Sources
McAfee Antivirus. Virus Profile: WM/NOP.A.
Kaspersky Labs. Securelist.com, Virus.MSWord.Nop.