Type Macro virus
Date Discovered 1996.06
Place of Origin Germany
Source Language
Platform MS Word
File Type(s) .doc
Infection Length 2 macro modules
Reported Costs

NOP is a family of language-specific word macro viruses.


NOP consists of two macros, AUTOOPEN and NOP. When an infected file is opened, these macros are written to NORMAL.DOC as NOP and DATEISPEICHERN. When documents are saved afterword, they become infected with the virus.


The original NOP was specific to the German language version of Microsoft Word. It may spread only under the German version, but the payloads function regardless of the language. Later variants were created for other language versions.

The original had no payload. NOP.B inserted the text "Testvirus" into newly infected documents. NOP.E replaces all instances of the text ". SAP" with ". SÅP".


NOP is also the name of an Assembly instruction, which stands fo
r "No Operation. Specifically, it means that after the instruction there is no change to the machine state. This instruction is commonly used in cracking software that checks for serial numbers. A technique used in buffer overflow and other exploits using this instruction is called the "NOP Slide". It is uncertain whether or not the creator(s) of this virus had this in mind when creating the virus.


McAfee Antivirus. Virus Profile: WM/NOP.A.

Kaspersky Labs., Virus.MSWord.Nop.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License