WordMacro/NicDay is a macro virus which infects MS-Word when the infected document is opened. It does not have any destructive code, but will display a message when it activates.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
WordMacro/NiceDay consists of 4 macros which can have different names depending on if its a infected document or infected global template(NORMAL.DOT).
WordMacro/NiceDay consists of the following 4 macros.
Infected docNORMAL.DOT ---------------------------------- AutoExit AutoExit AutoOpen VOpen Payload Payload VCloseAutoClose
When the infected document is opened, the AutoOpen macro will be executed automatically and the global template will be infected with the 4 macros, but 2 of the macros (AutoOpen and VClose) will be renamed to VOpen and AutoClose respectively which will cause MS-Word to be infected by WordMacro/NiceDay.
The virus uses the AutoClose macro to infect all documents which are opened with an infected MS-Word to be infected by WordMacro/NiceDay when the documents are being closed.
WordMacro has one activation routine which resides in the AutoExit macro. This macro will be executed automatically when you exit MS-Word, will display the following message.
"Have a Nice Day!"
In the virus code which displays this message, the author has a code which determines if the date is April 1st, but regardless of the date it will always display the same message.
Note that AutoExit macro has the following description attached. "ScanProt macro to protect and disinfect your Normal (Global) template."
The Payload macro looks identical to WordMacro/Concept. It never activates and has the following code which makes me belive the author created this virus using code from WordMacro/Concept.
Sub MAIN REM That's enough to prove my point End Sub
VClose(AutoClose), is the macro which contains the code to infects documents once MS-Word(NORMAL.DOT) has been infected.
Note that VClose macro has the following description attached. "Installed to your NORMAL template as AutoClose to clean the prank macros from any documents that you open then close."
For users of localized versions of MS-Word(other than english), it may be important to note that this virus will probably not work. This is because the variable, "Global" is used to refer to the global template when the macro's are being copied.