AmiProMacro/Green Stripe
is a macro virus which has been discovered in January 1996.This virus infects Ami Pro document files (*.SAM) by creating for every .SAM file a corresponding .SMM (Ami Pro macro) file with the same name in the same directory and linking .SAM to .SMM in such a way that opening .SAM invokes execution of the .SMM. .SMM files are hidden and cannot be seen with a simple DIR command - DIR /AH will work though.
When an infected document is opened, the virus gets control and infects all *.SAM files in the current directory which is always Ami Pro's default DOCS directory (...AMIPRODOCS). The process is very noticeable since all the doc files are opened and then closed one by one and a user can see them quickly appearing/disappearing on the screen.
Then the virus intercepts File/Save and File/Save As commands. On File/Save As the virus infects the document being saved. And this is the only way the virus can propagate to another computer. Since both .SAM and .SMM files are necessary for the virus and since .SAM file contains an absolute pathname as a reference to the appropriate .SMM file, if one simply copies either .SAM or both .SAM and .SMM files to a floppy and then opens .SAM under Ami Pro on a different computer, the virus won't run. But when a document (.SAM) is copied using File/Save As both .SAM and .SMM are transferred and the pathname link is changed accordingly.
File/Save was supposed to be used for the virus' payload. On File/Save the virus should replace all occurences of "its" in the document with "it's". Unlike with Word macro viruses, this Ami Pro virus is very unlikely to be transmitted by Email. Again, this is due to the fact that Ami Pro keeps macros in separate .SMM files, while only .SAM file is sent as a cc:Mail attachment.
The name of the virus "Green Stripe" is taken from the virus itself. It's main macro procedure is called Green_Stripe_virus.
Detection is made easier by the following factors:
Firstly, as mentioned above, when an infected document is opened it is very noticeable - the screen keeps blinking as numerous documents are loaded and then closed.
Secondly, after loading a document, one can go to Tools/Macros/Edit and see whether the document has an appropriate macro file (same name, .SMM) assigned to it to be executed on open.
