[20825] in APO-L
Virus Alert
daemon@ATHENA.MIT.EDU (Derek Cashman)
Fri Sep 3 16:34:22 1999
Date: Fri, 3 Sep 1999 13:34:59 -0700
Reply-To: Derek Cashman <cashman@YAHOO.COM>
From: Derek Cashman <cashman@YAHOO.COM>
To: APO-L@LISTSERV.IUPUI.EDU
** If you do not care about this virus alert and
prefer to risk all the data on your hard drive, kindly
hit "DELETE" now. ;-) **
This has been VERIFIED by Network Associates, the
producer of the McAfee Virus Protection Package, and
is POSTED to their web site:
http://www.nai.com/ (virus alert link on front page)
This is a particularly devastating virus and can
affect anyone who uses Microsoft Word (wordperfect
users need not worry unless someone uses microsoft
word on your computer).
Virus Name
W97M/Thus.a
Date Updated
9/1/99
Virus Characteristics
This is a virus that infects Word 97 documents. The
virus consists of a module called ThisDocument. It
will infect Word's normal.dot file. When it infects it
turns the Word 97 Macro Warning feature off.
Prior to infecting a document, the virus will look to
see if it has already infected the document by
checking for a comment - thus.000 - if this comment is
found the virus will not reinfect.
On the 13th of December when an infected document is
opened the virus will attempt to delete ALL files on
drive C: (including subdirectories).
This virus has been reported to AVERT by various banks
and financial organizations in Europe and the United
States.
Indications Of Infection
There are no specific indications that a document has
been infected.
Method Of Infection
At this time it appears the documents have been passed
from one organization to another.
This virus DOES NOT use email to spread itself,
however as in many cases it can get from one place to
the next as an attachment in an email message.
Removal
For VirusScan 4x users, update your DATS from here.
For VirusScan 3x users, update your DATS from here.
For Dr Solomon's 7.95 and above users, an EXTRA.DRV is
here.
Virus Information
Discovery Date:
8/26/99
Type:
Macro
Risk Assessment:
High
Minimum DAT:
4041
Variants
Unknown
Aliases
Thus.a, W97M/Thursday
===
_________________________________________________________
Derek Cashman (cashman@yahoo.com)
Graduate Student, Medicinal Chemistry
MCV / VCU
__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com
