[20826] in APO-L
Re: Virus Alert
daemon@ATHENA.MIT.EDU (Christine L. Rainsford)
Sat Sep 4 15:21:10 1999
Date: Sat, 4 Sep 1999 12:18:42 -0700
Reply-To: "Christine L. Rainsford" <corporateslave@YAHOO.COM>
From: "Christine L. Rainsford" <corporateslave@YAHOO.COM>
To: APO-L@LISTSERV.IUPUI.EDU
I just have one question. You say that if someone
doesn't have Word 97 on their PC, they don't have to
worry. An article I read said that an infected Word
97 document attached to an e-mail, if opened by the
receiver, can pass the virus on to a computer without
Word 97. Something to do with converting it from Word
97 to WordPerfect activating the virus on the
receiver's computer. Is there any truth to that?
In LF&S,
Christine L. Rainsford
Alpha Delta Eta alum
Life Member #18074
--- Derek Cashman <cashman@YAHOO.COM> wrote:
> ** If you do not care about this virus alert and
> prefer to risk all the data on your hard drive,
> kindly
> hit "DELETE" now. ;-) **
>
> This has been VERIFIED by Network Associates, the
> producer of the McAfee Virus Protection Package, and
> is POSTED to their web site:
>
> http://www.nai.com/ (virus alert link on front
> page)
>
> This is a particularly devastating virus and can
> affect anyone who uses Microsoft Word (wordperfect
> users need not worry unless someone uses microsoft
> word on your computer).
>
>
> Virus Name
> W97M/Thus.a
>
> Date Updated
> 9/1/99
>
> Virus Characteristics
> This is a virus that infects Word 97 documents. The
> virus consists of a module called ThisDocument. It
> will infect Word's normal.dot file. When it infects
> it
> turns the Word 97 Macro Warning feature off.
>
> Prior to infecting a document, the virus will look
> to
> see if it has already infected the document by
> checking for a comment - thus.000 - if this comment
> is
> found the virus will not reinfect.
>
> On the 13th of December when an infected document is
> opened the virus will attempt to delete ALL files on
> drive C: (including subdirectories).
>
> This virus has been reported to AVERT by various
> banks
> and financial organizations in Europe and the United
> States.
>
> Indications Of Infection
> There are no specific indications that a document
> has
> been infected.
>
> Method Of Infection
> At this time it appears the documents have been
> passed
> from one organization to another.
>
> This virus DOES NOT use email to spread itself,
> however as in many cases it can get from one place
> to
> the next as an attachment in an email message.
>
> Removal
> For VirusScan 4x users, update your DATS from here.
> For VirusScan 3x users, update your DATS from here.
> For Dr Solomon's 7.95 and above users, an EXTRA.DRV
> is
> here.
>
> Virus Information
>
> Discovery Date:
> 8/26/99
>
> Type:
> Macro
>
> Risk Assessment:
> High
>
> Minimum DAT:
> 4041
>
> Variants
> Unknown
>
> Aliases
> Thus.a, W97M/Thursday
>
>
>
> ===
>
_________________________________________________________
>
> Derek Cashman (cashman@yahoo.com)
> Graduate Student, Medicinal Chemistry
> MCV / VCU
> __________________________________________________
> Do You Yahoo!?
> Bid and sell for free at http://auctions.yahoo.com
>
__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com
