[20827] in APO-L
Re: Virus Alert
daemon@ATHENA.MIT.EDU (Robert Dean)
Sat Sep 4 18:01:52 1999
Date: Sat, 4 Sep 1999 17:00:25 -0500
Reply-To: Robert Dean <deanrl@GTE.NET>
From: Robert Dean <deanrl@GTE.NET>
To: APO-L@LISTSERV.IUPUI.EDU
The requirement for getting infected by a Word Macro virus is the
ability to run Word macros (Visual Basic for Applications scripts).
Such a program then could run the virus and infect other Word
documents. The program's native files wouldn't get infected unless they
were structured like Word documents.
LFS,
Robert Dean
Section 48 Communications Chair
"Christine L. Rainsford" wrote:
>
> I just have one question. You say that if someone
> doesn't have Word 97 on their PC, they don't have to
> worry. An article I read said that an infected Word
> 97 document attached to an e-mail, if opened by the
> receiver, can pass the virus on to a computer without
> Word 97. Something to do with converting it from Word
> 97 to WordPerfect activating the virus on the
> receiver's computer. Is there any truth to that?
>
> In LF&S,
>
> Christine L. Rainsford
> Alpha Delta Eta alum
> Life Member #18074
>
> --- Derek Cashman <cashman@YAHOO.COM> wrote:
> > ** If you do not care about this virus alert and
> > prefer to risk all the data on your hard drive,
> > kindly
> > hit "DELETE" now. ;-) **
> >
> > This has been VERIFIED by Network Associates, the
> > producer of the McAfee Virus Protection Package, and
> > is POSTED to their web site:
> >
> > http://www.nai.com/ (virus alert link on front
> > page)
> >
> > This is a particularly devastating virus and can
> > affect anyone who uses Microsoft Word (wordperfect
> > users need not worry unless someone uses microsoft
> > word on your computer).
> >
> >
> > Virus Name
> > W97M/Thus.a
> >
> > Date Updated
> > 9/1/99
> >
> > Virus Characteristics
> > This is a virus that infects Word 97 documents. The
> > virus consists of a module called ThisDocument. It
> > will infect Word's normal.dot file. When it infects
> > it
> > turns the Word 97 Macro Warning feature off.
> >
> > Prior to infecting a document, the virus will look
> > to
> > see if it has already infected the document by
> > checking for a comment - thus.000 - if this comment
> > is
> > found the virus will not reinfect.
> >
> > On the 13th of December when an infected document is
> > opened the virus will attempt to delete ALL files on
> > drive C: (including subdirectories).
> >
> > This virus has been reported to AVERT by various
> > banks
> > and financial organizations in Europe and the United
> > States.
> >
> > Indications Of Infection
> > There are no specific indications that a document
> > has
> > been infected.
> >
> > Method Of Infection
> > At this time it appears the documents have been
> > passed
> > from one organization to another.
> >
> > This virus DOES NOT use email to spread itself,
> > however as in many cases it can get from one place
> > to
> > the next as an attachment in an email message.
> >
> > Removal
> > For VirusScan 4x users, update your DATS from here.
> > For VirusScan 3x users, update your DATS from here.
> > For Dr Solomon's 7.95 and above users, an EXTRA.DRV
> > is
> > here.
> >
> > Virus Information
> >
> > Discovery Date:
> > 8/26/99
> >
> > Type:
> > Macro
> >
> > Risk Assessment:
> > High
> >
> > Minimum DAT:
> > 4041
> >
> > Variants
> > Unknown
> >
> > Aliases
> > Thus.a, W97M/Thursday
> >
> >
> >
> > ===
> >
> _________________________________________________________
> >
> > Derek Cashman (cashman@yahoo.com)
> > Graduate Student, Medicinal Chemistry
> > MCV / VCU
> > __________________________________________________
> > Do You Yahoo!?
> > Bid and sell for free at http://auctions.yahoo.com
> >
>
> __________________________________________________
> Do You Yahoo!?
> Bid and sell for free at http://auctions.yahoo.com
