MACRO/OFFICE VIRUSES — THE HEADLINES

 2001/7/25 

WM97/Marker-C & WM97/Marker-GU

 2001/5/18 

WM97/Thus-EF

 2001/3/20 

XM97/Divi-AE, XM97/Divi-W & XM97/Divi-Y

 2001/3/19 

WM97/Doccopy-A, WM97/E4 & WM97/Pizdec-A

 2001/3/13 

WM97/Myna-AI, WM97/Myna-AJ & WM97/Myna-AK

MACRO/OFFICE VIRUSES — THE LINKS

• Sophos Antivirus

  Disclaimer: These hyper-links to external content may be submitted by visitors of this site. Their contents do not represent the opinion of this publication. The links will be reviewed by an editor and may be modified, rejected or deleted at any time.

MACRO/OFFICE VIRUSES — THE NEWS

2001/7/25

11:01 +0100

WM97/Marker-C & WM97/Marker-GU

[Macro- & Office Viruses] WM97/Marker-C is a variant of the WM97/Marker-A Word macro virus family, which is now in the virus top-ten charts for years. Sophos has received many reports of this virus from the wild. The respective IDE has been updated to detect many new variants of the WM97/Marker virus family.

Whenever a document is closed, the virus FTPs user information from Word to the Codebreakers site and appends this information to the bottom of the macro as comments.

Sophos Anti-Virus is capable of detecting many new variants of the WM97/Marker virus family as WM97/Marker-C. These other variants may not exhibit the same payload as the original virus.

WM97/Marker-GU is a corrupted but viable new variant of the WM97/Marker-C Word macro virus. At the time of writing Sophos has received just one report of this virus from the wild. :: [dre].

Comments (0)

2001/5/18

11:19 +0100

WM97/Thus-EF

[Macro- & Office Viruses] WM97/Thus-EF is one of many Word macro viruses. Other than most of them, this one does not just replicate but is a real nuisance:

On the 13th or 26th of any month, this virus will display the "Attention! Do everything, your computer tells you!" when a document is closed. The virus then asks you to enter your name, and displays the message "Do you know, you're the greatest stupid lamer? If no please call WWW.MICROSOFT.COM". On August 13th, or during December, the virus will shut down Windows whenever a document is closed.

An IDE file that enable Sophos Anti-Virus to detect this Microsoft Office virus is available at their Web site. :: [dre].

Comments (0)

2001/3/20

10:27 +0100

XM97/Divi-AE, XM97/Divi-W & XM97/Divi-Y

[Macro- & Office Viruses] The following viruses are all variants of the XM97/Divi-A Microsoft Excel macro virus.

XM97/Divi-AE creates a file called BASE5874.XLS in the Excel template directory, and will infect other spreadsheets as they are opened or closed. The virus adds a flag, in the form of a variable called IVID plus a hexadecimal number, to each file as it is infected. The virus uses this flag to determine whether the spreadsheet has already been infected.

XM97/Divi-W creates a file called ODR.XLS in the XLSTART subdirectory.

XM97/Divi-Y is just a minor variant of the XM97/Divi-A Excel macro virus with no special features.

IDE files that enable Sophos Anti-Virus to detect these Microsoft Office viruses are available at their Web site. :: [dre].

Comments (0)

2001/3/19

10:23 +0100

WM97/Doccopy-A, WM97/E4 & WM97/Pizdec-A

[Macro- & Office Viruses] WM97/Doccopy-A is a Word macro virus that infects Microsoft Word documents. The virus creates an infected file called saver.dll in the directory that Microsoft Word has been run from. The virus also creates a subdirectory under Microsoft's Word directory called Doc_Copy (for instance, C:\WORD\Doc_Copy) into which it places copies of infected files.

On the 20th of any month, WM97/E4 will create the file C:\start.exe and run it. start.exe is a copy of Joke/Win-Wobble.

WM97/Pizdec-A has a main function named Virus that is called when you open or close a document.
In addition, a message box containing non-English characters will appear when you choose one of a selsction of options from the menu bar. The same message appears if you attempt to view the VB virus code.
The virus also contains a function Pizdec, which will display another message box containing non-English characters seven days after first infection.

IDE files that enable Sophos Anti-Virus to detect these Microsoft Office viruses are available at their Web site. :: [dre].

Comments (1)

2001/3/13

16:38 +0100

WM97/Myna-AI, WM97/Myna-AJ & WM97/Myna-AK

[Macro- & Office Viruses]
WM97/Myna-AI is a Word macro virus. It is a minor variant of WM97/Myna-AF that does little more than replicate. It contains the phrase "This Document", which is used as a flag to check for the presence of the virus.

WM97/Myna-AJ is a minor variant of the WM97/Myna-J Word macro virus. It does little more than replicate and contains the phrase "MYNAMEISVIRUS", which is used as a flag to check for the presence of the virus.

WM97/Myna-AK is a variant of the WM97/Myna-D Word macro.

IDE files that enable Sophos Anti-Virus to detect these Microsoft Office viruses are available at their Web site. :: [dre].

Comments (0)