Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Threats » W97M/Corner.A

Overview

Threat Risk LOW LOW
Destructivity LOW LOW
Payload
Detection files published 25 Oct 1999 03:00:00
Description created 28 Oct 1999 03:00:00
Description updated 08 Nov 2001 02:35:00
Malware type VIRUS
Alias
Spreading mechanism FILE_INFECTION
Summary None

W97M/Corner.A

Spreading

When an infected document is loaded into Word, the virus will disable the Tools | Macro | Security option in Word 97 and the Tools | Macro | Security option in Word 2000. In the latter case, it will also reset the security to Low leaving the system vulnerable for attacks. The virus is a regular class-infector using a common technique to replicate to the gloabl template Normal.Dot and force a save. Every time a new document is opened or created, it will be infected.

Next, the virus will check if Microsoft Project 98 is also active. If this application is not present, the user will not see a messagebox as the virus has its own errorhandling and will continue to wait for the next victim. If Microsoft Project 98 is active, every time an infected document is opened or closed, the virus will infect a blank project.

When an infected project is loaded, the virus will infect other non-infected projects when they are deactivated. The virus will check if Microsoft Word active. If this application is not present, the user will not see a messagebox as the virus has its own errorhandling and will continue to wait for the next victim. If Microsoft Word is active, the virus will infect the global template and force a save.


Spreadability The Corner.A virus will only spread when documents and projects are shared or sent as an attachment of an e-mail. The virus does not contain any other way to mail itself though the viruscode indicates that the author tried to do that.

Payload Details

n/a

Analysis

n/a

Removal

n/a


Last Updated: 12 Nov 2015 11:06:11