Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Threats » W97M/Story

Overview

Threat Risk LOW LOW
Destructivity NONE NONE
Payload
Detection files published
Description created 17 Apr 2000 03:00:00
Description updated 17 Apr 2000 03:00:00
Malware type VIRUS
Alias
Spreading mechanism FILE_INFECTION
IRC
Summary None

W97M/Story

Spreading

W97M/Story infects MS Word 97 documents. An indication of this virus is the presence of the file Story.doc, which is created by the virus in the C:\Windows\ directory.It starts to turn off the VirusProtection and disables the Word menus, "Tools/Macro", "Tools/Customize...", "View/Toolbars" and "View/Status Bar". The virus has a comment line, "'Jack-In-The-Box", that the virus uses to perform a check to separate infected and clean documents. If both "Normal Template" and the "Active Document" already are infected the virus jumps out of the procedure, else the clean one will be infected.The virus also has some worm ability and may be able to spread itself via IRC channels. It checks the presence of the file c:\mirc\mirc32.exe. If this file exists, it will disable the security warning messages and create c:\mirc\script.ini and insert code to run a IRC session. During the IRC session the c:\windows\story.doc created by the virus, will be sent. When a connection is made to an IRC server, there is a 1/8 probability that the script will send an email to a random anti-virus vendor's support email address. If mIRC is installed in another folder than c:\mirc, the virus will fail in the mIRC routine.

Payload Details

n/a

Analysis

n/a

Removal

n/a


Last Updated: 12 Nov 2015 11:06:12