Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Nagem.A is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents.
After opening the infected document W97M/Nagem.A checks whether there is a macro with the name Magan_Macro in the global template. If it finds one it supposes that the template is already been infected. If it does not find one it exports its code to the file MaganM.BAS, imports it to the global template and then deletes this contemporary file.
The virus also attacks all active documents. Upon an attempt to call the menu item Tools/Macro it displays the following warning window:

The virus attacks documents when they are being saved and saved under a different name. Upon closing a document when the current date is higher that the 20th day in a month is sets to the document a password. If the current date is higher that the 10th day in a month the virus causes turning off the computer with a 50% chance.
In the virus body, as a note in the code is the following text:

' Distributed for Changes/Upgradation etc. in
'Open Source Code.
' If you are interested in developing,modifying,
'crypting etc. this document using your skills,
'you are FREE to do so.
' Don't forget to give credits also to
'"Anonymous Creater of Megan V1.0"
' Nick of course is Magan
' Best of Luck
' Explanation Also Included.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.