Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Nono.A is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents.
After opening an infected document W97M/Nono.A turns off the Word anti-virus protection and disables displaying of warning on storing the global template. Then it attacks the global template by adding to it a module with name created by the initials of the Word user. Before adding the module the virus exports it into a file with identical name as the initials of the user are. The file will be located in the disk C: root directory.
The virus disables the Word menu items Tools/Macro/Macros and Tools/Macro/Editor of the language Visual Basic.
If activation of the virus occurs at the time when the number of minutes on the internal computer clock is 30 and number of seconds is 15 the virus may demonstrate its activity in two ways. The first one is displaying a window if the day is the 10th in a month. The window looks as follows:

After clicking on "Yes" the window is displayed again, upon clicking on "No" nothing happens. As the second form of demonstration the virus may alter the text in the Word window heading to "VicodinES /TNN /CB".
The virus attacks documents when they are closed.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.