Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Bablas.A

W97M/Bablas.A is a macro operating in the Microsoft Word 97 environments. It attacks active documents and the global template normal.dot.
After an infected document is opened the virus alters text in the heading in the windows of Word and the active document. After that it attacks the global template normal.dot. Text in the Word window heading is altered to “Bpp Hacker is now activating ", text in the active window heading is changed to "(I Don't mean to disturb.)". When attacking documents the virus turns the Word anti-virus protection off and disables displaying of warning at writing into the templates a confirming their saving. After attacking the global template the virus changes the altered texts in the windows headings back to the original ones.
After operating in the the global template W97M/Bablas.A attacks documents when they are being closed and saved. It manipulates items in the Word menu. It makes the items Tools/Macro, Tools/Templates and complements as well as the Visual Basic editor not accessible. Instead of them the virus displays the following window:

Instead of information on Word in the item menu Help/About Microsoft Word the virus displays window:

When closing a document, if it is Friday or Saturday and it is not 9 o’clock pm yet, the virus W97M/Bablas.A beeps 100 times and displays the following window:

In the virus body is the following text:

' ##### Innama a'malu binniyat #####
' Saya hanya berusaha melindungi komputerku, dan tentu juga komputer-
' teman-teman dari terinfeksinya virus macro yang merugikan.
' Semoga Allah melindungi kita semua

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.