Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Seliuq.A

W97M/Seliuq.A is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents. Its presence is manifested by a macro with the name Aquiles existing in the attacked document.
After opening an infected document W97M/Seliuq.A turns off the Word anti-virus protection and hides the item of menu enabling access to the language Visual Basic editor. It also disables access to the item Tools/Macro. Then it searches for the presence of a macro with the name Aquiles in the global template. If there is not such a macro there the virus attacks the template. The virus attacks documents as they are opened and closed.
The virus records the complete route to each of the attacked documents in the file C:\systemDos. If length of this file exceeds 1024 bytes the virus deletes XXXXXX and in the end it deletes also the file C:\systemDos.
At the end of the virus body, as a note in its code, there is the following text:

'Al rio jactancioso, Dios le a puesto un vado. Malinke
'Y una vez mas el emperador interpuso su alma, claudIo
'esto es una modificacion, trato de llegar a la perfeccion

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.