Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Service.A

W97M/Service.A is a polymorphic macro virus spreading in the Microsoft Office environment. After opening an infected document it attacks the global template Normal.dot. That causes that each next document will be attacked by the virus. The documents are infected when they are being closed.
The virus is able of spreading also in electronic mail by means of Microsoft Outlook. Its spreading is limited to the first 50 e-mail addresses ending with the string ".fr". Before this routine is activated the virus checks presence of the variable "NOSN" with the value Non au Service National - Oui au Contrat de Travail in the system registry in HKEY_CURRENT_USER\Software\Microsoft\Office. If this variable already exists spreading by means of electronic mail will not take place.
In the virus are contained three variants of the message text with three different message subjects. They are all in French language and they should prompt the addressee to open the file in the message attachment. That file contains the attacked.
Polymorphism of the virus is simple and consists of adding commentaries to the code of the virus macro NOSN and of dividing its code to more lines, respectively.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.