Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Surround.A

This is a macro virus spreading in the Microsoft Word 97 environment. When an infected Word document is opened the virus creates the file C:\Surround.key on the disk and exports its code to it. At the same time the virus sets the attributes of the created file to Hidden and System. This causes that at the standard setting Windows Explorer will not display the file.
After that the virus changes the Word setting: it turns off the anti-virus protection, enables storing of an opened file on the background and disables displaying of the confirming dialogue at writing into the global template Normal.dot. Next the virus attacks the global template and opened documents.
The virus presents itself in two ways. The first one is that upon attacking the global template it beeps if the day is the 21st day of a month. The second manifestation is destructive. It is activated on December 29th and it deletes the file C:\WIN*\win.com. After the file is deleted the virus displays the following window:

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.