Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/ColdApe.B

W97M/ColdApe.B is a polymorphic macro virus operating in the Microsoft Word 97 environments. It attacks documents when they are closed and the global template normal.dot. It is derived from the virus W97M/ColdApe.A.
From the point of viewpoint of function this virus is almost identical with the W97M/ColdApe.A. The difference is only in the fact that polymorphic algorithm was added. That will ensure that to the end of the macro containing the virus always a line with the code commentary is added. In the commentary the name of the Word user, the text " Loves Nicky F. Also! " and the current date including time are located. These lines look as follows:

'Hugh G. Rection Loves Nicky F. Also! 11/14/98 10:56:30 AM

At the end of the file happy.vbs, as well as of the body of the virus W97M/ColdApe.B itself, there is the following text:

' Nick "The Love Monkey" v2 Virus Package by ALT-F4 and ALT-F11 for the Alternative Virus Mafia

In the script a4.vbs the address of the virus author is altered to avm@redneck.efga.org.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.