Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/FF.E

W97M/FF.E is a macro virus operating in the Microsoft Word 97 environment. It attacks active documents and the global template normal.dot.
When an infected document is opened the virus prohibits displaying of warning windows informing about macros conversion and saving templates. It turns off protection against viruses and deletes the item Tools/Macro in the Word menu. The virus exports its body into the file C:\FF.sys. Then, when infecting the global template and documents, it reads its code from this file. The virus attacks them when they are opened.
W97M/FF.E changes value of BootGUI in the file C:\Msdos.sys to 0. It causes that Windows at the nest system restart will not boot into the usual graphic interface but to the command line.

© 1992-2003 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.