Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Smac.D

W97M/Smac.D is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents. Its presence is manifested by existence of the macro with the name bdoc2 in the attacked document.
After an infected document is opened W97M/Smac.D turns off the Word anti-virus protection and disables displaying of warning at writing into the template as well as at macros conversion. According to the presence of the macro bdoc2 the virus finds out whether the global template and the active document have already been attacked. If they were not attacked yet the virus exports its code into the file c:\bdoc2.txt and attacks them.
The virus attacks documents as they are opened and closed. The virus deletes the file c:\bdoc2.txt when leaving Word. On September 2nd as well as on the 13th day in each month the virus displays windows with text.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.