Selected viruses, spyware, and other threats: sorted alphabetically
W97M/Titch.H is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents.
After an infected document is opened W97M/Titch.H turns off the Word anti-virus protection, disables displaying of warning at macros conversion but it enables warning at writing into the template. By the existence of the commentary 'UPC116STAG in the first line of its code the virus finds out whether the global template has already been attacked. If the template has not been infected it exports its code to the file c:\UPC116STAG.tmp and attacks it. After attacking the template the virus deletes this temporary file.
W97M/Titch.H attacks files when they are being closed. There are the following lines with commentaries in its body:
'An experiment in Macro programming ;)
'Minimum stealth, no encryption, No payload, No mail replication
'If you had looked you could have found and deleted it but..
'You probably never knew it was here!
'SAD CODE MODIFIED DEC 2000 FOR TRACKING IN HETHEL
© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.