Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Lexar.A

W97M/Xaler.B, W97M/Relax

W97M/Lexar.A is a macro virus. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It consists of macros RELAX2, Document_Close, GOODSub and Document_Open.

After the infected document is opened the screen refreshing is switched off, and the warning message window indicating the attempt of writing into the global template NORMAL.DOT is inactivated. In order to achieve this it creates the file temp.tmp in the the root directory of C:, and exports its body body into it. Finally, the body is assigned to the variable keimeno where it keeps the virus code only.

The virus attacks the module ThisDocument of active document, and of global template if they do not begin with the string 'RELAX, by which recognizes W97M/Lexar.A documents already infected. The file is infected while opening or closing the document.

W97M/Lexar.A opens the active document even in the binary code, and it sets the byte value of 1 at the offset 0x35dh. This can cause the situation that some macro virus heuristics will not catch it. Then the virus allows refreshing the screen, and deletes the temporary file temp.tmp.

The virus contains an activation routine, which activates on 10th, 20th and 30th of April, August or December. It ads a portion of code to the file C:\Autoexec.bat displaying following text.

NOTE!!!
***
*****
*******
*****
***
Sometimes you must RELAX.
Please, RELAX while deleting all files in C:\
*****
*******
*****
ECHO GREECE
==================================
Press any key to continue . . .

After pressing the key the virus clears the screen and displays a message:

All files deleted!!!
Now, you have a clean COMPUTER.
*******
*******
Press any key to continue . . .

Then the system normally starts. The virus does not delete any file from hard disk.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.