1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Labs
  2. Threats
  3. Virus and threat descriptions
    4. Arbeit

Arbeit



W97M/Arbeit is a Word 97 macro virus with a destructive payload.

VARIANT:Arbeit.A

Summary

When an infected document is opened, W97M/Arbeit.A disables the built-in macro virus protection, the status bar and the following menus: "Tools/Macros/Macro" and "Tools/Macros/Visual Basic Editor". It also modifies the user name and initials to: 

    User name:  NoWork Inc.
    Initials:   NWI


Then the virus creates a temporary file "C:\mlpog.sys" that it uses to infect the global template and all documents closed after that.

The virus activates its payload every day after October 15th, when it shows a message box with the following text: 

    The technology will be kill humaneness


After the message box has been shown, it deletes all files from the root directory of the "C:" drive.

[Analysis: Sami Rautiainen, F-Secure]