Summary
W97M/Arbeit is a Word 97 macro virus with a destructive payload.
Disinfection & Removal
Allow F-Secure Anti-Virus to disinfect the relevant files.
For more general information on disinfection, please see Removal Instructions.
Technical Details
Variant:Arbeit.A
When an infected document is opened, W97M/Arbeit.A disables the built-in macro virus protection, the status bar and the following menus: "Tools/Macros/Macro" and "Tools/Macros/Visual Basic Editor". It also modifies the user name and initials to:
User name: NoWork Inc.
Initials: NWI
Then the virus creates a temporary file "C:\mlpog.sys" that it uses to infect the global template and all documents closed after that.
The virus activates its payload every day after October 15th, when it shows a message box with the following text:
The technology will be kill humaneness
After the message box has been shown, it deletes all files from the root directory of the "C:" drive.
Description Created: Analysis: Sami Rautiainen, F-Secure
Submit a sample
Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)
F-Secure Community
Give advice. Get advice. Share the knowledge on our free discussion forum.