Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Arbeit


Aliases:

Arbeit

Malware
Virus
W97M

Summary

W97M/Arbeit is a Word 97 macro virus with a destructive payload.



Disinfection & Removal

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details


Variant:Arbeit.A

When an infected document is opened, W97M/Arbeit.A disables the built-in macro virus protection, the status bar and the following menus: "Tools/Macros/Macro" and "Tools/Macros/Visual Basic Editor". It also modifies the user name and initials to:

  User name:  NoWork Inc.
    Initials:   NWI

Then the virus creates a temporary file "C:\mlpog.sys" that it uses to infect the global template and all documents closed after that.

The virus activates its payload every day after October 15th, when it shows a message box with the following text:

  The technology will be kill humaneness

After the message box has been shown, it deletes all files from the root directory of the "C:" drive.





Description Created: Analysis: Sami Rautiainen, F-Secure



Submit a sample

Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)



F-Secure Community

Give advice. Get advice. Share the knowledge on our free discussion forum.