PP97M/Attach is the first PowerPoint 97 macro virus. It was found in
December 1998. It has several design flaws which make it extremely
unlikely to spread.
Attach is a direct-action infector, infecting all *.PPT files in the
"C:\My Documents" folder, provided that their name doesn't start with
a "~" (i.e., are not currently opened) and is not the same as the name
of the presentation from which the virus is running.
In order to be infected, the presentation must contain user forms.
All user forms of the presentation will be infected, with the virus
inserting its code in front of the code already in the user form. (Most
user forms contain at least some code already, since it doesn't make
much sense to create an empty user form which does not respond to any
events like button clicks, etc.)
The virus replicates only when the user terminates the form by
clicking at the [x] button in the upper right corner of the form's
PP97M/Attach is not known to be in the wild, and is not likely to be,
[Analysis: Vesselin Bontchev, FSI]