Threat Description

Jerk

Details

Aliases: Jerk
Category: Malware
Type:
Platform: W32

Summary



O97M/Jerk is a polymorphic macro virus that is able to infect both Excel and Word files. It gets control when an infected document is closed or an infected workbook is deactivated.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



When it gets control, it attempts to infect all open workbooks in Excel as well as the Word's global template. After that it infects every Word document that is closed.

The virus activates its payload every 14th day of each month from June to December when user closes an infected document in Word. It displays a message with the title:

Class.Poppy

with the text:

I think (UserName) is a big stupid jerk!

where "(UserName)" is the current user name.


Variant:Jerk.B

This variant is functionally identical with O97M/Jerk.A, only the message is different. The title is:

www.all.net

and the text is:

V guvax (UserName) vf n ovt fghcvq wrex!

where "(UserName)" is the current user name.





Technical Details: Sami Rautiainen, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More