F-Secure Virus Descriptions : Lenni

NAME:

Lenni

W97M/Lenni is a Word 97 macro virus with a destructive payload.

VARIANT: Lenni.A

When an infected document is closed, W97M/Lenni.A infects the global template. It creates a hidden temporary file, "c:\config.win", during the infection.

During the year 2000, the virus activates its payload in several specified dates. These dates are: January 1st, January 10th, January 20th, April 1st, August 4th and October 31st. When the payload activates, the virus attempts to format the "C:" drive and show a message box with the following title:

    -= MILLENNIUM VIRUS =-

and with the following text:

    Alert..!! Your Pc have a serious problem with the Year 2000

The virus also hooks the "Tools/Macros/Visual Basic Editor" menu with a message box that displays the following text:

    Microsoft Visual Basic Error in components MsVbRun32.dll.

[Analysis: Sami Rautiainen, F-Secure]