Summary
This is a Word 97 macro virus that infects when Word is started and when an infected document is opened or closed.
Disinfection & Removal
Allow F-Secure Anti-Virus to disinfect the relevant files.
For more general information on disinfection, please see Removal Instructions.
Technical Details
Variant:Ozwer.A
The virus hooks several menus like: Format/Font, File/Print, File/Save As, File/Save, File/Close, File/New, Edit/Copy, Edit/Paste, Tools/Macros/Macro, File/Exit and Tools/Options. It also replace Tools/Macro dialogue box with it's own and Tools/Macro/Visual Basic Editor with the following Message box:
Depending on the random number, the virus moves words in the active document to the left or to the right, when the has been running for 20 minutes.
In Spanish version of Word 97 it will show it's messages in Spanish.
Technical Details: Katrin Tocheva and Sami Rautiainen, F-Secure
Submit a sample
Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)
F-Secure Community
Give advice. Get advice. Share the knowledge on our free discussion forum.