Summary

W97M/Verlor is a Word 97 macro virus.

Additional Details

ALIAS:

Verlor.A

When an infected document is closed, the virus drops two files to the Windows directory, "tempad.dll" and "tempnt.dll". These files are used to infect the active document and the global template.

As an infection marker, the virus uses the word "Overlord".

Then it creates a text file, "c:\Himem.sys". This file is used to keep names of the infected documents.

If user attempts to see the code via "Tools\Macros\Visual Basic Editor", the virus hides itself by calling a stealth function. It modifies the registered owner of Windows to "the Overlord". Then the virus alters the "win.ini" in the Windows directory in a such way, that a VBS file "overlord.b.vbs" will be executed when the system is restarted. The the virus removes itself from the global template and all active documents.

The "overlord.b.vbs" infects the global template and it uses the "c:\himem.sys" to infect all files that are listed there.

When "Tools\Macros\Macro" is accessed, the virus uses another stealh mechanism. It deletes its code from the global template and all opened documents before the "Tools\Macros\Macro" dialog is shown. Later it infects them back after the dialog is closed using different method of infection.

[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]