Threat Description





W97M/Verlor is a Word 97 macro virus.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.

Technical Details


When an infected document is closed, the virus drops two files to the Windows directory, "tempad.dll" and "tempnt.dll". These files are used to infect the active document and the global template.

As an infection marker, the virus uses the word "Overlord".

Then it creates a text file, "c:\Himem.sys". This file is used to keep names of the infected documents.

If user attempts to see the code via "Tools\Macros\Visual Basic Editor", the virus hides itself by calling a stealth function. It modifies the registered owner of Windows to "the Overlord". Then the virus alters the "win.ini" in the Windows directory in a such way, that a VBS file "overlord.b.vbs" will be executed when the system is restarted. The the virus removes itself from the global template and all active documents.

The "overlord.b.vbs" infects the global template and it uses the "c:\himem.sys" to infect all files that are listed there.

When "Tools\Macros\Macro" is accessed, the virus uses another stealh mechanism. It deletes its code from the global template and all opened documents before the "Tools\Macros\Macro" dialog is shown. Later it infects them back after the dialog is closed using different method of infection.

Description Created: Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More