Summary

W97M/Wrench is a Word 97 macro virus.

Additional Details

VARIANT:

Wrench.A

W97M/Wrench.A infects the global template when an infected document is opened or closed. During infection, the virus creates two temporary files, "c:\Bench" and "c:\BenchFrm". After infection, the virus deletes all "Bench*" files from the root of the C: drive - including the temporary files created by the virus.

The virus hooks "Help/About" menu. When an user selects this menu, a picture is displayed:



Then it displays a message box with a text:

    I'm Psycho Sushi!!!

W97M/Wrench.A also hooks "Tools/Macros/Visual Basic Editor" menu, displaying a message box with the following text:

    This program has performed an illegal operation and will shut down.

After that the virus causes Word to quit.

VARIANT:

Wrench.B

This variant is slightly modified from W97M/Wrench.A. This variant does not hook "Tools/Macros/Visual Basic Editor" nor it does not display additional message box after the picture when "Help/About" is selected.

VARIANT:

Wrench.C

W97M/Wrench.C is a slightly modified variant of W97M/Wrench.A. The only difference between these two is that this variant does not display a message box after the picture when "Help/About" is selected.

[Analysis: Sami Rautiainen, F-Secure]