Arbeit

Classification

Malware

Virus

W97M

Arbeit

Summary

W97M/Arbeit is a Word 97 macro virus with a destructive payload.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


Variant:Arbeit.A

When an infected document is opened, W97M/Arbeit.A disables the built-in macro virus protection, the status bar and the following menus: "Tools/Macros/Macro" and "Tools/Macros/Visual Basic Editor". It also modifies the user name and initials to:

User name:
NoWork Inc.

 Initials:
 NWI

Then the virus creates a temporary file "C:\mlpog.sys" that it uses to infect the global template and all documents closed after that.

The virus activates its payload every day after October 15th, when it shows a message box with the following text:

The technology will be kill humaneness

After the message box has been shown, it deletes all files from the root directory of the "C:" drive.

Date Created: -

Date Last Modified: -