Threat Description

Jerk

Details

Aliases: Jerk
Category: Malware
Type:
Platform: W32

Summary


O97M/Jerk is a polymorphic macro virus that is able to infect both Excel and Word files. It gets control when an infected document is closed or an infected workbook is deactivated.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.



Technical Details


When it gets control, it attempts to infect all open workbooks in Excel as well as the Word's global template. After that it infects every Word document that is closed.

The virus activates its payload every 14th day of each month from June to December when user closes an infected document in Word. It displays a message with the title:

Class.Poppy  

with the text:

I think (UserName) is a big stupid jerk!  

where "(UserName)" is the current user name.


Variant:Jerk.B

This variant is functionally identical with O97M/Jerk.A, only the message is different. The title is:

www.all.net  

and the text is:

V guvax (UserName) vf n ovt fghcvq wrex!  

where "(UserName)" is the current user name.





Technical Details:Sami Rautiainen, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More