Nail

Threat description

Details

Category: Malware
Type: Virus
Platform: W97M

Summary

This is a worm which attempts to use Microsoft Word 97 to send e-mail to everyone at the address book of the current user. However, it will no infect any Word documents and will work only if the installed email client supports MAPI (Mail API, supported by most modern Windows e-mail programs).



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details

W97M/Nail will start a new MAPI session and logon as the current user. It will use a random number to select the message out of four different possibilities:

1. Subject: Good Times      Text:    New information on this apparent hoax..   2. Subject: New Developments      Text:    I thought you should know about this recent development...   3. Subject: WWIII!      Text:    Check out CNN.Com or read this   4. Subject: Market share tipoff...      Text:    Please don't share this information with anyone  

Next, it will add the name of the user to the end of the message. After that, the worm will add the message to the outbox and collect every address from the user's address book. The worm will add all collected addresses to the receiver of the message and attachs itself (ActiveDocument) to the message. This way the users who receive the attachment and open it with Microsoft Word 97 will spread the worm to the users from their address book.

The worm will also create another message from the collected address book and a random message from user's inbox. This message will be sent to an email address (chainnail@hotmail.com) which probably belongs to the virus writer.

Finally it will send both messages and close the MAPI session.

The virus code contains this comment:

         Automated Chain Mail v0.1  




Technical Details: Katrin Tocheva and Sami Rautiainen, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More