Threat Description



Aliases: Verlor
Category: Malware
Type: Virus
Platform: W32


W97M/Verlor is a Word 97 macro virus.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Technical Details


When an infected document is closed, the virus drops two files to the Windows directory, "tempad.dll" and "tempnt.dll". These files are used to infect the active document and the global template.

As an infection marker, the virus uses the word "Overlord".

Then it creates a text file, "c:\Himem.sys". This file is used to keep names of the infected documents.

If user attempts to see the code via "Tools\Macros\Visual Basic Editor", the virus hides itself by calling a stealth function. It modifies the registered owner of Windows to "the Overlord". Then the virus alters the "win.ini" in the Windows directory in a such way, that a VBS file "overlord.b.vbs" will be executed when the system is restarted. The the virus removes itself from the global template and all active documents.

The "overlord.b.vbs" infects the global template and it uses the "c:\himem.sys" to infect all files that are listed there.

When "Tools\Macros\Macro" is accessed, the virus uses another stealh mechanism. It deletes its code from the global template and all opened documents before the "Tools\Macros\Macro" dialog is shown. Later it infects them back after the dialog is closed using different method of infection.

Description Details: Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More