W97M/Verlor is a Word 97 macro virus.


Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details


When an infected document is closed, the virus drops two files to the Windows directory, "tempad.dll" and "tempnt.dll". These files are used to infect the active document and the global template.

As an infection marker, the virus uses the word "Overlord".

Then it creates a text file, "c:\Himem.sys". This file is used to keep names of the infected documents.

If user attempts to see the code via "Tools\Macros\Visual Basic Editor", the virus hides itself by calling a stealth function. It modifies the registered owner of Windows to "the Overlord". Then the virus alters the "win.ini" in the Windows directory in a such way, that a VBS file "overlord.b.vbs" will be executed when the system is restarted. The the virus removes itself from the global template and all active documents.

The "overlord.b.vbs" infects the global template and it uses the "c:\himem.sys" to infect all files that are listed there.

When "Tools\Macros\Macro" is accessed, the virus uses another stealh mechanism. It deletes its code from the global template and all opened documents before the "Tools\Macros\Macro" dialog is shown. Later it infects them back after the dialog is closed using different method of infection.

Date Created: -

Date Last Modified: -