Threat Descriptions

Wrench

Classification

Category :

Malware

Type :

Virus

Platform :

W97M

Aliases :

Wrench

Summary

W97M/Wrench is a Word 97 macro virus.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Variant:Wrench.A

W97M/Wrench.A infects the global template when an infected document is opened or closed. During infection, the virus creates two temporary files, "c:\Bench" and "c:\BenchFrm". After infection, the virus deletes all "Bench*" files from the root of the C: drive - including the temporary files created by the virus.

The virus hooks "Help/About" menu. When an user selects this menu, a picture is displayed:

Then it displays a message box with a text:

I'm Psycho Sushi!!!

W97M/Wrench.A also hooks "Tools/Macros/Visual Basic Editor" menu, displaying a message box with the following text: 

This program has performed an illegal operation and will shut down.

After that the virus causes Word to quit.

Variant:Wrench.B

This variant is slightly modified from W97M/Wrench.A. This variant does not hook "Tools/Macros/Visual Basic Editor" nor it does not display additional message box after the picture when "Help/About" is selected.

Variant:Wrench.C

W97M/Wrench.C is a slightly modified variant of W97M/Wrench.A. The only difference between these two is that this variant does not display a message box after the picture when "Help/About" is selected.