Summary
W97M/Wrench is a Word 97 macro virus.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
-
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
-
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
-
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
Technical Details
Variant:Wrench.A
W97M/Wrench.A infects the global template when an infected document is opened or closed. During infection, the virus creates two temporary files, "c:\Bench" and "c:\BenchFrm". After infection, the virus deletes all "Bench*" files from the root of the C: drive - including the temporary files created by the virus.
The virus hooks "Help/About" menu. When an user selects this menu, a picture is displayed:
Then it displays a message box with a text:
I'm Psycho Sushi!!!
W97M/Wrench.A also hooks "Tools/Macros/Visual Basic Editor" menu, displaying a message box with the following text:
This program has performed an illegal operation and will shut down.
After that the virus causes Word to quit.
Variant:Wrench.B
This variant is slightly modified from W97M/Wrench.A. This variant does not hook "Tools/Macros/Visual Basic Editor" nor it does not display additional message box after the picture when "Help/About" is selected.
Variant:Wrench.C
W97M/Wrench.C is a slightly modified variant of W97M/Wrench.A. The only difference between these two is that this variant does not display a message box after the picture when "Help/About" is selected.
More Support
Community
Ask questions in our Community .
User Guides
Check the user guide for instructions.
Submit a Sample
Submit a file or URL for analysis.