Variant:Wrench.A
W97M/Wrench.A infects the global template when an infected document is opened or closed. During infection, the virus creates two temporary files, "c:\Bench" and "c:\BenchFrm". After infection, the virus deletes all "Bench*" files from the root of the C: drive - including the temporary files created by the virus.
The virus hooks "Help/About" menu. When an user selects this menu, a picture is displayed:
Then it displays a message box with a text:
I'm Psycho Sushi!!!
W97M/Wrench.A also hooks "Tools/Macros/Visual Basic Editor" menu, displaying a message box with the following text:
This program has performed an illegal operation and will shut down.
After that the virus causes Word to quit.
Variant:Wrench.B
This variant is slightly modified from W97M/Wrench.A. This variant does not hook "Tools/Macros/Visual Basic Editor" nor it does not display additional message box after the picture when "Help/About" is selected.
Variant:Wrench.C
W97M/Wrench.C is a slightly modified variant of W97M/Wrench.A. The only difference between these two is that this variant does not display a message box after the picture when "Help/About" is selected.