Selected viruses, spyware, and other threats: sorted alphabetically
W97M/Wrench.E |
W97M/Wrench.E is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents. The infection is manifested by existence of the module with the name Skyline in the infected document.
When an infected document is opened W97M/Wrench disables the Visual Basic editor and finds out whether the module named Skyline exists in the global template. If there is no module of that name there the virus exports its code to the file c:\ascii.vxd and attacks the template from there. After the template was infected the virus W97M/Wrench.E attacks documents when they are being opened.
When an attempt is made to display the Visual Basic editor an assistant appears in a window with heading Skyline MV and with the text You thought you got rid of me, but I'm Still here, better and stronger!. When an attempt is made to find out the level of Word security the following window is displayed:
In the virus code there are the following lines with notes:
'Name - W97M/Skyline.B
'Author - [Bench]
© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.
