W97M/Corner.A
| W97M/Corner.A |
Destructivity:  Spreading:  Overall risk:
|
| • Detected by virus detection files published: 10/29/1999 | • Type: Virus |
| • Virus characteristics first published: 10/29/1999 | • Spreading mechanism: File Infection |
| • Virus characteristics latest update: 12/17/2003 | • Overall risk: Low |
| • Infection type: Microsoft Word 97/2000/XP/2003 |
| Virus type |
Spreading mechanism |
Destructivity and payload |
Additional descriptions |
Detection and removal |
||||||||||
|
When an infected document is loaded into Word, the virus will disable the Tools | Macro | Security option in Word 97 and the Tools | Macro | Security option in Word 2000. In the latter case, it will also reset the security to Low leaving the system vulnerable for attacks. The virus is a regular class-infector using a common technique to replicate to the gloabl template Normal.Dot and force a save. Every time a new document is opened or created, it will be infected. Next, the virus will check if Microsoft Project 98 is also active. If this application is not present, the user will not see a messagebox as the virus has its own errorhandling and will continue to wait for the next victim. If Microsoft Project 98 is active, every time an infected document is opened or closed, the virus will infect a blank project. When an infected project is loaded, the virus will infect other non-infected projects when they are deactivated. The virus will check if Microsoft Word active. If this application is not present, the user will not see a messagebox as the virus has its own errorhandling and will continue to wait for the next victim. If Microsoft Word is active, the virus will infect the global template and force a save. SpreadabilityThe Corner.A virus will only spread when documents and projects are shared or sent as an attachment of an e-mail. The virus does not contain any other way to mail itself though the viruscode indicates that the author tried to do that. |
||||||||||||||