For Home

Virus Profile: W97M/Alina.a@mm

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 4/6/2000
Date Added: 4/10/2000
Origin: N/A
Length: 0
Type: Virus
Subtype: MAPI
DAT Required: 4073
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

The presence of ~Alina.tmp and ~Love.tmp in the XLStart directory. Additionally a file may be password protected where it was not before, particularly after the date activated payload.

Methods of Infection

This virus will infect the global template and further infect any document used on that system. This virus will attempt to send an infected document via MAPI email in an effort to maximize spreading.
   

Virus Characteristics

This is a class module macro virus for Word97/2000 documents and templates. This virus will rename the first VB project from "ThisDocument" to "Love" within infected documents. This virus hooks the Word event of opening or closing documents in order to maximize the infection possibility. This virus will send itself via MAPI email using MS Outlook too all recipients from all available lists.

The email message will contain the following information:

  • Subject: Important News From Alina Via [username]
  • Body: News of today:=
  • Attachment: Infected document

The virus will also disable the following menu command bars: Tools/Macro and View/Toolbars. It will also disable the macro protection warning. The virus will export its code to ~Alina.tmp and ~Love.tmp in the XLStart directory. These files are not infected.

There is a date activated payload associated with this virus. If the day of the month is the same number as the month, this virus will save the active document with a password of "Alina".

   
Use current engine and DAT files for detection and removal.

It is very common for macro viruses to disable options within Office applications for example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.

AVERT Recommended Updates:

* Office 2000 updates

* Malformed Word Document Could Enable Macro to Run Automatically (Information/Patch)