Virus Profile: W97M/Serpent

Threat Search
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 8/9/2000
Date Added: 8/3/2001
Origin: Unknown
Length: N/A
Type: Virus
Subtype: Macro
DAT Required: 4091
Removal Instructions


This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

Methods of Infection


W97M.Snake (NAV), W97M_SNAKE.A (Trend)

Virus Characteristics

This virus infects Word 97 documents and executes whenever a Word document is opened.

This virus checks to see if GlobalTemplate is infected. If the GlobalTemplate is already infected, the virus displays the following message:

Error245! MSWord will try to fix the problem.

If the GlobalTemplate is not infected, this virus deletes all code from the GlobalTemplate and inserts its viral code. This virus also deletes all macro code in the ActiveDocument and inserts its viral code into it. This virus disables the VirusProtection property.

This virus checks the date to see if the current day is the 17th. If it is not the 17th, the virus disables the Visual Basic Editor on the Items CommandBar under "Macro" options, saves the ActiveDocument and quits.

If it is the 17th, the virus' payload is executed. The payload runs by choosing random letters and symbols and displays them as a message.

The ActiveDocument is then minimized and the caption bar wording of the document in use is changed to:

...hmmm, strange!".

With MS-Word minimized, the virus then begins redrawing itself on the desktop, each redraw occurring at a different coordinate. The redraw generally happens so quickly it produces the effect of MS-Word splitting itself in two.

The virus then disables the Visual Basic Editor on the Items CommandBar under "Macro" options, saves the ActiveDocument and quits.

Use current engine and DAT files for detection and removal.

It is very common for macro viruses to disable options within Office applications for example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.

AVERT Recommended Updates:

* Office 2000 updates

* Malformed Word Document Could Enable Macro to Run Automatically (Information/Patch)


PC Infected? Get Expert Help

Virus Removal Service

Connect to one of our Security Experts by phone. Have your PC fixed remotely - while you watch!