| ||Discovery Date:||11/11/99|
| ||Risk Assessment:||Medium|
| ||Minimum DAT:||4054|
This is a virus for Word 97 documents. It is able to replicate under the SR-1 release of Word 97. It will turn off the macro warning feature of Word 97. This virus consists of a module called "x". It is a copy-cat of the W97M/Melissa.a virus in that there is a payload to send the infected file via MS Outlook.
This virus hooks the system event of closing documents Word97 by the subroutine "Document_Close" (in the global template) thereby running its code. Infected documents contain the subroutine "Document_Open" which also is a system event.
The Outlook email routine which is designed to create an email message with the first 100 recipients with the subject of the message is "Duhalde Presidente " (Office97 User Name) and the body of the message is "Programa de gobierno 1999 - 2004."
Macro warning if opening infected document, increase in size to global template. Email propagation as mentioned above.
Method Of Infection
Opening infected documents will infect global template normal.dot.
VirusScan 4 with the 4.0.25 engine (and above) download here
Dr. Solomon's AVTK 7.99 and above download here