🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: uk.comp.misc
Article #141

WM97/Marker-O macro virus removal

#141
From: Andy Mabbett
Date: Sat, 06 May 2000 00:00
36 lines
2021 bytes
A friend (yes, the same one as before!) has a few files infected with
the Marco virus "WM97/Marker-O".

The Sophos web site has this to say:

        Name: WM97/Marker-O

        Type: Word 97 macro virus  

        Resident: Yes, within Word environment.  

        Detection: Detected by Sophos Anti-Virus version 3.32 or later. 

        An update (IDE file) is available for earlier versions from the
        Latest virus identities section. 

        This virus has been reported in the wild. 

        Note: An IDE was posted on 16 February 2000 to update the
        definition already included in Sophos Anti-Virus. This updated
        IDE is required to detect several occurrences where a WM97/Class
        variant has interacted with WM97/Marker-O. These replicants
        created will normally give Visual Basic errors. 
 
        Comments: Whenever a document is closed there is a 1 in 3 chance
        of a File Summary box appearing on the screen with the author
        name set to Ethan Frome.  

Sophos detects, but does not remove it - how can it, and other Word
Macro Viruses, be purged?
-- 
Andy Mabbett

According to Microsoft, the world is spinning in the wrong direction:
    http://support.microsoft.com/support/kb/articles/Q131/1/09.asp
Technical Details
Message-ID: <U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1036bc,7ab9128b5ebb12c2,start
X-Google-Attributes: gid1036bc,public
X-Google-Thread: f5142,7ab9128b5ebb12c2,start
X-Google-Attributes: gidf5142,public
From: Andy Mabbett <andy@pigsonthewing.demon.co.uk>
Subject: WM97/Marker-O macro virus removal
Date: 2000/05/06
Message-ID: <U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk>
X-Deja-AN: 619805058
X-NNTP-Posting-Host: pigsonthewing.demon.co.uk:212.229.98.210
X-Trace: news.demon.co.uk 957573038 nnrp-13:25946 NO-IDENT pigsonthewing.demon.co.uk:212.229.98.210
Organization: Copyright Andy Mabbett, date as above
MIME-Version: 1.0
Newsgroups: uk.comp.misc,demon.tech.pc
X-Complaints-To: abuse@demon.net