Article View: uk.comp.misc
Article #141WM97/Marker-O macro virus removal
From: Andy Mabbett
Date: Sat, 06 May 2000 00:00
Date: Sat, 06 May 2000 00:00
36 lines
2021 bytes
2021 bytes
A friend (yes, the same one as before!) has a few files infected with
the Marco virus "WM97/Marker-O".
The Sophos web site has this to say:
Name: WM97/Marker-O
Type: Word 97 macro virus
Resident: Yes, within Word environment.
Detection: Detected by Sophos Anti-Virus version 3.32 or later.
An update (IDE file) is available for earlier versions from the
Latest virus identities section.
This virus has been reported in the wild.
Note: An IDE was posted on 16 February 2000 to update the
definition already included in Sophos Anti-Virus. This updated
IDE is required to detect several occurrences where a WM97/Class
variant has interacted with WM97/Marker-O. These replicants
created will normally give Visual Basic errors.
Comments: Whenever a document is closed there is a 1 in 3 chance
of a File Summary box appearing on the screen with the author
name set to Ethan Frome.
Sophos detects, but does not remove it - how can it, and other Word
Macro Viruses, be purged?
--
Andy Mabbett
According to Microsoft, the world is spinning in the wrong direction:
http://support.microsoft.com/support/kb/articles/Q131/1/09.asp
Technical Details
Message-ID:
<U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 1036bc,7ab9128b5ebb12c2,start X-Google-Attributes: gid1036bc,public X-Google-Thread: f5142,7ab9128b5ebb12c2,start X-Google-Attributes: gidf5142,public From: Andy Mabbett <andy@pigsonthewing.demon.co.uk> Subject: WM97/Marker-O macro virus removal Date: 2000/05/06 Message-ID: <U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk> X-Deja-AN: 619805058 X-NNTP-Posting-Host: pigsonthewing.demon.co.uk:212.229.98.210 X-Trace: news.demon.co.uk 957573038 nnrp-13:25946 NO-IDENT pigsonthewing.demon.co.uk:212.229.98.210 Organization: Copyright Andy Mabbett, date as above MIME-Version: 1.0 Newsgroups: uk.comp.misc,demon.tech.pc X-Complaints-To: abuse@demon.net