From: J. Aires de Sousa (jas$##$mail.fct.unl.pt)
Date: Wed Jun 16 1999 - 10:29:20 EDT
Dear ORGLIST members,
As you already know the message sent today (16 June 1999) from
barnabas_liau$##$hotmail.com with
Subject: ORGLIST: trans isomerization
contained an attachment (Dear colleagues.doc) with the W97M.Chack.B
virus.
As far as I know this affects Word 97 documents.
PLEASE DO NOT OPEN THE FILE "Dear colleagues.doc". DELETE IT AND THE
CORRESPONDING EMAIL MESSAGE.
Following are
a) 3 web sites with information about this virus and software that
should detect the virus
b) Information about the virus that I could collect
If anyone has further relevant information about this please send it
directly to me <mailto:jas$##$mail.fct.unl.pt> and I will distribute a
summary through the list.
joao aires de sousa, ORGLIST coordinator
a)___________________________________________________________
<http://vil.mcafee.com/vil/vm10186.asp>
<http://www.esafe.com/products.html>
<http://www.symantec.com/avcenter/venc/ebld/enc.cgi?vid=25513&lang=us>
b)____________________________________________________________
Source: McAfee
<http://vil.mcafee.com/vil/vm10186.asp>
Virus Name
W97M/Chack.B
Date Added
6/14/99
Virus Characteristics
This is a virus for Word 97 documents. It is not able to replicate under
the SR-1 release of Word 97. Upgrading to the SR-1 release of Word 97
or later will stop it from spreading. This is a stealth virus; it will
intercept
the macro viewing commands to attempt to hide its presence. This virus
consists of a module called Cyberform, Cyberhack. It will turn off the
macro warning feature of Word. On several events a userform is shown.
Virus Information
Discovery Date:
11/18/98
Type:
Macro
Risk Assesment:
medium
Variants
F, K
Aliases
Chack.K, Cyberhack
_______________________
Source: Symantec
<http://www.symantec.com/avcenter/venc/ebld/enc.cgi?vid=25513&lang=us>
VirusName:
W97M.Chack.B
Aliases:
MW97:Chack family, Word97Macro/Chack.E,
W97M.CyberHack, W97M/Chack.e
Infection Length:
N/A
Likelihood:
rare
Target Platform:
Application macros
Description:
This virus is not known to be widespread. This virus infects
document/spreadsheet data files. It does not employ any "stealthing"
mechanisms. The W97M.Chack.B virus does not attempt to use
polymorphism to conceal itself. Norton AntiVirus can properly repair
files
infected with the W97M.Chack.B virus.
__________________
ORGLIST - Organic Chemistry Mailing List
Website and Archive: http://www.orglist.net/
List coordinator: Joao Aires de Sousa (jas$##$mail.fct.unl.pt)
This archive was generated by hypermail 2.1.4 : Fri Sep 19 2003 - 12:15:04 EDT