News

New Virus Waits Before Attacking

A new virus is said to wait a week or so before replicating itself. Suppl.doc, first found at the end of last week, replicates itself with some of the same techniques employed by the Worm.ExploreZip virus, and cripples files so they are unusable.

Security vendor Network Associates Inc. (www.nai.com) classifies Suppl.doc with a medium risk warning on its Anti-Virus Emergency Response Team (AVERT) Web site.

AVERT describes the virus as a Word97 document with a class module macro having an Internet worm binary file. The worm binary is an appended EXE file with a trojan payload. The virus is sent and received in a file attachment named SUPPL.DOC.

Once opened, the virus functions similar to W32/Ska in that the local file WSOCK32.DLL is replaced with a rogue copy self-contained at the end of the document. The new WSOCK32.DLL contains instructions to attach the file SUPPL.DOC to e-mail messages using SMTP protocol.

The virus’ macro code was written to make use of routines found in the DLL files LZ32.DLL and KERNEL32.DLL.

About a week after initially infecting the local machine, the trojanized WSOCK32.DLL will seek all files within all local drives with the following extension and null them similar to W32/ExploreZip: .doc, .xls, .txt, .rtf, .dbf, .zip, .arj and .rar.

As with all potential viruses, users are warned against opening attachments named Suppl.doc. -- Thomas Sullivan

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Microsoft Uniting OneDrive and SharePoint Admin Portals Next Month

    Microsoft is converging its OneDrive and SharePoint Admin Center management portals, with a consolidated portal expected to arrive for Microsoft 365 subscribers "through February."

  • Phishing Tops Concerns in Microsoft Study of Remote Work

    Potential phishing attacks were a top concern of most IT security professionals when organizations switched to remote-work conditions early last year.

  • How To Configure Windows 10 for Intel Optane Memory

    Intel's Optane memory technology can significantly improve the performance of your Windows 10 system -- provided you enable it correctly. A single mistake can render the system unbootable. Here's how to do it the right way.

  • Microsoft and SAP Enhance Partnership with Teams Integration

    Microsoft and SAP this week described continuing partnership efforts on Microsoft Azure, while also planning a Microsoft Teams integration with SAP's enterprise resource planning product and other solutions.

comments powered by Disqus