W97M.Cham.A@mm

SUMMARY

This is a Microsoft Word metamorphic macro virus that spreads by infecting the global template, Normal.dot.

Protection

• Virus Definitions (Intelligent Updater) February 23, 2001

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low

TECHNICAL DETAILS

Metamorphic viruses use a permutated virus body. The virus engine of a metamorphic virus can recompile itself into a new form. Therefore, the code of the virus is different from generation to generation, leaving no constant areas that let antivirus software detect it with string-type detection.

The virus performs the following actions:

1. It disables the Microsoft Word warning message that appears when you open a document or template containing the macros.
2. It infects the global template, Normal.dot.
3. It creates a new Microsoft Word document that contains a replicated, permutated form of the virus body.
4. It names the document with the user name to whom the copy of Microsoft Word is licensed.
5. It attaches the generated, infected document to a new email message. The subject of the messages consists of the user name followed by the following text:
   
    - Curriculum Vitae
   
6. W97M.Cham.A@mm sends the message to the first 50 recipients in the Microsoft Outlook address book.
7. It sends the message to all items fin the Microsoft Outlook Journal. (Outlook journaling tracks documents as they are closed or saved. Outlook journaling is turned on by default when Outlook is installed.)
8. W97M.Cham then creates the following values:
   
   LegalNoticeCaption HTTP://www.2600.com
   LegalNoticeCaption You Were Infected By FreeCham Virus
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoft WindowsCurrentVersionWinlogon
   
   This causes these messages to appear when you stat Windows.

REMOVAL

To remove this virus:

1. Run LiveUpdate to make sure you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and set NAV to scan all files.
3. Run a full system scan.
4. If any files are detected as infected by W97M.Cham, choose Repair.
5. Complete the next procedure to remove the following registry entries:
   
   CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure you modify only the keys specified. Please see the document How to back up the Windows registry before proceeding.
   
   1. Click Start, and then click Run. The Run dialog box appears.
   2. Type regedit and then click OK. The Registry Editor opens.
   3. Navigate to the following subkey:
      
      HKEY_LOCAL_MACHINESoftwareMicrosoft WindowsCurrentVersionWinlogon
      
   4. In the right pane, delete the following values:
      
      LegalNoticeCaption HTTP://www.2600.com
      LegalNoticeCaption You Were Infected By FreeCham Virus
      
6. (Optional) Re-enable Microsoft Word MacroVirusProtection. To do this, click Tools, click Options, and then click the General tab. (The exact steps may vary depending your version of Word.)