W97M.Cobra.Family

SUMMARY

W97M.Cobra is a stealth macro virus that infects both the Microsoft Word Normal.dot template and the active document. On March 26 of any even year, W97M.Cobra inserts two extra functions into the active document and the Normal.dot template. One displays the message "You are infected with Cobra" and the other function deletes all files from drive C.

Protection

• Virus Definitions (Intelligent Updater) October 6, 1999

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 50 - 999
• Number of Sites: More than 10
• Geographical Distribution: Medium
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: High
• Payload Trigger: If today is the 26th of March of any even year
• Payload: Displays message
• Deletes Files: All files on the C: drive

Distribution

• Distribution Level: Low

TECHNICAL DETAILS

When you open a W97M.Cobra infected document, the virus does the following:

• It goes stealth by switching off the following options:
  • VirusProtection
  • SaveNormalPrompt
  • ConfirmConversions
• It deletes all macros from the Normal.dot template that are not named "ThisDocument" or "Cobra." This means that any user macro or other macro virus that is not stored in the "ThisDocument" or "Cobra" macros is deleted.
• W97M.Cobra checks whether the Normal.dot template is already infected; if not, the virus infects it. These procedures are then also executed on the active document, stripping the macro storage and infecting the active document (if this did not occur previously).
• When closing an infected document, the payload trigger date is checked. If the date is the March 26 of any even year, an extra macro is inserted in both the Normal.dot template and the active document. This macro module is named "War" and overrides two functions with the following actions:
  • Clicking File and clicking Exit causes a message box with the text "You are infected with Cobra" to appear.
  • Clicking File and clicking New causes all files to be deleted from drive C.

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and then run a full system scan, making sure that NAV is set to scan all files.
3. If any files are detected as infected by W97M.Cobra, then click Repair.