W97M.Shepmah.G

SUMMARY

This is a Microsoft Word macro virus that spreads by infecting Microsoft Word documents and the global template, Normal.dot.

Protection

• Virus Definitions (Intelligent Updater) February 27, 2001

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low

TECHNICAL DETAILS

This virus is similar to many other Microsoft Word macro viruses. It changes the following Microsoft Word settings:

• It disables the Visual Basic Convert File dialog box before it opens or inserts a file that is not a Word document or template.
• It sets Microsoft Word to automatically save changes to Normal.dot before Word closes.
• It disables the Visual Basic Editor to prevent you from viewing or editing the macro code.
• It sets the way that Word handles Ctrl+Break user interruptions to prevent Ctrl+Break from interrupting a macro.
• It enables AutoMacros, so that the macro virus runs automatically when you start Word or open a document.

If the day is February 25th of any year, the virus performs the following actions:

• It changes the following document settings:
  • Title
  • Subject
  • Author Name
  • Keywords
  • Comments.
• It displays a message with the caption [HamPehS] and the picture "Evil Inside."
• It drops the C:alim.det file, the contents of which start with the following string:
  

===>>>!!HAMPEHS!!<<<>>>!!HAMPEHS!!<<<>>>!!HAMPEHS!!<<<====

• It also adds several commands to the C:Autoexec.bat file. The commands are designed to delete the Program Files and Windows folders, and to display the contents of the C:alim.det file. Due to a bug in the code, this does not work in Windows NT, but it does work in Windows 95, 98, Me, and 2000.

REMOVAL

To remove this virus:

NOTE: If this virus ran in Windows 95, 98, Me, or 2000, and the computer has been restarted, you may first have to reinstall the operating system and most programs.

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
3. If any Microsoft Word files are detected as infected by W97M.Shepmah.G, click Repair.
4. If the file C:alim.det is found, delete it.
5. Click Start, and click Run.
6. Type sysedit and then click OK.
7. In the C:Autoexec.bat file, look for the following text:
   
   Rem -- Hampehs Wuz HERE! ;)=
   echo off
   cls
   move /y progra~1 tempt1 > null
   move /y windows tempt2 > null
   cls
   type c:zalim.det
   pause > null
   Rem -- The world full of Hampehs!
   
8. (Optional) Re-enable Microsoft Word MacroVirusProtection. To do this, click Tools, click Options, and then click the General tab. (The exact steps may vary depending your version of Word.)