BEWARE OF
W97M/PRILISSA VIRUS
W97M/Prilissa
virus is a new variant of Melissa virus
infects Word 97 Documents. Prilissa
virus makes use of the MAPI functions in
Microsoft Outlook to retrieve the current
user profile and password for server
logon. This Virus grabs the first 50
addresses from the address book of
Microsoft Outlook and resends the mail.
In
Word97, the virus disables the
Tools/Macro menu commands, the Confirm
Conversions option, the MS Word macro
virus protection, and the Save Normal
Template prompt. The virus then checks to
see if the registry key
"HKEY_CURRENT_USER\Software\Microsoft\Office\""CyberNET""
contains the value "(C)1999 -
Indonesia by AnomOke!"
This is how the virus determines whether
it has activated on this system.
The
virus then opens Outlook, if present on
the system, and sends one email for each
address list. The email may contain up to
50 recipients. The email will contain the
subject line: "Message From {Office
97 user name}" and the message body
will be "This document is very
important and you've GOT to read this
!!!". The virus then
attaches a copy of the infected active
document to the outgoing mail.
W97M/Prilissa
includes a destructive payload! If
the date is December 25 of any year, it
will modify the AUTOEXEC.BAT file so that
the next time the computer is booted, the
hard drive will be formatted, causing
a loss of all data. In addition, the
following message will be displayed in
Word 97:
"(C)
1999 - CyberNET
Vine... Vide... Vice...Moslem Power Never
End...
You Dare Rise Against Me... The Human Era
is
Over, The CyberNET Era Has Come!!!
[OK]"
How can I
protect my system?
Fire has
incorporated Win97/Prilissa into its
virus signature file, with the aim of
helping users affected by this Worm
attack to detect and eliminate it from
their systems. Fire anti-virus users can
update this signature file from our web
site. A free utility Fimacro
also available to detect and clean this
virus in Download
Center.
|
.