White Papers
W97M/Hopper.ab / Hopper Macro Virus Family (Mcafee)
Overview
Date: December 3, 2001
Name: W97M/Hopper.ab
Risk Assessment: Low
Date Discovered: (family) 12/20/2000
Date Added: 11/8/2001
Origin: Unknown
Type: Virus
SubType: Macro
Other strains of this virus include:
VBS/Hopper
VBS/Hopper.htm.a
VBS/Hopper.htm.d
VBS/Hopper.vbs.a
VBS/Hopper.vbs.b
VBS/Hopper.vbs.d
W97M/Hopper.ab
W97M/Hopper.dam.c
X97M/Hopper
X97M/Hopper.ab
This virus executes when a Word97 or Excel97 document is opened. It disables the save normal prompt, the ConfirmConversions prompt and the macro warning dialog. It also reduces the default level of security.
When infecting, this virus checks the first line of the current file that it is executing from for the marker
""
It replaces all code in the current document with viral code if the marker does not exist.
This virus infects Excel files by opening the Excel object. If this fails, the virus creates its own object. It checks the startup directory for a file named "Book1". If the file exists, it is deleted. The virus then creates a new workbook, inserts viral code into the workbook’s module, saves the workbook as "Book1" in the startup directory and closes the Excel object.
| Publisher | McAfee Security | File Format | HTML |
|---|---|---|---|
| Date Published | December 2001 | ||
| Format | White Papers | ||
| Topics |
|
||
-
Did you find this white paper useful?
White Paper RSS
Download
Register
