White Papers
WM97/Comical-A (Sophos)
Overview
Date: February 6, 2002
Name: WM97/Comical-A
Type: Word 97 macro worm
WM97/Comical-A is a mass mailing email worm. It consists of three components: a Word macro file, a Visual Basic script and a Windows executable. These three components are detected as WM97/Comical-A, VBS/Comical-A and W32/Comical-A respectively.
WM97/Comical-A arrives in an email with the following characteristics:
Subject line: A comical story for you
Message text: I send you a comical
story found on the Net.
Best Regards, You friend.
Attached file: comical_story.doc
When the attachment is launched using Microsoft Word it will display a message box which states 'This file has some problems'. When the user clicks on the OK button the worm will drop a Visual Basic script, VBS/Comical-A, to C:\twin.vbs. The worm will then execute VBS/Comical-A.
Click thru to alert text for disinfection information.
| Publisher | Sophos | File Format | HTML |
|---|---|---|---|
| Date Published | February 2002 | ||
| Format | White Papers | ||
| Topics |
|
||
-
Did you find this white paper useful?
White Paper RSS
Download
Register
