New virus to detonate December 13

A leading antivirus software vendor is warning of a new virus affecting Microsoft Word 97 that sits in a user's computer like a time bomb, set to deliver a potentially destructive payload on December 13.

Dubbed the "Thursday virus," it has spread through banks and other financial institutions in the US and Europe, according to AVERT (Anti-Virus Emergency Response Team), a division of Network Associates's NAI Labs that is tracking it.

The Thursday virus carries a "trigger" date of December 13. When an infected document is opened on that date, it will attempt to delete all the files on a user's "c:" drive, including subdirectories, according to AVERT. Users and network administrators are encouraged to upgrade to the most recent version of their antivirus software immediately to help stem the spread of the infection.

Unlike the infamous Melissa virus, which spread by automatically e-mailing itself across networks, the Thursday virus is spread when users share documents. However, because it appears to be spreading quickly, and because of its potentially destructive and costly payload, AVERT has given it a "high-risk" assessment.

While the virus likely originated within the financial community, it may soon spread beyond that industry, said Eddy Hsia, director of software development with Network Associates' McAfee.com consumer subsidiary.

"Financial people usually talk to other financial people, but eventually they're inevitably going to talk to you or me," Hsia said. The virus could be spread through, for example, a resume attached to an e-mail as a Word document, he said.

The virus infects the "normal.dot" template in Microsoft Word 97. Affected users won't see any obvious signs of infection, although the size of the normal.dot template will increase from its typical maximum size of 27Kbytes, Hsia said.

In addition, the virus turns off the Macro Warning feature in Word 97. If a user has a document that contains a macro, and the Macro Warning feature doesn't activate, that's a sign that their system may be infected, AVERT said.

The virus, which also goes by the aliases "W97M/Thursday, and "Thus.A," contains a module called ThisDocument. After turning the macro warning feature off, the module proceeds to infect any Word documents opened or created on the computer from that point on.

Judging by the pattern of reports made to AVERT, which came in from multiple financial institutions around the world in rapid succession, the outbreak may have stemmed from the distribution of a single infected document within the financial community, AVERT deduced. The virus was first detected around August 26, Hsia said.

To reduce the risk of contracting or spreading the virus, network administrators and users are advised to upgrade immediately to the latest version of their antivirus software. The most recent protection from Network Associates is available on its Web site, at http://www.nai.com. Consumers also can visit http://www.mcafee.com for the latest upgrades.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

James Niccolai

PC World
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?