:IDG.net: New 'Thursday' [Word macro] virus set to detonate Dec. 13
IDG.net: New 'Thursday' [Word macro] virus set to detonate Dec. 13 Sep 2, 1999, 21 :01 UTC (0 Talkback[s]) (3060 reads) (Other stories by James Niccolai)
"The Thursday virus carries a 'trigger' date
of Dec. 13. When an infected document is
opened on that date, it will attempt to
delete all the files on a user's 'c:' drive,
including subdirectories..."
"Unlike the infamous Melissa virus, which
spread by automatically e-mailing itself
across networks, the Thursday virus is
spread when users share documents.
However, because it appears to be
spreading quickly, and because of its
potentially destructive and costly payload,
AVERT has given it a 'high-risk' assessment."
"...the virus turns off the Macro
Warning feature in Word 97. If a user has a
document that contains a macro, and the
Macro Warning feature doesn't activate,
that's a sign that their system may be
infected, AVERT said."
"The virus, which also goes by the aliases
'W97M/Thursday,' and 'Thus.A,' contains a
module called ThisDocument. After turning
the macro warning feature off, the module
proceeds to infect any Word documents
opened or created on the computer from
that point on."
