Re: [AntivirusClub] virus ~77.vys

Dear All,

saveral days ego my computer was infected by virus ~77.vys, it attack ms.word.
Please help me to remove it, I have tried to clean by mc.Afee & NAV, but they can not detect it.

Indrasp

What is it doing?

How did you orignally detect it?

 

I've done research and it sounds like a Macro virus.  But it does not seem wide spread as I only found one forum with anything about it: 

http://www.infokomputer.com/forum/display_messages.php?mid=54578&fid=60&ids=54578

(don't even know what language that is)

 

Here is a page you should try out:

http://support.microsoft.com/?scid=kb;en-us;187243 It is about Macro virus' from microsoft I believe it will give you more insight into what it maybe.

 

Have you tried Hijackthis detect it?

http://www.majorgeeks.com/download3155.html 

Make sure you update it with the latest definitions How to use Hijackthis –> http://forums.majorgeeks.com/showthread.php?t=38752 Not sure it hijackthis will detect macros.

 

Can you find the process running in Task Manager?

http://elamb.blogharbor.com/hacked/IDTools.htm

 

On 6/21/05, Indra> wrote:

Dear Mr. Robert

 

    Thank you very much for your attantion of my problem. “What is it doing?” , if your computer was infected by this virus, when you insert the disket to diskdrive automatically file ~77.vys will copy to your diskette, and when you open your ms.word document and than you save it, the document couldn't be opened. Virus ~77.vys will appear as vys~77.doc, and you can find your document content in vys~77.doc.

 

I will try to do your suggestion, thank you very much and I'm so sorry about my bad English.

 

Indra

 

Technical facts about W97M.Ethan.AK computer virus:

Indra, Check this out,

Could you have some variation of the W97M.Ethan.AK Macro virus?  Do you have Word 97?  97 seems to be pretty vulnerable to attack.

Here is what I found out about the W97M.Ethan.AK
The virus copies itself in a temporary file, named “evolve.tmp”, in “C:\”.

At opening, if the virus is a macro in a “.doc” file, it infects normal.dot.  If the virus is a macro in normal template (”normal.dot”), it infects documents when they are opened.

It verifies the file macros, and it doesn't infect a macro that begins with “Private Sub Open” and ends with “End sub”. So, it doesn't infect the same macro twice.

The virus doesn't have any destructive payload, it only spreads itself through Microsoft Word Application.

 

Popularity: 2% [?]