1. /
  2. Security Response/
  3. W97M.Suppl.A / W95.Suppl.16384.A

W97M.Suppl.A / W95.Suppl.16384.A

Risk Level 1: Very Low

Discovered:
September 20, 1999
Updated:
February 13, 2007 11:50:40 AM
Type:
Worm

W97M/W95.Suppl.16384.A is a worm that spreads a Microsoft Word 97 macro virus that hooks Winsock32 APIs, by replacing the Wsock32.dll system file. The payload overwrites the files with certain filename extensions, as described in detail in the "Technical Details" section.

The worm arrives as a MIME-encoded email/newsgroup attachment, named Suppl.doc.

Antivirus Protection Dates

  • Initial Rapid Release version December 19, 2000
  • Latest Rapid Release version December 19, 2000
  • Initial Daily Certified version December 19, 2000
  • Latest Daily Certified version December 19, 2000
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Low

Distribution

  • Distribution Level: Low

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver