W97M.Suppl.A / W95.Suppl.16384.A

Risk Level 1: Very Low

Printer Friendly Page|Rate this page

Discovered:: September 20, 1999
Updated:: February 13, 2007 11:50:40 AM
Type:: Worm

W97M/W95.Suppl.16384.A is a worm that spreads a Microsoft Word 97 macro virus that hooks Winsock32 APIs, by replacing the Wsock32.dll system file. The payload overwrites the files with certain filename extensions, as described in detail in the "Technical Details" section.

The worm arrives as a MIME-encoded email/newsgroup attachment, named Suppl.doc.

Antivirus Protection Dates

Initial Rapid Release version December 19, 2000
Latest Rapid Release version December 19, 2000
Initial Daily Certified version December 19, 2000
Latest Daily Certified version December 19, 2000
Initial Weekly Certified release date pending

Click for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

Wild Level: Low
Number of Infections: 0 - 49
Number of Sites: 0 - 2
Geographical Distribution: Low
Threat Containment: Easy
Removal: Easy

Damage

Damage Level: Low

Distribution

Distribution Level: Low

Technical Details

Search Threats

Search by name

Example: W32.Beagle.AG@mm

Internet Security Threat Report, Volume 16