W97M/W95.Suppl.16384.A is a worm that spreads a Microsoft Word 97 macro virus that hooks Winsock32 APIs, by replacing the Wsock32.dll system file. The payload overwrites the files with certain filename extensions, as described in detail in the "Technical Details" section.
The worm arrives as a MIME-encoded email/newsgroup attachment, named Suppl.doc.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
/
