W97M/Astia.Y Virus Information

Name: W97M/Astia.Y
Aliases: W97M/BMH
Type: Macro Virus

Description:

This virus infects Word 97 documents only. As typical of many macro viruses, it disables the macro warning feature in Word and infects the normal.dot. The virus also hooks several system events, including autoclose, autoexit, autoopen, fileexit, fileopen, formatstyle, toolsmacro, toolsoption, and viewvbcode. When the corresponding menu items are used, the virus will execute.

W97M/Astia.Y creates a temp file and creates a file snrml.dot in the Office 97 startup folder. The payload consists of an innocuous message box that displays three sentences followed by a beep:

"Infected Boomv1.01" "Me, No longer to stay in your computer!" "Beware of the Boomv1.01!"

Detection: Command AntiVirus v4.57 and higher, with the latest definition files, will detect and disinfect this virus.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .