Virus:W97M/Story.AE

This is a macro virus that infects Word documents, attempts to spread via mIRC, and provides limited backdoor functionality (also through mIRC).

This virus infects Word documents as they are opened or closed. It saves a copy of the current infected document as C:\Windows\Story.doc and deletes its entry from the list of recent documents.

The virus searches for the Mirc folder, by looking for C:\mirc\mirc32.exe. If Mirc exists in this location, it attempts to disable the IRC 'file serving warning' by altering mirc.ini. It then deletes script.ini. The virus then creates a new, modified script.ini that is used to serve the virus to users inside the IRC channel. It  creates a further copy of its modified script.ini as C:\Windows\script1.ini.

 

The virus spreads via Mirc using several different methods.

Spreads upon receiving notification
If another user notifies the infected user, the virus sends the following message to the initiating user:

"Hey, I can't talk right now but I wanted to send you this file.  It has a funny story you should read, and also has macros inside that protect you from a lot of viruses.  Just open the document, enable the macros, and if you are infected it will get rid of the virus"

 

The virus then sends the file C:\Windows\Story.doc to the other user.

Spreads upon receiving an invitation
If another user invites the infected user, the virus sends the following message to the initiating user:

"I'm a little busy so I can't talk much now.  I thought you might want to look at this file I got. It has a funny story and also has macros in it which get rid of any macro viruses.  Just enable the macros when the prompt comes up and it will scan for any viruses and clean them."

The virus then sends the file C:\Windows\Story.doc to the other user.

Spreads upon receiving a file
If a file is received by the infected user, the virus sends C:\Windows\Story.doc to the other user.

 

The virus may also attempt to change the channel's subject to "Jack-In-The-Box Has Popped Up Again!"

 

This virus makes a number of modifications to the affected in order to hamper its detection and/or removal. It makes the following modifications:

 

If the user "Simplicity" contacts the infected user, the virus gives access to the infected user's C: drive through file serving.

 

The virus ignores users when it finds the following keywords in messages received:
"script", "worm", "virus", "infect", "Jack*Box", "macro", "Story.doc".

 

This virus uses the infection marker: 'Jack-In-The-Box'.