Worm: W97M_CHAMELEON.A

[Techguy]

Worm: W97M_CHAMELEON.A
--------------------------------------------------------------------------------
Aliases:
CHAMELEON, W97M/Chameleon.gen

Description:
This macro virus infects MS Word global templates first and then infects all MS Word documents that are opened and/or closed. It also disables the virus protection option that comes with MS Word. If the current system day is 18, the virus displays a message box.

Solution:


Delete the dropped file CHAMELEON.VBS in c:\Windows\Start Menu\Programs\Startup\ directory
Scan your system with your antivirus and delete all files detected as W97M_CHAMELEON.A

------------------
Thank you for using Help From Techs Support Forums!
Please come again and remember to refer a friend to our site.

[Techguy]

Worm: W97M_CHAMELEON.B
--------------------------------------------------------------------------------
Aliases:
CHAMELEON.B

Description:
This macro virus infects MS Word documents and document templates. If the current system day is greater than 26, the virus replaces the word "the" in the active document with a text string and also adds a text string in the infected document. It also changes the caption of the infected document.

Solution:


Delete the file QUIET.VBS in the c WINDOWS\START MENU\PROGRAMS\STARTUP\ directory
Scan your system with your antivirus and delete all files detected as W97M_CHAMELEON.B

------------------
Thank you for using Help From Techs Support Forums!
Please come again and remember to refer a friend to our site.

[Techguy]

Worm: W97M_CHAMELEON.C
--------------------------------------------------------------------------------
Aliases:
CHAMELEON.C

Description:
This macro virus infects MS Word documents and document templates. It disables some document command bars such as: TOOLS|MACROTOOLS|TEMPLATES and ADD-INS.FORMAT|STYLE GALLERY



------------------
Thank you for using Help From Techs Support Forums!
Please come again and remember to refer a friend to our site.

[Total K]

Originally posted by Techguy:
Worm: W97M_CHAMELEON.B

It's a shame that ALL AV AND this site have the descriptions wrong for this virus. If anyone had actually taken the time to read it correctly, it DOESN'T drop 'Quiet.vbs' at all, in fact, the replication routine is done via an 'addfromstring' command. Shame about this, I didn't think VBA woz THAT hard to read ;)


------------------
Regards..

..:: Total K ::..

[Total K]

>>>>>This macro virus infects MS Word documents and document templates.<<<<<

It also drops 'Quiet.vbs' and 'Quiet.dll' ;)



------------------
Regards..

..:: Total K ::..

[Total K]

Originally posted by Total K:
>>>>>This macro virus infects MS Word documents and document templates.<<<<<

It also drops 'Quiet.vbs' and 'Quiet.dll' ;)



This post regarding W97M.Chameleon.C




------------------
Regards..

..:: Total K ::..

[Techguy]

you might want to consider emailing virus_doctor@trendmicro.com , because its theirs defintions that we use.
Personally I very rarely look through coding of these worms.
Thanks http://www.helpfromtechs.com/ubb/smilies/smile.gif

------------------
Thank you for using Help From Techs Support Forums!
Please come again and remember to refer a friend to our site.