Techguy
December 8, 2000, 05:24 pm
O97M_TRISTATE
Risk rating: low
Virus type: Macro
Destructive: N
Aliases:
TRISTATE, O97M_TRIPLICATE, TRIPLICATE, X97M_TRISTATE, P97M_TRISTATE, W97M_TRISTATE
Description:
This macro virus cross-infects Microsoft Word 97, Microsoft Excel 97, and Microsoft PowerPoint 97 applications.
In the wild: Yes
Trigger date 1: Any Day
Trigger condition 1: Upon activation
Payload 1: Others disables macro virus protection
Detected by pattern file#: 518
Detected by scan engine#: 2.062
Language:
English
Platform: Windows
Encrypted: No
Details:
The virus is activated from a Word document, an Excel spreadsheet/workbook, or from a PowerPoint slide and will cross-infect.
Upon activation in Excel the virus searches for BOOK1.XLS in the Excel Startup directory. If not found, the virus creates an infected workbook in the same directory and disables Excel's macro virus protection. The virus resides in the "ThisWorkbook" stream of an infected excel spreadsheet/workbook.
Upon activiation in Word, the virus will check for its codes in the "ThisDocument" Stream of the Global Template (NORMAL.DOT). If not found, the virus infects the global template and disables Word's macro virus protection.
Upon activation in PowerPoint, the virus searches for the "Triplicate" module in the "BLANK PRESENTATION.POT" PowerPoint Template. If not found, the virus disables PowerPoint's macro virus protection.
The virus then adds a viral module called "Triplicate" into "BLANK PRESENTATION.POT" and a basic AutoShape object that covers the entire slide. The viral module is linked to the AutoShape object.
This is an old macro virus. It is detected by pattern file #518 (Trend)
------------------
Thank you for using Help From Techs Support Forums!
Please come again and remember to refer a friend to our site.
Risk rating: low
Virus type: Macro
Destructive: N
Aliases:
TRISTATE, O97M_TRIPLICATE, TRIPLICATE, X97M_TRISTATE, P97M_TRISTATE, W97M_TRISTATE
Description:
This macro virus cross-infects Microsoft Word 97, Microsoft Excel 97, and Microsoft PowerPoint 97 applications.
In the wild: Yes
Trigger date 1: Any Day
Trigger condition 1: Upon activation
Payload 1: Others disables macro virus protection
Detected by pattern file#: 518
Detected by scan engine#: 2.062
Language:
English
Platform: Windows
Encrypted: No
Details:
The virus is activated from a Word document, an Excel spreadsheet/workbook, or from a PowerPoint slide and will cross-infect.
Upon activation in Excel the virus searches for BOOK1.XLS in the Excel Startup directory. If not found, the virus creates an infected workbook in the same directory and disables Excel's macro virus protection. The virus resides in the "ThisWorkbook" stream of an infected excel spreadsheet/workbook.
Upon activiation in Word, the virus will check for its codes in the "ThisDocument" Stream of the Global Template (NORMAL.DOT). If not found, the virus infects the global template and disables Word's macro virus protection.
Upon activation in PowerPoint, the virus searches for the "Triplicate" module in the "BLANK PRESENTATION.POT" PowerPoint Template. If not found, the virus disables PowerPoint's macro virus protection.
The virus then adds a viral module called "Triplicate" into "BLANK PRESENTATION.POT" and a basic AutoShape object that covers the entire slide. The viral module is linked to the AutoShape object.
This is an old macro virus. It is detected by pattern file #518 (Trend)
------------------
Thank you for using Help From Techs Support Forums!
Please come again and remember to refer a friend to our site.