Home / malware

PDF

Virus:W97M/Titch.H

First posted on 24 July 2019.
Source: Microsoft

Aliases :

Virus:W97M/Titch.H is also known as W97M/Titch.H, WM97/Titch-H, W97M.Titch.L, Virus.MSWord.Titch.g, W97M/Titch.h.gen, W97M.Titch.G, W97M_TITCH.H.

Explanation :

Virus:W97M/Titch.H is a macro virus, which infects Word 97 documents. It implements the AutoClose() method so that the virus code is executed immediately before the document is closed. When a user opens an infected Word document, the virus code is copied into the normal template if it is not yet infected. When the normal template is infected, the virus copies itself into all active documents if they are not yet infected. It sets the VirusProtection option to "False", which ensures that all macros (including this virus) are automatically run without user notification. It also sets the SaveNormalPrompt option to "True", and the ConfirmConversions option to "False".  Analysis by Marian Radu

Last update 24 July 2019

 

TOP