Virus that duplicates word documents as exe

Posted by Bob Rivers on Server Fault See other posts from Server Fault or by Bob Rivers
Published on 2010-02-15T16:39:32Z Indexed on 2010/03/23 21:23 UTC
Read the original article Hit count: 545

Filed under:

Hi,

We are facing a virus problem on our network, but I'm unable to identify it, so we can't properly deal with it.

The symptoms are that the virus duplicates a word document (.doc) generating a new archive with the same name, but with an exe extension, and, after that, the virus hides the original file.

So, when the user clicks over the file, it propagates itself.

Symantec AV seems to be able to block it: every time that the virus tries to generate the exe, symantec blocks it, but at this point, the original file was already converted to hidden, so the user thinks that the file has been deleted.

Symantec identifies it as a simple trojan horse. I already started a full scan, but it didn't found nothing.

I'm trying to know the virus name in order to fight it.

Does anyone has any kind of information?

TIA,

Bob

© Server Fault or respective owner

Related posts about virus