Virus w97m thus.gen

Because Microsoft Office is so commonly used, most computer users are familiar with it and generally trust files associated with its programs. Attackers thus try to exploit the implicit trust and familiarity users have with such files by secretly embedding malicious code into document files and distributing them, either en mass or to targeted users. These 'bait' files are often specifically designed, or 'socially engineered', to look legitimate.

For example, they may use filenames such as 'resume. The careful crafting of the bait files is meant to encourage the user to believe the document is trustworthy and open the file - and in so doing, unsuspectingly run the malware. Some W97M malware exploit vulnerabilities in the Microsoft Word program itself to execute code on the user's computer, though this is relatively less common, since it requires more technical skill to accomplish.

Other W97M malware are independent programs that only use the Word document as a 'carrrier', and once run they can operate separately. The most common type of W97M malware however is a malicious macro embedded into the Word document itself. A macro is a tiny program that can be legitimately used in Word to automate some functions, but an attacker can also craft a macro to perform malicious actions. Most often, these malicious macros are used by attackers to download additional malware onto the user's computer.

Some representative examples of macro malware in Word documents are:. With changes in the threat landscape today, F-Secure has updated its platform designation convention and malware affecting this platform now uses the platform designation, 'WM'. Javascript is disabled in your web browser For full functionality of this site it is necessary to enable JavaScript. Classification Category :. Type :. Aliases :. Then trash the original, infected file. Enable the option to receive a warning when a Word document contains macros.

In some circumstances, yes. Finally, the Normal template document that Word defaults to is likely contaminated as well. This is a bad thing because any new documents you create based on that template will contain the macro virus. Platform :. Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it. A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs.

A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:. First check if your F-Secure security program is using the latest detection database updates , then try scanning the file again. After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis. NOTE If the file was moved to quarantine , you need to collect the file from quarantine before you can submit it.

If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product. Note You need administrative rights to change the settings. Find the latest advice in our Community. See the user guide for your product on the Help Center. Chat with or call an expert for help.

A macro is a compact set of commands or instructions for performing a task. While macros are often used legitimately to automate helpful actions, they can also be used by attackers to automate harmful ones.