Triplicate virus.
 Information
about the triplicate virus:
This virus infects Word 97 documents NORMAL.DOT
file of Word 97 and Word 2000. Through Word97 it infects Excel spread sheets
and PowerPoint files.
When the infected file is opened under
Word 97 it disables Macro virus protection of the MSWord, after
this it will infect NORMAL.DOT which is a global template there by it transfers
virus code in to that. Virus removes all the macros from the global template
and inserts a procedure DisableAV(). This procedure carries code
which disables Macro virus protection of Excel and Power Point in
the registry.
Virus will invoke MS Excel and creates
a file called BOOK1.XLS under Excel startup directory. If the file BOOK1.XLS
is already present then it would not infect Excel. In the last virus will
launch Power Point and searches for a module called Triplicate,
if this module does not exists then it will insert a shape in the first
slide Blank Presentation which is under template directory.
The infected file carries the following
text which is visible in all the infected documents:
<!--1nternal--> Triplicate v0.1
/1nternal
Triplicate virus first appeared in May
1999 and it is in the wild.
Variants
of triplicate virus :
Triplicate
B:
This variant almost same
as Triplicate. There is some minor bug fix in the virus code and
the text in the infected document has been changed to:
"Triplilcate.b":
<!--1nternal--> Triplicate v0.11 /1nternal
Triplicate
C:
This variant almost
same as Triplicate. There is some minor modifications in the virus code
and the text in the infected document has been changed to:
"Triplilcate.c":
<!--1nternal--> Triplicate v0.2 /1nternal
Triplicate
D:
This variant almost
same as Triplicate. There is some minor modifications in the virus code
and the text in the infected document has been changed to:
"Triplilcate.d":
<!--1nternal--> Triplicate v0.21 /1nternal
Other
names of triplicate virus :
This worm is also known as W97M/Tristate.
Removing
triplicate virus from your computer:
You can remove this virus from your computer
by using Protector Plus antivirus software.
Click
here to download a 30 day Evaluation Copy of
Protector Plus for your operating system
|
