Home / malware

PDF

Virus:WM/Cap.A

First posted on 06 May 2015.
Source: Microsoft

Aliases :

There are no other names known for Virus:WM/Cap.A.

Explanation :

Threat behavior

Virus:WM/Cap.A is a virus that was first seen in the 1990's. It infects Microsoft Word document (.doc) files.

Installation

This threat arrives on your PC as an infected document file (.doc).

If you're infected, you might see the following encrypted macros:

• AutoClose
• AutoExec
• AutoOpen
• CAP
• FileClose
• FileOpen
• FileSave
• FileSaveAs
• FileTemplates
• ToolsMacro

Spreads through...

File infection

This threat infects other .doc files when it runs.

Payload

Deletes macros

If the virus finds other macros in a .doc file, it will delete them before it infects the file.

Disables menus

It also attempts to disable menus such as the following:

• File->Open
• File->New
• File->Save
• File->SaveAs
• Tools->Macro
• Tools->Template

It might do this to limit your use of .doc files.



Analysis by Ric Robielos

Symptoms

The following can indicate that you have this threat on your PC:

• You have limited control over .doc files.
• You see the following encrypted macros:
  • AutoClose
  • AutoExec
  • AutoOpen
  • CAP
  • FileClose
  • FileOpen
  • FileSave
  • FileSaveAs
  • FileTemplates
  • ToolsMacro

Last update 06 May 2015

 

TOP