WM97/Adenu-B

Aliases	Virus.MSWord.Adenu
Category	Viruses and Spyware
Type	Virus
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


How it spreads	Infected files
Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	November 2005 (3.99)
Protection available since	18 August 2005 14:40:23 (GMT)
Last updated	6 October 2005 18:20:26 (GMT)
Detected by	All Sophos products

WM97/Adenu-B prepends a message to the contents of the active document if the date is 26 June.

WM97/Adenu-B lowers the Microsoft Office Security settings by setting the following registry entry:

HKCU\Software\Microsoft\Office\9.0\Word\Security\
Level
"01"

WM97/Adenu-B also disables the following Toolbar options:

Tools|Macro, Tools|Customize, Tools|Templates and Add-Ins

WM97/Adenu-B drops VBS/Adenu-B to the Windows System folder as "che.ocx.vbs" and sets the following registry entry so that it is run on startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
che32
"<System>\che.ocx.vbs"

Get reports about the latest virus and spyware threats delivered to your computer