Network Associates Inc issued a High Risk warning for the so-called Thursday virus at the end of last week, putting it in the same category as Melissa, Chernobyl and Explore.zip. Thursday has already been found in a number of US and European financial institutions, and is believed to have already spread beyond them.
Thursday, or W97M/Thus.a, is a macro-virus that disables the Macro Warning feature of Word 97 in order to infect its documents. Its payload is designed to delete the contents of an infected user’s C drive on December 13. This year, December 13 is a Monday.
Symantec Corp discovered the virus on August 16, and rates it as Rare due to the fact that it has received only one infection report. Unlike Melissa Thursday is not capable of spreading itself via email. Melissa, also a Word 97 macro, was not destructive in itself, but brought down scores of email servers by sending itself to every address in an Outlook Express address book. Thursday can only be spread if attached to an email by an unwitting user.
There is no way of easily spotting Thursday infection, but anti-viral companies including Symantec and Network Associates have already released fix updates to eliminate it.
