w97m_story_a

病毒名称：W97M_STORY.A

别名：STORY.A, JACK_BOX, W97M_JACK_BOX, Word97Macro.JackBox

病毒特点:

该病毒感染Word 97文档和模板文件normal.dot，并使MS Word的宏预警功能失效。该病毒由名为ThisDocument的模块构成，它通过查找字符串“J ACK-IN-THE-BOX”进行自检。 该病毒侵袭mIRC（互联网聊天）程序。 该病毒通过查找“C:MIRCMIRC.EXE”来判定用户是否安装了mIRC，如果安装了mIRC，该病毒就会在系统中创建一个mIRC脚本，名为SCRIPT.INI（C:MIRCSCRIPT.INI）。

这个mIRC脚本的主要特征是如果“C:WINDOWS”下存在名为STORY.DOC的文件时，就将该文件发送，如果文件不存在，它就会将当前打开的文档以STORY.DOC保存在c:windows目录下。这导致了被感染文件被广泛的传播。 其中，.DOC文件包含以下内容：

“I'm on irc.” 'Hey, I can't talk right now but I wanted to send you this file. It has a funny story you should read, and also has macros inside that protect you from a lot of viruses. Just open the document, enable the macros, and if you are infected it will get rid of the virus''Thanks for the invite I thought you might want to look at this file I got. It has a funny story and also has macros in it which get rid of any macro viruses. Just enable the macros when the prompt comes up and it will scan for any viruses and clean them.'