Poem

Upon infection, the virus becomes memory resident in low available system memory. Interrupts 01, 03, 21, and 7C are hooked by the Poem virus in memory.

Once Poem is memory resident, it infects .COM files, other than very small .COM files, as they are executed.

Additional Comments:
The Poem virus was isolated in the Republic of South Africa in September, 1991, by Oliver Steudler. Poem is a memory resident infector of .COM programs, including COMMAND.COM. The first time a program infected with Poem is executed, the virus will become memory resident in low available system memory. Interrupts 01, 03, 21, and 7C will have been hooked by the Poem virus in memory. Once Poem is memory resident, it will infect .COM programs, other than very small .COM programs, when they are executed. If COMMAND.COM is executed, it will become infected as well. Poem infected programs will have a file size increase of approximately 1,825 to 1,888 bytes with the virus being located at the end of the infected file. There will be no change to the file's date and time in the DOS disk directory. The copy of Poem resident in memory keeps track of how many times interrupt 21 has been called. Once interrupt 21 has been called 2,112 time, the virus will display the following poem on the system display, and the user will be prompted to press Escape to continue: "Void - Composed by Marvin Giskard for T.... In a field a million buds stood,Over them a million days came - a day a bud - opening up one by one with their directed light.But one didn't do as others did,It waited for only your loving rays to shine upon it to open its pedals revealing the pure beauty of its sincere love. Never being unfaithful to its dream of the day of your light, Forced to resist any other light but yours - because of it - until the day the brilliance of your life sustaining light shines it will be there : wanting, wishing, waiting. Many were the buds you rather shined upon opening them - revealing their phony colours. I willed your light onto me but others you tried instead, No subtle motion reached you, still I refused other's light - holding out for you - Even when your light will fade, Not having found one to do your light justice, mine will still be there : wanting, wishing, waiting. 22 Nov - 21 Dec" On December 21 of any year, Poem will activate. At that time, the virus will also display the above poem, as well as overwrite the first 1,221 sectors of the system hard disk, drive C:, with an unencrypted copy of the virus' code.

"Void - Composed by Marvin Giskard for T....

In a field a million buds stood, Over them a million days came - a day a bud - opening up one by one with their directed light. But one didn't do as others did, It waited for only your loving rays to shine upon it to open its pedals revealing the pure beauty of its sincere love. Never being unfaithful to its dream of the day of your light, Forced to resist any other light but yours - because of it - until the day the brilliance of your life sustaining light shines it will be there : wanting, wishing, waiting. Many were the buds you rather shined upon opening them - revealing their phony colours. I willed your light onto me but others you tried instead, No subtle motion reached you, still I refused other's light - holding out for you - Even when your light will fade, Not having found one to do your light justice, mine will still be there : wanting, wishing, waiting.

22 Nov - 21 Dec"

On December 21 of any year, Poem activates. On this date, the virus displays the above poem, and overwrites the first 1,221 sectors of the system hard disk, drive C:, with an unencrypted copy of the virus' code.

Poem infected files have a file size increase of approximately 1,825 to 1,888 bytes. The virus is located at the end of the infected file. There are no changes to the file's date and time in the DOS disk directory.

The only way to infect a computer with a file infecting virus is to execute an infected file on the computer. The infected file may come from a multitude of sources including: floppy diskettes, downloads through an online service, network, etc. Once the infected file is executed, the virus may activate.

All Users :
Script,Batch,Macro and non memory-resident:
Use current engine and DAT files for detection and removal.

PE,Trojan,Internet Worm and memory resident :
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner:

Additional Windows ME/XP removal considerations

Users should not trust file icons, particularly when receiving files from others via P2P clients, IRC, email or other mediums where users can share files.

AVERT Recommended Updates :

* Office2000 Updates

* Malformed Word Document Could Enable Macro to Run Automatically (Information/Patch )

* scriptlet.typelib/Eyedog vulnerability patch

* Outlook as an email attachment security update

* Exchange 5.5 post SP3 Information Store Patch 5.5.2652.42 - this patch corrects detection issues with GroupShield

For a list of attachments blocked by the Outlook patch and a general FAQ, visit this link .
Additionally, Network Administrators can configure this update using an available tool - visit this link for more information .

It is very common for macro viruses to disable options within Office applications for example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.