Threat Detail

  • Malware Type: Virus
  • Malware Sub-type: Floppy Worm
  • Protection Added: 2003-03-28

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Minimum Engine


File Length


Description Added


Description Modified


Malware Proliferation

fpo-ti-severity-legend logo-new-mcafee

This is a floppy worm. It was detected as "New Floppy Worm" with heuristic scanning turned on.

When run, the worm copies itself to c:\WINDOWS\SYSTEM\W16OFF.exe. It creates the following registry key in order to run at Windows start up:

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    "Spool32" = C:\WINDOWS\SYSTEM\W16OFF.exe

Every 2-3 minutes, the worm copies itself to floppy drive A:. It creates the following files:

  • A:\ - the worm itself.
  • c:\WINDOWS\SYSTEM\HTA.doc - word document.
  • A:\TRAP.doc - same word document.
  • c:\listf.vxd - a log file.

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

The worm propagates via floppy disk.
Existence of the files and registry keys mentioned above.