# MA-008.041999: MyCERT Advisory - X97M/Papa Worm

**Date:** 01 Apr 1999  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-008.041999  
**Advisory ID:** MA-008.041999

---

1.0 Description
#### 1.1 Overview
The X97M/Papa worm is a macro worm. This newly discovered worm has two versions, Papa.A and Papa.B. The former version does not function and replicate properly due to a bug in the macro code. However, the latter version of the worm has been found to propagate and able to spread via Internet similar to W97M/Melissa virus. It is known to replicate in the form of a Microsoft Excel spreadsheet. Using the macro language in Microsoft Excel in conjuction with Microsoft Outlook, the worm sends copies of itself to email addresses configured in Outlook's address lists.
#### 1.2 Limitation
In order for the worm to self-propagate, one must have both Microsoft Excel and Microsoft Outlook installed in their computer system.
It will not self-propagate simply by reading your email. You must launch or run the attached Excel spreadsheet.
### 2.0 Technical Matters
#### 2.1 Installation
An infected user will receive Papa.B from other infected user via Outlook. The user receiving the document will neither know that they have been infected, nor will the sender know the spreadsheet has been sent. A user may become alerted to the worm if the Macro Security settings are enabled. This warning will be displayed to the user when the spreadsheet is opened.
#### 2.2 Functionality
Upon opening an infected spreadsheet, the worm composes an email to the first 60 mail addresses in each address list configured in Microsoft Outlook. The email sent by the worm will look 
```
From : (name of the infected user)   To : (60 names from alias list of the infected user)   Subject : Fwd : Workbook from all.net and Fred Cohen   Urgent info inside. Disregard macro warning.     Attachment : XPASS.XLS
```
The attachment was originally named **CRACKED.XLS**. However, filenames are easily changeble, so the worm may spread as a different filename. The worm attaches the Excel spreadsheet to the email and sends the message, propagating itself further. Such mass mailings can cause network congestion and an increase in payload on email servers forcing them to be shut down.
The worm also contains an additional payload with a random trigger. The payload performs a ping on two different IP addresses with a random buffer size for an indefinite amount of time potentially causing a **denial of service** and additional network congestion.
### 3.0 Possible Seps
#### 3.1 Prevention
3.1.1 It is important to note that one should practise safe computing practices and avoid opening email attachments that may contain viruses, worms or other malicious programs.
#### 3.2 Detection/Removal
As of today, the followings are the sites that have detection and removal for this macro worm. However, do visit your respective anti-virus vendor sites from time to time for their updates.
McAfee and Dr. Solomon
**http://www.mcafeeb2b.com/naicommon/download/dats/find.asp**
Norton Antivirus
**http://www.symantec.com/avcenter/download.html**
F-Secure Antivirus
**http://www.datafellows.com/download-purchase/updates.shtml**
Sophos Anti-Virus
**http://www.sophos.com/downloads/ide/index.html#papa**
### 4.0 More Information
To obtain more information on this virus, please refer to the following site :
4.1 AVERT
**http://vil.nai.com/vil/content/v\_10145.htm**
4.2 Symantec AntiVirus Research Center
**http://www.symantec.com/avcenter/venc/data/x97m.papa.b.html**
4.3 Data Fellows Computer Virus Information Pages
**http://www.europe.f-secure.com/v-descs/papa.shtml**