TECH: Any info on W97M.Story.A or W97M.IRCJack.B virus?

[Jody Newman <jcnewma@attglobal.net>]

Greetings:

After years of wondering how Norton's Antivirus was really protecting my
machine, I found out recently. A virus named W97M.Story.A (alias
W97M.IRCJack.B) appeared in an attachment I had sent to myself from an
outside computer. The screen shook and a warning appeared on the screen
that said the virus had been detected and what did I want to do about
it...I chose the "Repair" route - which Norton's said it handled and
that the file was safe to use - and all appears well. Wanting to get to
the source of the problem, I went to where I volunteer- which also has
Norton's installed - and downloaded the most recent goodies from
Norton's Live Update and scanned that computer. It said the machine was
clean! Just to be sure the Virus Information for this virus was
downloaded,  I  looked in the Norton's listing of viruses that Norton's
would detect...and this one was not listed - ??? I went again to the
Norton's Live Update and downloaded the most current virus updates, and
it still didn't appear in the listing. Obviously the machine got a clean
bill of health from the scan, because it didn't know to look for this
particular virus!  Why would I be able to download it at home with the
live update and not be able to get the same protection at my volunteer
place?

Also, does anyone know anything about this virus and what it is and
might do? Norton's information says that it's characteristics are all
negative for: Memory resident, Size Stealth, Full Stealth, Triggered
event, Encrypting, Polymorphic. It comments that "In addition to
infecting documents, STORY.DOC is added to C:\WINDOWS, and SCRIPT.INI is
added to C:\MIRC if C:\MIRC\MIRC32.EXE is installed. The script will
copy itself to C:\WINDOWS\SCRIPT1.INI when executed."

This is pretty much GREEK to me. I have run the scan disk on my hard
drive files a number of time and am clean. When I scanned a floppy disk
that I use to transport files from the volunteer location to home...it
is full of virus and Norton's can't even quarantine it on the diskette
let alone "repair" it. Why is it possible for Norton's to "repair" files
when I get them as an attachments in an email and also when I go to open
them from the disk, but it won't handle it on a scan disk when I'm
specifically looking for a virus to fix? It doesn't make sense and it
has me very worried.

I tried going to the Symantec Search page to find out about this virus
and couldn't locate it in their listing - which is even more peculiar -
but I might not be doing the search correctly. I tried other virus/hoax
sites, and no one had anything on it.

I am PRAYING that someone is knowledgable about Norton's and this virus
in particular. I'm a bit schizoid about doing any more volunteer work!
Please help if you have any input.

Thanks so much in advance

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Jody Newman
Library Aide, retired
Stow, MA
jcnewma@attglobal.net (home)
   aka jcnewma@ibm.net (til 10/2000)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=
All postings to LM_NET are protected under copyright law.
To quit LM_NET (or set-reset NOMAIL or DIGEST), send email to:
listserv@listserv.syr.edu   In the message write EITHER:
1) SIGNOFF LM_NET 2) SET LM_NET NOMAIL or 3) SET LM_NET DIGEST
4) SET LM_NET MAIL  * Please allow for confirmation from Listserv.
For LM_NET Help see: http://ericir.syr.edu/lm_net/
Archives: http://askeric.org/Virtual/Listserv_Archives/LM_NET.html
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=