W97M.downloader virus

Question

Level 1

8 points

W97M.downloader virus

I opened an email attachment using Apple Mail on my iMac running High Sierra. It was from a trusted source and had part of an email chain attached. The attachment was Superdry.request.rpt.

On opening the attachment the warning that the file contain macros popped up and stupidly after having no respose to selecting 'disable macros' I chose 'enable macros'. Again nothing seemed to happen.

A couple of days later I tried to resend this email to my Gmail account and the system would not send it reporting it as a virus.

I had been running Intego Virus Scanner but this did not pick it up. I found a thread on Apple support that indicated that this was the virus HEUR.VBA.trojan.e. I contacted Intego and wrapped up the virus as a disk image and sent it to them. They responded that it was the trojan W97M.downloader.

Intego updated their database and on the next scan it was removed.

I find it difficult to find any information on this virus or the HEUR virus if it is triggered on OSX High Sierra. Is it dangerous, what does it do and how can I find out if there are any infected files downloaded? Subsequent scans by Intego Virus Scanner and Malwarebytes scanner do not pick any infected files.

Both viruses can be removed on scanning but if opened as I did, what did it do and is it dangerous?

Any advice would be gratefully received.

iMac, macOS High Sierra (10.13.4)

Posted on May 28, 2018 6:51 AM

Reply

Answer 1

Best reply

babowa

Level 9

78,097 points

May 28, 2018 8:56 AM in response to trogon01

Well, since it appears to be a Windows virus, it cannot do any harm to a Mac (unless you are running Windows) - see info here:

https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/w2km_fareit.amr

FWIW, I do not click on or open any attachment unless I am expecting one and/or it doesn't have a suspicious file name.

Reply

Answer 2

rkaufmann87

Level 10

140,274 points

May 28, 2018 8:57 AM in response to trogon01

In addition your AV app at best is useless for Mac OS. Mac OS simply needs to be kept up-to-date to remain extremely secure. There are no viruses for Mac OS, however there is a small amount of other types of malware. That is the bad news, the good news is you have to install them for them. If you use a bit of common sense and don't download from unknown or suspicious sites then you should be fine, don't respond to any calls, e-mails, popups, etc that indicate your computer is at risk or infected and do not use torrents to download software your computer should remain extremely secure.

Reply

Answer 3

trogon01 Author

Level 1

8 points

May 28, 2018 9:02 AM in response to babowa

Hi

Thanks for your helpful answer. I did find some information that a mac user had triggered the virus and that resulted in his gmail id sending out a stream of emails to his contact list. There is a great deal of conflicting information on what this virus can or cannot do. As you say it is designed for Windows implementation and it's not clear if the host servers which are the sources of downloadable malware, are still in existence or not.

As Office 2011 allows execution of VBA macros on Mac OS, I didn't know if this was a risk or not.

Best wishes

John

Reply

Answer 4

trogon01 Author

Level 1

8 points

May 28, 2018 9:07 AM in response to rkaufmann87

Thanks for your reply. I'm not certain that there are no viruses for Macs

See https://www.macworld.co.uk/feature/mac-software/mac-viruses-malware-security-366 8354/

I realise that Apple do try to keep the system as safe as possible. I will heed your advice and will not open attachments, however plausible as this one was, in the future

Best wishes

John

Reply

Answer 5

babowa

Level 9

78,097 points

May 28, 2018 10:59 AM in response to trogon01

I looked at that and it appears to only be included/effective in Word and a couple of other Windoze apps - not every Mac user does Windoze apps, so please don't generalize. I, for one, have never used (nor will I ever) anything Windoze related; therefore, even an email attachment would immediately be marked spam/junk/wind up in the trash.

Reply

Answer 6

May 28, 2018 11:56 AM in response to trogon01

trogon01 wrote:

Thats ok for you I guess but most people use Ms Office stuff even on Macs; I'm surprised you don't.

MS Office applications for Macs are not Windows applications. They are Mac applications made by Microsoft. In order to run a Windows application on your Mac, you need to install the Windows operating system on you Mac.

Reply