PAPA WORM

Information about the Papa worm:

This is a worm that uses Excel 97 Workbook as a base to spread on its own. This worm works on both Excel 97 and Excel 2000.

This worm is similar to Melissa virus in its capability to spread. It has the ability to spread itself very fast using email. When the Workbook infected by Papa worm is opened for the first time, it checks whether the user's computer is installed with MS Outlook. If it finds Outlook then the worm sends email to 60 addresses found in the address book of outlook. The email sent by the worm will contain the subject "Fwd: Workbook from all.net and Fred Cohen". The body of the email will contain "Urgent info inside. Disregard macro warning." The worm will attach the infected workbook in the name of PASS.XLS to the message. The worm can spread very fast because of this method.

Papa will not infect PERSONAL.XLS or other workbook. It will only spread via email. It does not have any destructive code.

Papa worm first appeared in March 1999 and it is not in the wild.


Other names of Papa worm:
This worm is also known as X97M/Papa, Excel.Papa, Password, Papa.B.