Hi,

We are facing a virus problem on our network, but I'm unable to identify it, so we can't properly deal with it.

The symptoms are that the virus duplicates a word document (.doc) generating a new archive with the same name, but with an exe extension, and, after that, the virus hides the original file.

So, when the user clicks over the file, it propagates itself.

Symantec AV seems to be able to block it: every time that the virus tries to generate the exe, symantec blocks it, but at this point, the original file was already converted to hidden, so the user thinks that the file has been deleted.

Symantec identifies it as a simple trojan horse. I already started a full scan, but it didn't found nothing.

I'm trying to know the virus name in order to fight it.

Does anyone has any kind of information?

TIA,

Bob