x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 40% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Panda Protection

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

SFC

Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:SFC
Technical name:W97M/SFC
Threat level:Low
Type:Worm
Effects:  It infects Word documents and the global template. It also disables the macro virus protection and prevents the user from handling macros.
Affected platforms:

Windows XP/2000/NT/ME/98/95

Detection updated on:May 14, 2009
StatisticsNo

Brief Description 

    

SFC is a macro virus that infects Word documents. This virus is easy to recognize when it spreads via e-mail, as the message carrying the worm always contains a Word document and the message text claims that the user's computer is infected and incites the user to delete a file called SFC.EXE.

SFC also spreads to other computers through the chat programs mIRC and Pirch.

SFC uses the normal means of infection used by macro viruses. First of all, it infects the global template (NORMAL.DOT file)  used by this application and from then on, it infects all the Word documents open, closed or saved on the affected computer.

Once it has carried out its infection, SFC prevents the user from working with Word macros and disables the antivirus protection incorporated in this text editor.

 

Visible Symptoms 

    

SFC is difficult to recognize, as it does not display any message or warnings that indicate that it has infected a computer.

When SFC spreads via e-mail, it is easy to identify before it carries out its infection, as it reaches computers in an e-mail message which always contains the same text:

I have discovered that my computer has had a computer virus, 
and I have removed all traces of it. This virus is causing problems for
lots of computer users worldwide.
However, there is a way to check to see if you have this virus on your computer system.
Click "Start", and then scroll up to "Find" or "Search" and select it
Wait until the file search application appears.
When the file search application appears, type "Sfc.exe" and click the find button. If your computer finds this file, DO NOT open this file.
It is infected with this virus. You can delete this file,
but the virus may still be active somewhere on your computer. To remove this virus.
I have included a document called
instructions on how to remove this virus from your computer
Thanks.
This text incites the user to delete a file called SFC.EXE, by claiming that it contains a  virus. However, SFC.EXE is a Windows system file that exists on all computers running under a Windows operating system.