Welcome to the Virus Encyclopedia of Panda Security.
|Effects: ||It infects Word documents and the global template. It also disables the macro virus protection and prevents the user from handling macros.
|Detection updated on:||May 14, 2009|
SFC is a macro virus that infects Word documents. This virus is easy to recognize when it spreads via e-mail, as the message carrying the worm always contains a Word document and the message text claims that the user's computer is infected and incites the user to delete a file called SFC.EXE.
SFC also spreads to other computers through the chat programs mIRC and Pirch.
SFC uses the normal means of infection used by macro viruses. First of all, it infects the global template (NORMAL.DOT file) used by this application and from then on, it infects all the Word documents open, closed or saved on the affected computer.
Once it has carried out its infection, SFC prevents the user from working with Word macros and disables the antivirus protection incorporated in this text editor.
SFC is difficult to recognize, as it does not display any message or warnings that indicate that it has infected a computer.
When SFC spreads via e-mail, it is easy to identify before it carries out its infection, as it reaches computers in an e-mail message which always contains the same text:
I have discovered that my computer has had a computer virus,
and I have removed all traces of it. This virus is causing problems for
lots of computer users worldwide.
However, there is a way to check to see if you have this virus on your computer system.
Click "Start", and then scroll up to "Find" or "Search" and select it
Wait until the file search application appears.
When the file search application appears, type "Sfc.exe" and click the find button. If your computer finds this file, DO NOT open this file.
It is infected with this virus. You can delete this file,
but the virus may still be active somewhere on your computer. To remove this virus.
I have included a document called
instructions on how to remove this virus from your computer
This text incites the user to delete a file called SFC.EXE, by claiming that it contains a virus. However, SFC.EXE is a Windows system file that exists on all computers running under a Windows operating system.