W97M/Thus.A has been given a HIGH risk assessment by AVERT. Though it spreads through sharing of documents, and not by automatically emailing itself across networks, it has achieved a high rate of prevalence very quickly.

The virus carries a potentially destructive payload that will attempt to delete all files on a user's c: drive on the trigger date of December 13th. The pattern of reports from multiple financial institutions around the world in rapid succession suggests the initial outbreak may have occurred through the distribution of a single infected document within the financial community.

Users infected with the Thursday virus will see no obvious indications that a document has been infected. However, because the virus infects Word 97's normal.dot, the size of that file will increase from its normal 27K. In addition, the virus turns off Word 97's Macro Warning feature. If a "clean" document known to contain macros does not produce the regular warning, this may be an indication that the system is infected.

Prior to infecting a document, the virus will look to see if it has already infected the document by checking for a comment - thus.000 - if this comment is found the virus will not reinfect.