Selected viruses, spyware, and other threats: sorted alphabetically

This macro virus infects documents and templates of the program Word 97. Upon infection the virus disables the protection of documents against viruses and changes the program setting so that it does not report alternations of the global template NORMAL.DOT. The virus checks whether the root directory of disk C:\ contains a file with name ETHAN.___. If it does not find this file it creates it and copies its code and other macros into it. Later, when infecting, the virus copies its code into documents from this file. The file ETHAN.___ is not visible for the user because its attributes are set to be a hidden and system file. When operating in the the virus changes title in the document properties to “Ethan Frome“, document author to “EW/LN/CB“ and company to “Foo Bar Industries Inc.“. In case that the file C:\CLASS.SYS exists the virus deletes it. This file is created on the disk by the macro virus W97M/Class. There are more variants of this virus.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.