Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Ethan.Q is a macro virus operating in the Microsoft Word 97 environments. It attacks active documents and the global template normal.dot. Its code is derived from W97M/Ethan.A.
Upon opening an infected document the virus prohibits interruption of program activities by keyboard; it turns off documents protection against viruses and suppresses displaying of warning window at writing into the global template. It checks whether the file c:\mwencek.___ exists on the disk. If this file does not exist the virus creates it and exports its code into the file. When infecting, the virus copies its code into attacked documents from this file. It attacks documents when they are opened.
If the file C:\class.sys exists the virus deletes it. This file is created on the disk by the macro virus W97M/Class.
When operating in the documents the virus, with chance less than 30%, changes title in the document properties and the document author to “Mark L. Wencek“ and key words to “CHASE“.
The file properties window then looks as follows:

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.