Selected viruses, spyware, and other threats: sorted alphabetically
W97M/Ethan.BE |
W97M/Ethan.BE is a macro virus operating in the Microsoft Word 97 environments. It attacks active documents and the global template normal.dot. Its code is derived from W97M/Ethan.A.
Upon opening an infected document the virus prohibits interruption of program activities by keyboard; it turns off documents protection against viruses and suppresses displaying of warning window at writing into the global template. If there is file c:\calvert.___ the virus deletes it. After that it exports its code into file c:\calvert.___. When attacking, the virus copies its code from this file into documents. It attacks documents when they are closed.
In case that the file C:\class.sys exists the virus deletes it. This file is created on the disk by the macro virus W97M/Class.
When operating in the documents the virus, with chance less than 30%, changes title in the document properties to “calvert Frome“, document author to “EW/LN/CB“ and key words to “calvert“.
The file properties window then looks as follows:
© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.
