W97M/Class
| W97M/Class |
Destructivity:  Spreading:  Overall risk:
|
| • Detected by virus detection files published: 4/10/2000 | • Type: Virus |
| • Virus characteristics first published: 4/10/2000 | • Spreading mechanism: File Infection |
| • Virus characteristics latest update: 12/17/2003 | • Overall risk: Low |
| • Infection type: Microsoft Word 97/2000/XP/2003 |
| Virus type |
Spreading mechanism |
Destructivity and payload |
Additional descriptions |
Detection and removal |
||||||||||
|
The first members of this virus famliy were discovered about July 1998 and reported in-the-wild some months later. The virus infects the global macros area on opening an infected document. During infections it exports its code to 'c:\class.sys' and insert this code into Normal.dot. An infected Normal.dot uses the same method to infect documents. The virus stored its code in the Class Module "ThisDocument" instead of in the standard Macro Module. The presence of this virus can often be confirmed by the presence of the file c:\class.sys (file with .sys exstension is default hidden by Windows). It also disables 'Tools\Macro' and 'Tools\Macro\VisualBasic Editor' menus by incorporating two empty macros Viruses in this family are generally polymorphic and change its own code by inserting comments that contains the current user name, current date and time and information about the active printer and window. |
||||||||||||||