W97M/Class

W97M/Class	Destructivity: Spreading: Overall risk:

• Detected by virus detection files published: 4/10/2000	• Type: Virus
• Virus characteristics first published: 4/10/2000	• Spreading mechanism: File Infection
• Virus characteristics latest update: 12/17/2003	• Overall risk: Low
• Infection type: Microsoft Word 97/2000/XP/2003

Virus type

Spreading
mechanism

Destructivity
and payload

Additional
descriptions

Detection
and removal

Variants

There is a huge number of different variants of this virus.

Most of the variants display a message box with some text at certain day. This text as well as the day, are different for most variants.

The most common variant is W97M/Class.D.

Class.A

This variant displays a message box each month on day 31 with the text:

VicodinES /CB /TNN" and "This is Class"

Class.B

This variant is very simlilar to the .D variant. The text is slightly different and it does not change the name of the registrered user.

Class.C

Displays a messagebox each month from September to December on day 17 at a chance of 1/100. The text is similar to the .A variant.

Class.D

This variant displays a message box each month from June to December on day 14 with the text:

It also change values in the registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\ RegistreredOwner = "VicodinES /CB /TNN"
RegistreredOrganization = "(-Dr. Diet Mountain Dew)-"

# - A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z