HOME > Security Info

W97M.Class

Aliases
Typical Symptoms	Displays message box,Prints screen
Discovered	[korea] 0000-00-00  [Foreign] 1998-09-01
Type	Virus	ActiveField	Macro
Destory/Distribution
Origin	others	Encryption	Polymorphic
Location	Macro	Memory residence	NO
Scan engine needed	1998-09-15 [Able to detect & repair]

W97M.Class is a macro virus that infects "Normal.dot" when the infected Microsoft Word 97 file is opened, then propagates itself to other files. It drops "Class.sys" under the root directory and adds itself if there is another macro virus. Infected "Normal.dot" file has two macros - AutoClose and ToolsMacro. It hides its code using ToolsMacro, which removes the macro menu in the toolbar. W97M.Class is a macro virus that infects "Normal.dot" when the infected Microsoft Word 97 file is opened, then propagates itself to other files. It drops "Class.sys" under the root directory and adds itself if there is another macro virus. Infected "Normal.dot" file has two macros - AutoClose and ToolsMacro. It hides its code using ToolsMacro, which removes the macro menu in the toolbar. This virus removes macro protection function in MS Word 97 to disguise the infection.   It displays the following message on 31st of every month. VicodinES /CB /TNN With the exception of the pop-up message on trigger date, the variants of this virus has the same payloads.

Download the latest definitions of 15 September 1998 or above to scan and repair all files.