Virus Name
W97M/Ethan.A
Date Added
3/23/99
Virus Characteristics W97M/Ethan.A is a parasitic class module infector, which consists of one macro, and is approximately 50 lines of code in length. It infects documents and templates using an algorithm to input data, from a source file "c:\ethan.___", to the host document. This source file is exported VBA code of the virus. Viruses using class module infection method transfer the virus code to the "ThisDocument" container. This virus prepends its code and infects all documents accessed. There is a 3-in-10 chance that this virus will modify the document properties of infected files: Title = "Ethan Frome" Ethan has one additional characteristic in that if it detects the "class.sys" file (created from the W97M/Class virus infection) on the machine it will delete it. AVERT has developed detection and cleaning for Ethan for all VirusScan products with engine version 3.21 and above. Detection is also available for the Dr Solomon&squot s AVTK. AVERT recommends completely updating your Virus Definition files on a regular basis.
W97M/Ethan.A is a Word97 Macro Virus. It is a fast moving infector and reported to numerous AVERT Labs around the globe. Infection takes place when an infected Word document is closed, allowing the virus to propagate itself to normal.dot template.
Author = "EW/LN/CB"
Indications Of Infection
Not Available...
Method Of Infection
Not Available...
Virus Information
| Discovery Date: | 1/21/99 | |
| Type: | Macro | |
| Risk Assessment: | medium | |
| Minimum DAT: | 4010 |
Variants
Unknown
Aliases
Unknown
