x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with a 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET A 50% OFF
x
CHRISTMAS OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 40% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET A 50% OFF
x
BLACKFRIDAY OFFER
Buy the best antivirus
at the best price
TODAY ONLY UP TO 70% OFF
x
CYBERMONDAY OFFER
Buy the best antivirus
at the best price
(Only for homeusers)
TODAY ONLY UP TO 70% OFF
Active Scan. Scan your PC free
Panda Protection

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Encyclopedia GetVirusCard True 0

Ethan.CG

 
Threat LevelModerate threatDamageHighDistributionNot widespread
Common name:Ethan.CG
Technical name:W97M/Ethan.CG
Threat level:Low
Alias:,
Type:Virus
Affected platforms:

Windows 2003/XP/2000/NT/ME/98/95

Detection updated on:Nov. 13, 2002
StatisticsNo
Family:ETHAN

Brief Description 

    
This is a macro virus that infects Microsoft Word 97 documents and the global template that this application uses. W97M/Ethan.CG disables the macro antivirus protection that Word generates. The virus carries out its infections when the documents are closed.

When an infected document is closed W97M/Ethan.CG checks to see if a file called DRDEATH.___ can be found in the root directory of the hard disk. It this file does not exist, it proceeds to create it and assigns it a hidden attribute. This file is in charge of infecting Word documents.

In three out of ten infections, the virus modifies the Word documents properties by changing their Title, Author and the keywords.

Visible Symptoms 

    

W97M/Ethan.CG makes changes to Microsoft Word 97 documents, but this will only take place in three out ten cases. In these cases, the properties of the documents will be changed as follows:

  • Title is replaced with DrDeath.


  • Authoris replaced with EW/LN/CB.


  • Keywords is replaced with DrDeath.



The virus creates a file called DRDEATH.___, but this file remains hidden in the root directory of the hard disk. Then, it attempts to find a file called IVB.NTZ in the same directory and deletes it if found.