Welcome to the Virus Encyclopedia of Panda Security.
|Detection updated on:||Nov. 13, 2002|
| This is a macro virus that infects Microsoft Word 97 documents and the global template that this application uses. W97M/Ethan.CG disables the macro antivirus protection that Word generates. The virus carries out its infections when the documents are closed.|
When an infected document is closed W97M/Ethan.CG checks to see if a file called DRDEATH.___ can be found in the root directory of the hard disk. It this file does not exist, it proceeds to create it and assigns it a hidden attribute. This file is in charge of infecting Word documents.
In three out of ten infections, the virus modifies the Word documents properties by changing their Title, Author and the keywords.
W97M/Ethan.CG makes changes to Microsoft Word 97 documents, but this will only take place in three out ten cases. In these cases, the properties of the documents will be changed as follows:
Title is replaced with DrDeath.
Authoris replaced with EW/LN/CB.
Keywords is replaced with DrDeath.
The virus creates a file called DRDEATH.___, but this file remains hidden in the root directory of the hard disk. Then, it attempts to find a file called IVB.NTZ in the same directory and deletes it if found.