CLASS VIRUS

Information about the Class virus:

This virus infects Word 97 documents, templates and the NORMAL.DOT file of Word 97. The virus code is contained in two macros. These macros will be in the "ThisDocument" module of the infected file. The names of the virus macros are "AutoOpen" and "ViewVBCode" in all the infected files except in the NORMAL.DOT file, in which it will be "AutoClose" and "ToolsMacro".

The Class virus creates a file called CLASS.SYS in the root directory of the C drive. This file contains the macro code of this virus. This file is used to copy the virus code while infecting other files.

The virus code varies in every infection because the virus puts some comments inside its code. The comments contain the current date and time, user name and some information about the printer used.

This virus displays this message on the 31st day of every month:

This Is Class
o-o-o-o-o-o-o-o-o-o-o-o-o-o
o VicodinES /CB /TNN o
o o-o-o-o-o-o-o-o-o-o-o-o-o

Class virus first appeared in December 1998 and it is in the wild.

Variants of Class virus:

Class D:

Class.D virus displays this message on the 14th day of the month (only from June to December):

I Think XXXXXX is a big stupid jerk!
VicodinES Loves You / Class.Poppy

(XXXXXX will be the current user's name)This variant of Class virus also randomly changes registered user of Windows to "Dr. Diet Mountain Dew" in the Windows registry.

Class B :

Class.B virus is same as Class.D but it does not alter the registry.


Other names of Class virus:
This worm is also known as W97M/Class, Word97.Class.