ETHAN FROME VIRUS

Information about Ethan Frome virus:

This virus infects Word 97 documents, templates and the NORMAL.DOT file of Word 97. The virus code is contained in one macro named "Document_Close". This macro will be in the "ThisDocument" module of the infected file.

It creates a file called ETHAN.___ in the root directory of the C drive. This file contains the macro code of this virus. The virus marks this file as a hidden file. This file is used to copy the virus code while infecting other files.

Ethan.A virus also looks for CLASS.SYS file in the root directory of the C drive and deletes it if found. CLASS.SYS file is used in the similar way by the Class virus to infect other files.

Ethan.A virus uses a random counter and when the counter is set, the virus will change the title of the infected document to "Ethan Frome", and its author to "EW/LN/CB".

Ethan virus first appeared in February 1999 and it is in the wild.


Other names of Ethan Frome virus:
This worm is also known as W97M/Ethan, Word97.Ethan.