Virus Information Library: CLASS.D

CLASS.D

To return to top of page,
select any

link

Virus Characteristics This virus propagates by infecting Word Documents in Microsoft WORD Versions 97 on Windows. The irus becomes active by using AutoMacros within the class stream of VBA.

Indications of Infection
On the first infection it will drop an exported copy of the virus code in an ascii file c:\class.sys. When working with the infected files on the 14TH of the month and the current month is not January through April, a message box like
- Class.Poppy X

I Think " (word97 reg. User name) " is a big stupid jerk!

OK
is displayed. Also this virus modifies the RegisteredOwner and RegisteredOrganization values in the registry at the following location-
HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion
RegisteredOwnder="VicodinES/VB/TNN"
RegisteredOrganization="-(Dr. D

Method of Infection General Macro Virus Information

Removal How To Clean Your System With VirusScan How to Clean Your System With VirusScan

Additional Information How to Repair Macro Virus Damages

Prevention How to Prevent Macro Virus Infection

Virus Information

Discovery Date	Nov 1998
Origin	UNKNOWN
Length	Not Applicable
Type	General Macro Virus Information
Prevalence	Common

Variants

Aliases CLASS CLASS CLASS