My Bitdefender
  • 0 Shopping Cart

SHARE
THIS ON

Facebook Twitter Google Plus

W97M.Ethan.AK

VERY LOW
LOW
5385 Bytes
(W97M.Ded.K, W97M.Ded.R)

Symptoms

None.

Removal instructions:



Analyzed By

Mihaela Stoian BitDefender Virus Researcher

Technical Description:

The virus copies itself in a temporary file, named "evolve.tmp", in the root directory (usually "C:\" ).

At opening, if the virus is a macro in a ".doc" file, it infects normal.dot.
If the virus is a macro in normal template ("normal.dot"), it infects documents when they are opened.

It verifies the file macros, and it doesn't infect a macro that begins with "Private Sub Open" and ends with "End sub". So, it doesn't infect the same macro twice.

The virus doesn't have any destructive payload, it only spreads itself through Microsoft Word Application.