Class Viruses

The Class family of macro viruses is very common. It is also called W97M/Class or "Microsoft Word 97 Macro Class virus". It travels in the ThisDocument module in Word 97, which is present in all documents. It is not visible in the macro Organizer. It works on any language version of Word. It works on SR-1, which stops most other macro viruses. These viruses use a temporary file to copy their code. These viruses turn off Word's Virus Protection, turn off Prompt to Save NORMAL.DOT, and turn of Confirm Conversions. These viruses are polymorphic and insert semi-random comments between their lines of code. Most of these viruses also disable Tools/Macro and the VB Editor.

MVK 97 can remove Class viruses and other Word 97 viruses automatically.

Class.A: It uses a temporary file called CLASS.SYS. On the 31st of any month it displays:
This Is Class
•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•
• VicodinES /CB /TNN •
•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•-•
Class.B: It uses a temporary file called CLASS.SYS. On the 14th of any month over the fifth it displays:
VicodinES Loves You / Class.Poppy
I Think [UserName] is a big stupid jerk!
Class.D: It uses a temporary file called CLASS.SYS. On the 14th of any month over the fifth it displays:
VicodinES Loves You / Class.Poppy
I Think [UserName] is a big stupid jerk!
It changes the registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner to
"VicodinES /CB /TNN"
and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOrganization to
"-(Dr. Diet Mountain Dew)-"
Class.dam: ".dam" is the Dr. Solomon abbreviation for damaged viruses or virus remnants. Most likely, those documents were disinfected with an antivirus program that leaves virus remnants in the documents. MVK 97 can remove these remnants.
Class.E: It uses a temporary file called CLINTON.SYS. With a 1% chance it displays:
Monica Blows Clinton! -=News@11=-
On the 17th of any month greater than 8 it displays:
Today is Clinton & Monica F***-Fest Day!
Class.F: It uses temporary files called ONE.SYS and TWO.SYS. On July 28 it displays:
WOOBIE
-=-=-=-=-
"Das Woo"
R.I.P July 28, 1998
We Love YOu [sic]
-=-=-=-=-
1992-1998
You Will Be Missed
Class.G: It uses a temporary file called CORE.SYS. With a 1% chance it displays:
CoRe By ViRuS
On the 13th of December it displays:
PRO ViRuS
Class.H: It uses a temporary file called GERBIL.SYS. With a 2% chance it displays:
GERBIL By ViRuS
Class.I: It uses a temporary file named after the user's initials. It contains the comment:
' Class.Poppy.Gold Infection Log
' ------------------------------
It adds the comment to itself in order to create a log file of all its victims:
' I infected [UserName] on: [Time]
Class.J: It uses a temporary file called SEEDII$.DLL. With a 1% chance it visits http://www.cannabisculture.com. With a 1 in 75 chance it visits http://www.Microsoft.com. It contains the comment:
'Word97/Class.Seed II by Virus :) Smile!
With a 2% chance it displays:
PRO ViRuS
With a 4% chance it displays:
CLASS SEED II
Class.K: It uses a temporary file called GERBIL.SYS. With a 2% chance it displays:
GERBIL By ViRuS
It contains the comment:
'wm97/class.gerbil by virus
Class.L: It uses a temporary file called TIE.SYS. With a 1% chance it displays:
TiE By ViRuS
On the 1st of any month except January it displays:
PRO ViRuS
Class.M: It uses a temporary file called CGOLD.DRV It contains the comment:
' Class.Poppy.Gold Infection Log
' ------------------------------
It adds the comment to itself in order to create a log file of all its victims:
' I infected [UserName] on: [Time]
Class.N: It uses a temporary file called CGOLD.DRV It contains the comment:
' Class.Poppy.Gold (noPoly) Infection Log
' ------------------------------
It adds the comment to itself in order to create a log file of all its victims:
' I infected [UserName] on: [Time]
Class.O: It uses a temporary file called CGOLD.DRV
Class.P: It uses a temporary file called ZENTORY$.FFO. If the Word version is 8.0.4412 it replaces "the" with "Zentory". With a 1% chance it displays:
ZENTORY By ViRuS
It contains the comment:
'Word97/Class.Zentory by Virus,Hi Vic.
Class.Q: It uses a temporary file called CLASS.SYS. On the 14th of any month over the fifth it displays:
VicodinES Loves You / Class.Poppy
I Think [UserName] is a big stupid jerk!
Class.R or Class.S: It uses a temporary file called SEED$.DLL. With a 1% chance it visits http://www.cannabisculture.com. With a 1 in 75 chance it visits http://www.Microsoft.com.
'Word97/Class.Seed by Virus :)
With a 2% chance it displays:
PRO ViRuS
With a 4% chance it displays:
CLASS SEED
Class.V: It uses a temporary file called GERBIL On October 13th it minimizes and maximizes Word 10 times then quits. On November 13th it visits http://www.Microsoft.com and some sites that appear to be porn sites. On December 13th it replaces "the" with "Pappy.Gerbil". With a 1 in 75 chance it displays:
PRO GERBIL
It contains the comment:
'WM97/Pappy.Gerbil by Virus :)
With a 1% chance it displays:
PRO ViRuS
With a 2% chance it displays:
PAPPY IS OLD
With a 4% chance it displays:
PAPPY GERBIL
With a 0.5% chance it displays:
PAPPY GERBIL By ViRuS
Class.W: It uses a temporary file called Joy With a 1% chance it visits http://www.ultra.com. With a 1 in 75 chance it visits http://www.joy.com. It contains the comment:
'WM97/Ultra.Joy by Virus :) Smile
With a 2% chance it displays:
ViRuS SAYS HI
With a 4% chance it displays:
CLASS ULTRA JOY
Class.BV: On October 16th it displays:
1nternal / Class.Insert
It contains the comment:
'1nternal

There are more Class viruses, from A-Z, AA-AZ, BA-BZ, CA-CZ, and DA-DS as of this writing. Most of them are just variations the viruses described above and are not believed to be in the wild. If any Class viruses not on this list are found in the wild, they will be added as soon as I get reports of them.

Information about macro viruses.

Virus Page