Other Class viruses are becoming common

Coldape, Ethan, Footer, Marker, Pri, Story and Walker macro viruses

There are several viruses that infect the "ThisDocument" module in Word 97 using the method first used in the W97M/Class virus. Most of them were first discovered in December or January but there have been an increasing number of reports of them recently. Like W97M/Class, they are not visible in the macro Organizer. Most of them work on local language versions of Word. They all work on SR-1, which stops most other macro viruses. Some of these viruses use a temporary file to copy their code. Most of these viruses turn off Word's Virus Protection, turn off Prompt to Save NORMAL.DOT, and turn off Confirm Conversions. Some of these viruses also disable Tools/Macro and the VB Editor.

MVK 97 can remove these viruses and other Word 97 viruses automatically. Since they all use the same infection method as W97M/Class they will be detected and removed by MVK as "Class type viruses".

ColdApe

If you are infected with ColdApe, you should also download SVK to remove the scripts this virus drops.

ColdApe.A: It checks the registry key HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0\AVM-DC and HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0\AVM-VBS to see if it has dropped the payload. The payload consists of two files in VBScript. The one named happy.vbs is a virus that will look for other VBScript files and infect them. The one called a4.vbs is a trojan that will send an obscene message to the editor of Virus Bulletin, and your IP address to the virus author.
It contains the comments:
'AVM
' Nick "The Love Monkey" Virus Package by ALT-F4 and ALT-F11 for the Alternative Virus Mafia
ColdApe.B: It checks the registry key HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0\AVM-DC and HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0\AVM-VBS to see if it has dropped the payload. The payload consists of two files in VBScript. The one named happy.vbs is a virus that will look for other VBScript files and infect them. The one called a4.vbs is a trojan that will send an obscene message to the editor of Virus Bulletin, and your IP address to the virus author.
'AVM
' Nick "The Love Monkey" v2 Virus Package by ALT-F4 and ALT-F11 for the Alternative Virus Mafia
It adds the comment to itself in order to create a log file of all its victims:
'[UserName] loves Nicky F. also! [Time]

Ethan

Ethan.A: It uses a temporary file called ETHAN.___. With a 30% chance it changes the data in the File Summary Info; Title to "Ethan Frome", Author to "EW/LN/CB", and Keywords to "Ethan". It deletes the CLASS.SYS used by some variants of W97M/Class, but this doesn't affect its ability to replicate.

Footer

Footer.A: It uses temporary files called FOOTPRINT.$$$ and FOOTPRINT.$$1. It tries to overwrite the footers in the document with the full path of the infected file.

Marker aka Blue Planet

Marker.A: It uses a temporary file called NETLDV.VXD. It adds comments to itself in order to create a log file of all its victims and the time they were infected. It uses the text "<- this is a marker!" as an infection marker
Marker.B: It adds comments to itself in order to create a log file of all its victims and the time they were infected. It uses the text "<- this is a marker!" as an infection marker
Marker.D: It adds comments to itself in order to create a log file of all its victims and the time they were infected. It uses the text "<- this is another marker!" as an infection marker. It checks the registry key "HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\LogUploaded" to see whether is has performed the payload. It uses temporary files called NETLDX.VXD and HSFX[four random letters].SYS to upload the log file of its infection to the author's FTP site.
Marker.I: It is like Marker.D except it contains an empty subroutine with the text
```
Regularly scheduled meetings
```
Marker.L: It is like Marker.D except it contains an small subroutine from Tristate to disable virus protection.
Marker.O: On days after July 23rd this virus will: Change the caption which appears at the top of the Word window to "Happy Birthday Shankar-25th July. The World may Forget but not me" Display a message box saying "Did You Wish Shankar on his Birthday ?" with the options Yes or No. If the user chooses yes, it displays "Thank You! I Love You. You are wonderfull.", otherwise it displays " You are Heart Less." "You Will Be Punished For This" If a new document is created in that date range, it displays in large, green, sparkling animated letters "Happy BirthDay Shankar" In the document properties this virus changes author to "LSK", subject to "Birthday", title to "Are You surprised[sic] ?", keywords to "Birthday", category to "You Are Infected", and comments to "Shankar's Birthday falls on 25th July. Don't Forget to wish him".

Pri aka PSD

Pri.A: If the current date equals the current minute, it will fill the current document with random shapes. This virus is polymorphic and renames its variables. It contains the comments:
'W97M/PSD ...porn star dreams? [(c)1998 ALT-F11 code hack]
'VAMP v1.0 [thanks Vic!]

Story aka IRCJack

Story.A: This virus looks for c:\mirc\mirc32.exe, and if so, drops a mIRC script. It contains the comment:
'Jack-In-The-Box

Walker

Walker.B or C: This virus is polymorphic: it is written so it can rearrange its code. It contains the comments:
WrittenBy = "Lord_Arz [SOS] {F#S}"
VirusName = "V_Man"
Walker.D: It is partially encrypted. It changes the registry key "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner" to "ThE wEiRd GeNiUs". It contains the comment:
'Sattelite v1.5

Information about macro viruses.

Virus Page