Класс Virus
Платформа MSWord

Technical Details

Макро-вирусы семейства содержат одну процедуру «Document_Close» в модуле
«ThisDocument». Заражение системной области макросов происходит при закрытии
зараженного документа. Другие документы заражаются также при их закрытии.
При заражении вирус выключает встроенную защиту от вирусов MS Word (опцию
VirusProtection) и предупреждение о изменении файла NORMAL.DOT.

При инсталляции в систему вирус создает в корне диска C: файл ETHAN.___ и
записывает туда код всех процедур текущего модуля (включая невирусные, если
таковые присутствуют). Этот файл используется вирусом при заражении
документов вирус: он копирует в них свой код, сохраненный в этом файле.

Вирус удаляет файл C:CLASS.SYS, который содержит экспортированный код
вируса «Macro.Word97.Class».

В зависимости от системного счетчика случайных чисел вирус изменяет
служебные поля документов:

Title: Ethan Frome
Author: EW/LN/CB
Keywords: Ethan


В первый рабочий день каждого месяца 1999 года при открытии документов до
полудня вирус выдает на экран одно из сообщений:

1 апреля 1999 г.:

Y2K! Spread the word
This is not an April fools joke. I wish it were! The year 2000 is fast
approaching, and the word still needs to be spread about the
implications and dangers of the millennium bug commonly referred to as
the Y2K bug. The virus that has infected this word document was written
to help spread the word about the Y2K bug, and educate you so you can
prepare yourself and your family for Saturday January 1, 2000. today
until January 1, 2000, on the first business day of each month, I will
give you a lesson in Y2K preparation. Spread the word. Knowledge is

3 мая 1999 г.:

Hello again!
Lets start our first lesson to help prepare you for the millennium bug.
Although I don’t personally believe there will be food shortages, power
shortages, gas shortages as a result of a computer bug, there will be
food, power and gas shortages by hoarding nitwits that fear the
millennium bug. As a result, I highly recommend that you begin to
stockpile bottled water (1-month supply), canned food (1-month supply),
and as much gas as you can store (keep your vehicle gas tank always
topped up starting December 1st). That’s it for this month. See you
next month!

1 июня 1999 г.:

How’s the weather?
Right now it’s pretty warm out, so you are probably not thinking much
about the winter. But remember the millennium bug is expected to hit in
the middle of winter. If you’re in a northern climate, like the Great
White North (Canada), I suggest you consider purchasing a good airtight
wood stove, and at least a face cord of wood. Even if there are no
disruptions in natural gas, or oil, or electricity, the wood stove is a
great way of reducing your heating bills. And if there is a problem, you
will be comfortable in your own heated home, unlike your unprepared
neighbors (remember the Canadian ice storm last year!) That’s it for
this month. See you next month!

2 июля 1999 г.:

Did you get the stove?
Last month I recommend purchasing a gas stove to help heat your home in
the event that your supply of electricity, gas, or oil was interrupted.
This month I would like to suggest that you purchase a portable
generator and enough gas cans to store gas to power the generator. The
generator can be used to power lighting and small electrical appliances
should the power be disrupted. That’s it for this month. See you next

2 августа 1999 г.:

Getting back to basics
In this installment, I would like to suggest that you consider
purchasing candles, matches, flashlights, and batteries. These items
will be invaluable during those cold, dark nights should the power
companies fail in their Y2K conversion. Don’t plan on relying on the
banks or credit/debit cards. Start each month, and stash away enough
money to last you at least 2 months. This money should include enough
money to pay the rent/mortgage, utilities, FOOD, etc. Remember cold hard
cash is accept EVERYWHERE. That’s it for this month. See you next

1 сентября 1999 г.:

A Limerick
The millennium ‘s not far away Get onto your coding today Fix it or
fudge it The boss won’t begrudge it If everything works on the day!
That’s it for this month. See you next month!

1 октября 1999 г.:

Three months to go
Getting nervous? If you’ve followed my advice over the past months,
there should be nothing for you to worry about. We will survive the Y2K
bug, but preparation will insure that if there is any Y2K crisis, it
will only be small bump on the road, not a major pothole for you. That
‘s it for this month. See you next month!

1 ноября 1999 г.:

Two months to go
Personally, I don’t believe that there will be a major, global Y2K
crisis. I trust the banks with my money, I trust MOST of the industrial
sector, and I trust the power and water agencies to provide me with
power and water over the infamous weekend. I even trust the Russians and
there nuclear arms! BUT you can never be too careful. Take care. Be
prepared. Use common sense. That ‘s it for this month. See you next

1 декабря 1999 г.:

Good Luck (30 days to go)
Well, this will be the final installment in the Y2K preparation lessons.
If you have followed my advice over the past few months, you will be in
excellent shape to bring in the New Year. May the New Year bring you
health and happiness. Best wishes. Bye!

Узнай статистику распространения угроз в твоем регионе