Threat Description



Aliases:Blee, Blee, Poppy.II


This is a simple Word 97 macro virus. The most common variant, WM/Blee.D was posted to the alt.cracks newsgroup on 25th of December, 1997.

This variant attempts to display this text on Saturdays:

VicodinES is probably high on painkillers right now"

It will also attempt to put this data in the Summary Info of the current document:

  Author: = VicodinES
 Title: =  Another W97M/Blee.Poppy Infected Document
 Subject:  Macro Virus Infection by The Narkotic Network
 Comments: Hello from VicodinES and The Narkotic Network ...
  we mean you no harm"

The virus contains these comments which are not displayed.

  this is version II(ES) (with no blee payload)
  By VicodinES
  Macro Virus for Word 97
  "Sloppy Code For A Sloppy Red Mess"

Virus also has code to attempt to delete all Word template files if the global template has been write-protected. Otherwise it does nothing but spreads.

WM/Blee.D has been reported to be in the wild globally.


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.


You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.

Description Created: Mikko Hypponen, F-Secure


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More