Threat Description



Aliases: Blee, Blee, Poppy.II
Category: Malware
Type: Virus
Platform: W97M


This is a simple Word 97 macro virus. The most common variant, WM/Blee.D was posted to the alt.cracks newsgroup on 25th of December, 1997.

This variant attempts to display this text on Saturdays:

VicodinES is probably high on painkillers right now"

It will also attempt to put this data in the Summary Info of the current document:

  Author: = VicodinES
    Title: =  Another W97M/Blee.Poppy Infected Document
    Subject:  Macro Virus Infection by The Narkotic Network
    Comments: Hello from VicodinES and The Narkotic Network ...
  we mean you no harm"

The virus contains these comments which are not displayed.

        this is version II(ES) (with no blee payload)
        By VicodinES
        Macro Virus for Word 97
        "Sloppy Code For A Sloppy Red Mess"

Virus also has code to attempt to delete all Word template files if the global template has been write-protected. Otherwise it does nothing but spreads.

WM/Blee.D has been reported to be in the wild globally.


Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Description Created: Mikko Hypponen, F-Secure


Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More