GO TO: Summary | Removal


Category: Malware

Type: Virus

Platform: W97M

Aliases: Blee, Poppy.II


This is a simple Word 97 macro virus. The most common variant, WM/Blee.D was posted to the alt.cracks newsgroup on 25th of December, 1997.

This variant attempts to display this text on Saturdays:

VicodinES is probably high on painkillers right now"

It will also attempt to put this data in the Summary Info of the current document:

Author: = VicodinES

 Title: =
Another W97M/Blee.Poppy Infected Document

Macro Virus Infection by The Narkotic Network

 Comments: Hello from VicodinES and The Narkotic Network ...
 we mean you no harm"

The virus contains these comments which are not displayed.

 this is version II(ES) (with no blee payload)
 By VicodinES
 Macro Virus for Word 97
 "Sloppy Code For A Sloppy Red Mess"

Virus also has code to attempt to delete all Word template files if the global template has been write-protected. Otherwise it does nothing but spreads.

WM/Blee.D has been reported to be in the wild globally.


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.