GO TO: Summary | Removal

Classification

Category: Malware

Type: Virus

Platform: W97M

Aliases: Blee, Poppy.II

Summary


This is a simple Word 97 macro virus. The most common variant, WM/Blee.D was posted to the alt.cracks newsgroup on 25th of December, 1997.

This variant attempts to display this text on Saturdays:

VicodinES is probably high on painkillers right now"

It will also attempt to put this data in the Summary Info of the current document:

Author: = VicodinES

 Title: =
Another W97M/Blee.Poppy Infected Document

 Subject:
Macro Virus Infection by The Narkotic Network

 Comments: Hello from VicodinES and The Narkotic Network ...
 we mean you no harm"

The virus contains these comments which are not displayed.

W97M/Blee.Poppy.II
 this is version II(ES) (with no blee payload)
 By VicodinES
 Macro Virus for Word 97
 "Sloppy Code For A Sloppy Red Mess"

Virus also has code to attempt to delete all Word template files if the global template has been write-protected. Otherwise it does nothing but spreads.

WM/Blee.D has been reported to be in the wild globally.

Removal


Automatic action

Based on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.