Threat description




This Word macro virus (also known as "MS Word 97 Macro Class Virus") infects Word 97 documents.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

W97M/Class changes it's own code constantly by inserting comments that contain the current user name, date and time and information about the active printer.

The virus uses an effective way to hide its code. The virus installs its module to Word classes by using special WordBasic operators. The virus code is appended as a native Word component. As a result the virus is not visible in the Tools/Macro menu.

The virus creates a file "c:\class.sys" to replicate. This file can be safely deleted after the system has been disinfected.

W97M/Class activates on the 31st of every month. On this date it displays this message:

 This Is Class









This is almost identical to Class.D except the displayed message is slightly different and the name of the registered user is not changed.


W97M/Class.D activates on the 14th of the month from June to December. At this time it displays a message:

 I Think (Name of the current user) is a big stupid jerk!

 VicodinES Loves You / Class.Poppy

Sometimes the virus also changes the registered company name to "Dr. Diet Mountain Dew".


This variant is functionally identical with Class.B.


W97M/Class.BV is a variant that does not contain any payload. Furthermore, it does not create a temporary file to replicate.

Variant:Class.CN (Mad Cow)

This variant of Class is also known as Mad Cow. It is related to the famous Melissa virus as well.

Class.CN spreads in Word documents and transfers itself via e-mail, using Microsoft Outlook. It sends e-mail to the first 20 aliases listed in Outlook Address Book.

The messages look like this:

 From: (name of infected user)

 Subject: Mad Cow Joke

 To: (20 names from alias list)

Beware of the spread of the Madcow Disease

Attachment: (random document infected with Syndicate)

Do notice that Class.CN can arrive in any document, not necessarily just in MADCOW.DOC in which it was initially distributed.

Another noticeable and a major difference that makes it different from Melissa and Syndicate: Class.CN re-sends the messages only when an infected document is opened or closed in an infected system.

W97M/Class.CN is a polymorphic virus which means that it changes it's own code every time it replicates. It uses a file called C:\V.SYS while spreading.

The virus contains these comments that are never shown to the user:



W97M/Class.EB is a non-polymorphic variant of W97M/Class. The file name that it uses to replicate has been changed to "c:\".

This virus activates its payload on the 11th day of each month when it displays a message box with the following text:

 Internal Error!
Restart Word.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info