Threat Descriptions

Ethan

Classification

Category :

Malware

Type :

Virus

Platform :

W97M

Aliases :

Ethana

Summary

W97M/Ethan is a Word macro virus that replicates under Word 97. It was found in the wild in Northern Europe in January 1999.

Ethan is a simple macro virus, consisting of a single macro less than 50 lines long. It infects Word's NORMAL.DOT template and documents by prepending it's code to a module in the document.

Removal

Based on the settings of your F-Secure security program, it will either automatically delete, quarantine or rename the detected program or file, or ask you for a desired action.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

To spread, the virus generates a file with the name "c:\ethan.___". This file alone is harmless and can be deleted after the disinfection. The file is listed as a hidden system file.

W97M/Ethan activates by random. Whenever a document is opened, there is a 3-in-10 chance that the virus will change the document's properties. If this happens, the virus changes the title of the document to "Ethan Frome", Author to "EW/LN/CB" and company to "Foo Bar Industries Inc.".

"Ethan Frome" is a book written by Edith Wharton in 1911. It was also released as a movie in 1993, with Liam Neeson playing Ethan Frome.

In addition, W97M/Ethan checks if the machine is already infected with the W97M/Class virus and if so, it delete the class.sys file that W97M/Class uses to replicate.

Variant:Ethan.B

W97M/Ethan.B is functionally identical with W97M/Ethan.A.

Variant:Ethan.D (y2k)

W97M/Ethan.D is a modified variant of W97M/Ethan.A.

The name of the temporary file that virus creates is changed. It is "c:\sys00.bak".

The payload is also different. Instead of changing the summary information, this variant displays message boxes on specified days during 1999. Every of these messages is displayed only after 12:00.

At April 1st, the message is as follows:

  This is not an April fools joke. I wish it were! The year 2000 is
    fast approaching, and the word still needs to be spread about the
    implications and dangers of the millennium bug commonly referred
    to as the Y2K bug. The virus that has infected this word document
    was written to help spread the word about the Y2K bug, and educate
    you so you can prepare yourself and your family for Saturday
    January 1, 2000.
    That 's it for this month. See you next month!

At May 3rd, the message text is:

  Lets start our first lesson to help prepare you for the millennium
    bug. Although I don't personally believe there will be food
    shortages, power shortages, gas shortages as a result of a
    computer bug, there will be food, power and gas shortages by
    hoarding nitwits that fear the millennium bug. As a result, I
    highly recommend that you begin to stockpile bottled water
    (1-month supply), canned food (1-month supply), and as much gas as
    you can store (keep your vehicle gas tank always topped up
    starting December 1st).
    That 's it for this month. See you next month!

At June 1st, the message is:

  Right now it's pretty warm out, so you are probably not thinking
    much about the winter. But remember the millennium bug is expected
    to hit in the middle of winter. If you're in a northern climate,
    like the Great White North (Canada), I suggest you consider
    purchasing a good airtight wood stove, and at least a face cord of
    wood. Even if there are no disruptions in natural gas, or oil, or
    electricity, the wood stove is a great way of reducing your
    heating bills. And if there is a problem, you will be comfortable
    in your own heated home, unlike your unprepared neighbors
    (remember the Canadian ice storm last year!)
    That 's it for this month. See you next month!

At the message of July 2nd is:

  Last month I recommend purchasing a gas stove to help heat your
    home in the event that your supply of electricity, gas, or oil was
    interrupted. This month I would like to suggest that you purchase
    a portable generator and enough gas cans to store gas to power the
    generator. The generator can be used to power lighting and small
    electrical appliances should the power be disrupted.
    That 's it for this month. See you next month!

At August 2nd the message is:

  In this installment, I would like to suggest that you consider
    purchasing candles, matches, flashlights, and batteries. These
    items will be invaluable during those cold, dark nights should the
    power companies fail in their Y2K conversion. Don't plan on
    relying on the banks or credit/debit cards. Start each month, and
    stash away enough money to last you at least 2 months. This money
    should include enough money to pay the rent/mortgage, utilities,
    FOOD, etc. Remember cold hard cash is accept EVERYWHERE.
    That 's it for this month. See you next month!

At September 1st the message is:

  The millennium 's not far away
    Get onto your coding today
    Fix it or fudge it
    The boss won't begrudge it
    If everything works on the day!
    That 's it for this month. See you next month!

At October 1st the message is:

  Getting nervous? If you've followed my advice over the past
    months, there should be nothing for you to worry about. We will
    survive the Y2K bug, but preparation will insure that if there is
    any Y2K crisis, it will only be small bump on the road, not a
    major pothole for you.
    That 's it for this month. See you next month!

At November 1st, the message is:

  Personally, I don't believe that there will be a major, global Y2K
    crisis. I trust the banks with my money, I trust MOST of the
    industrial sector, and I trust the power and water agencies to
    provide me with power and water over the "infamous" weekend. I
    even trust the Russians and there nuclear arms! BUT you can never
    be too careful. Take care. Be prepared. Use common sense.
    That 's it for this month. See you next month!

And finally, December 1st the message is:

  Well, this will be the final installment in the Y2K preparation
    lessons. If you have followed my advice over the past few months,
    you will be in excellent shape to bring in the New Year. May the
    New Year bring you health and happiness. Best wishes.
    Bye!

This variant does not remove "c:\class.sys" file used by W97M/Class virus.

Variant:Ethan.Q

W97M/Ethan.Q is functionally identical with W97M/Ethan.A. The only difference is the file name that virus uses to replicate has been changed to "mwencek.____".

Variant:Ethan.AD

This variant uses temporary file "c:\grover.___", and when a new document is created the virus inserts the following text into the new document: 

  !MOSH to Super Grover!

Variant:Ethan.AE

This variant is similar with W97M/Ethan.AD, but it the text it inserts has been changed to: 

  Super Grover

Variant:Ethan.AK

W97M/Ethan.AK is similar to W97M/Ethan.A. The file that this variant uses is named as "envolve.tmp".

Variant:Ethan.AT (Page, Class.BT)

This variant is almost the same as Ethan.A, except that the name of the file that it uses is not "ethan.___", but "pagefile.dat".

Ethan.AT does not contain any payload.

Variant:Ethan.BI

W97M/Ethan.BI is a modified variant of W97M/Ethan.A. This variant uses a different file, "c:\vedani.___".

Also the payload has been modified. This variant changes the document summary to: 

  Title:      Vedani Nicola - biscotica
    Author:     EW/LN/CB
    Keywords:   Ethan

Variant:Ethan.DS

Ethan.DS variant saves its code in a file c:\winsys.log.

One of the virus payload will change the document Summary Information with: 

Title:  BasTarD-2811
        Author: $$$$$$

The other payload activates if the year is 2001 or more. Then with a chance 1/10 the virus will modify the contents of Autoexec.bat. Next time when an infected machine is restarted it will show a picture drown using # character and will format the C:\ drive.