Fandom

Virus Information

Class

249pages on
this wiki
Add New Page
Talk0 Share
Class
Type Macro virus
Creator VicodinES
Date Discovered 1998.07
Place of Origin USA
Source Language Visual Basic
Platform MS Word
File type(s) .doc
Infection length
Reported costs

Class also known as Poppy is a macro virus by VicodinES. It is one of the first macro viruses to work successfully under Word 97. This virus is also polymorphic.

BehaviorEdit

When a file infected with Class is opened, it creates the file class.sys in the root of the C: drive. This file contains the code it will insert into the the Normal.dot template. Class does not add a new module, but instead adds code to the ThisDocument VBA5 module in Normal.dot, which is in all word documents by default. The macros in Normal.dot will be "AutoClose" and "ToolsMacro", while those in the infected files will be "AutoOpen" and "ViewVBCode".

Class changes its code by inserting comments that include the current user name, date and time and information about the active printer. It also has some stealth techniques, disabling the "Tools\Macro" and "Tools\Macro\VisualBasic Editor" menus by incorporating two empty macros.


On the 31st of every month, it displays a message:

   This Is Class
   o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o
   o      VicodinES     /CB    /TNN      o
   o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o-o

VariantsEdit

There are numerous variants of Class, most of them with some variation on the message.

Class.B and DEdit

This variant displays a message on the 14th of any month between June and December:

  I Think (Name of the current user) is a big stupid jerk!
  VicodinES Loves You / Class.Poppy

Class.D is similar, but changes the registered company name to "Dr. Diet Mountain Dew".

Class.BVEdit

This variant has no payload and does not create a temporary file to replicate.

Class.CNEdit

This variant, also known as Mad Cow is capable of sending itself in email. It arrives in an email with a subject of "Mad Cow Joke". The message body is "Beware of the spread of the Madcow Disease". It uses the file V.SYS. This variant was originally distributed in a file named MADCOW.DOC, but began spreading under other file names as it was executed from the many other files it had infected. It contains the comment in its code "'WORD/VERONICA // thanks to WORD/MELLISA & WORD/CLASS".

Class.EBEdit

Class.EB is non-polymorphic. It uses the file normal.dot. Its payload activates on the 11th of any month. It displays a text box with the text "Internal Error! Restart Word."

Name and OriginEdit

Class was coded by the American virus coder VicodinES. VicodinES is suspected of being David L. Smith or Kwyjibo, the creator of Melissa. He gave all his viruses a name with .Poppy (Class's full name would be Class.Poppy). VicodinES was a recreational user of prescription drugs and believed the best drugs originated in the poppy plant.

SourcesEdit

Katrin Tocheva, Sami Rautiainen. F-Secure, Class.

Cicatrix. VX Heavens, Interview with VicodinES. 1997.08

Symantec, W97M.Class.A.Gen. 1998.08.08

Virus Fighter, W97M/Class.

Proland Software, Class virus.

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.