W97M/Ethan.a virus found

[Ebadaah]

I have found the following virus : W97M/Ethan.a in my old Windows 97 system. This virus triggers when I try to open any Word documents. I think this virus may have entered in my Word docs from some other machine on the network to my machine. Can anyone give me the info about this virus ? How do I eliminate it ? plz help.....

[Zachary]

W97M/Ethan.a is a Word97 Macro Virus. It is a fast moving infector and reported to numerous AVERT Labs around the globe. Infection takes place when an infected Word document is closed, allowing the virus to propagate itself to normal.dot template.

W97M/Ethan.A is a parasitic class module infector, which consists of one macro, and is approximately 50 lines of code in length. It infects documents and templates using an algorithm to input data, from a source file
c:\ethan.___ to the host document. This source file is exported VBA code of the virus.

Viruses using class module infection method transfer the virus code to the "ThisDocument" container. This virus prepends its code and infects all documents accessed.

There is are 3 out of 10 chances that this virus will modify the document properties of infected files:
Title = "Ethan Frome"
Author = "EW/LN/CB"

These properties will have to be changed back manually after the virus has been removed.

Ethan has one additional characteristic in that if it detects the "class.sys" file (created by the W97M/Class virus infection) on the machine it will delete it.

[Snake08]

To avoid the unnecessary risk of damaging your computer, it is highly recommended that you use a good malware remover to track W97M/Ethan and automatically remove W97M/Ethan as well as other spyware, adware, trojans, and virus threats in your PC.

For this - Download SpyHunter's Malware Scanner

[Snake08]

You can remove W97M/Ethan.a virus manually -

First - Use Windows File Search Tool to Find W97M/Ethan Path

1. Go to Start > Search > All Files or Folders.
2. In the "All or part of the the file name" section, type in "W97M/Ethan " file name(s).
3. To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
4. When Windows finishes your search, hover over the "In Folder" of "W97M/Ethan ", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete W97M/Ethan in the following manual removal steps.

• To remove W97M/Ethan , you must first stop any W97M/Ethan processes that are running in your computer's memory. To stop all W97M/Ethan processes, press CTRL+ALT+DELETE to open the Windows Task Manager. Click on the "Processes" tab, search for W97M/Ethan , then right-click it and select "End Process" key.
  
  
• To delete W97M/Ethan registry keys, open the Windows Registry Editor by clicking on the Windows "Start" button and selecting "Run." Type "regedit" into the box and click "OK." Once the Registry Editor is open, search for the registry key "HKEY_LOCAL_MACHINE\Software\W97M/Ethan ." Right-click this registry key and select "Delete."
  
  
• Finally, to completely get rid of W97M/Ethan , you must manually remove other W97M/Ethan files. These W97M/Ethan files can be in the form of EXE, DLL, LSP, TOOLBAR, BROWSER HIJACK, and/or BROWSER PLUGIN. For example, W97M/Ethan might create a file like %PROGRAM_FILES%\W97M/Ethan \W97M/Ethan .exe. Locate and remove these files.