It is a fast moving infector and reported to numerous Labs around the globe. Infection takes place when an infected Word document is closed, allowing the virus to propagate itself to normal.dot template.

It is a parasitic class module infector, which consists of one macro, and is approximately 50 lines of code in length. It infects documents and templates using an algorithm to input data, from a source file c:\ethan.___ to the host document then changes the attribute of this file to system/hidden.

Viruses using class module infection method transfer the virus code to the "ThisDocument" container. This virus prepends its code and infects all documents accessed.

There is a 3-in-10 chance that this virus will modify the document properties of infected files:

Title = "Ethan Frome"
Author = "EW/LN/CB"

Ethan has one additional characteristic in that if it detects the "class.sys" file (created by the W97M/Class virus infection) on the machine it will delete it.