W97M/Ethan.AW

Analysis

• Virus consists of one macro module within the class storage
  
• Virus hooks Word event handler which prevents the closing of infected documents
  
• Virus checks for the file "c:\class.sys" which is associated with W97M/Class, and deletes this file