W97M/ColdApe.B is a polymorphic macro virus operating in the Microsoft Word 97 environments. It attacks documents when they are closed and the global template normal.dot. It is derived from the virus W97M/ColdApe.A.

From the point of viewpoint of function this virus is almost identical with the W97M/ColdApe.A. The difference is only in the fact that polymorphic algorithm was added. That will ensure that to the end of the macro containing the virus always a line with the code commentary is added. In the commentary the name of the Word user, the text " Loves Nicky F. Also! " and the current date including time are located. These lines look as follows:

'Hugh G. Rection Loves Nicky F. Also! 11/14/98 10:56:30 AM

At the end of the file happy.vbs, as well as of the body of the virus W97M/ColdApe.B itself, there is the following text:

' Nick "The Love Monkey" v2 Virus Package by ALT-F4 and ALT-F11 for the Alternative Virus Mafia

In the script a4.vbs the address of the virus author is altered to avm@redneck.efga.org.