This virus infects Excel sheets (XLS files). It contains five macros in one
module “Disaster”: Auto_Open, Infect, Unvisible, Butterfly, Auto_Close.
While loading an infected document Excel executes auto macros auto_open,
and the virus takes control. The virus auto_open macro contains just one
command, which defines the Unvisible macro as a handler of OnSheetActivate
routine. As a result the virus hooks the sheet activate routine, and while
opening a sheet the virus (the Unvisible macro) takes control.
When the Unvisible macro takes control, it executes the Infect macro which
infects all active Workbooks. While closing an infected document Excel
executes the Auto_Close macro. This macro erases all sheets except having
the “Sheet” at the beginning of the name. This macro then saves infected
sheet to the Excel Startup directory with the BOOK1.XLS name.
On Monday that falls on 1-5th day or month, or on Friday starting from 25th
of month the virus on closing files executes the Butterfly macro that
creates new sheet named “A” and deletes all other.