This virus infects Excel sheets. It contains six macros: Auto_open,
Auto_close, ChangeCell, CreatePers, CheckV101, HideModV101 and several
functions in one module “ModulV101”.
To infect the system the virus creates the infected PERSONAL.XLS file in
the ALTSTART directory and declares it as the Alternate Startup directory.
To create this file the virus looks for Windows directory and creates it
If there is no such directories, the virus creates alternate directory on
the C: drive: C:ALTSTART.
To infect other sheets the virus hooks sheets activation procedure. The
virus handler also has stealth ability: it does not allow to examine a
module with the virus, switching current page to first non-virus found.
The virus also hooks formulas calculation procedure and with probability
30% erases the source formula and replaces it with calculated result (i.e.
this cell will be not recalculated).