This is an Excel macro virus. It contains one module (macro) named Legend
containing two routines – Auto_Open and Infect. While opening an infected
document Excel runs this Auto_Open routine. That routine then sets routine
Infect as a SheetActivate handler, i.e. on activation of any sheet Excel
will call the Infect routine.
When executed Infect routine infects either PERSONAL.XLS file, or current
book (file), depending on the situation – if already infected file is
opened, the virus infects PERSONAL.XLS. When not infected file is opened,
the virus infects it.
After infecting the virus deletes the Tools/Macro menu item. If UserName is
“Pyro” and OrganizationName is “VBB”, the virus does not perform any
action. Depending on the system date and system random counter the virus
displays the message box:
You’ve Been Infected By Legend!