Virus.MSExcel.PTH

Technical Details

This virus infects Excel worksheets. It contains nine macros in one module

PTH: Auto_Open, lay_proc, Message, set_action, Set_time, Warning, Nghich,

p_exit, message1.

On opening an infected table Excel executes auto-macro auto_open which

installs the virus into the system: copies the virus code to the file

PERSONAL.XLS in the Excel Startup directory. The virus then checks all

opened workbook and infect them.

On file closing on 13th of any month after 5:00pm the virus replaces with

the "PTH" text the content of all files with extension "TXT" in directory

of active document.