This virus infects Excel worksheets. It contains nine macros in one module
PTH: Auto_Open, lay_proc, Message, set_action, Set_time, Warning, Nghich,
On opening an infected table Excel executes auto-macro auto_open which
installs the virus into the system: copies the virus code to the file
PERSONAL.XLS in the Excel Startup directory. The virus then checks all
opened workbook and infect them.
On file closing on 13th of any month after 5:00pm the virus replaces with
the "PTH" text the content of all files with extension "TXT" in directory
of active document.