This is a stealth Excel97 macro-virus. It infects Excel97 spreadsheets
(XLS-files). The virus contains two modules: ArtiLife and Replicator. The
ArtiLife module contains the auto-function “auto_open”. When an infected
sheet is opened, the “auto_open” function takes control, infects Excel
and sets the DeliverPayload function on execution at 16:00:00. While
infecting Excel, the virus creates the infected ~XL.XLA in the Excel
Start-up Path directory.
The virus is quite an unusual for macro-viruses: it has a parasitic-virus-like stealth
mechanism – the virus removes its modules from sheets upon opening them and
infects them again upon closing.
The DeliverPayload that is executed at 16:00 outputs the texts to the
Is watching you!