Virus.MSExcel.Sic

Detect Date 05/20/2004
Class Virus
Platform MSExcel
Description

This is one of the few macro viruses which does not use macros to penetrate Excel tables, which is the usual method. Instead it uses formalas.

It is impossible to detect this virus using a normal method (by viewing macros), because the virus ascribes the attritube VeryHidden to its module; this characteristic cannot be detected from an Excel menu.

The virus infects MS Excel tables when they are opened and closed.

The virus itself is one macro with two functions, Auto_Close and Auto_Open.

It contains several variables:

_Fill 



Bust 



Continue 



Document_array 



Documents_array 



Hello 



MakeIt 



Morning 



TaxTV 



TaxXL 



Test5

When it infects tables, it creates a hidden page called XL4Test5 where it saves its code.

It also creates an infected file called Book1 in the autorun catalogue.