Virus.MSExcel.Soldier

Technical Details

This is a polymorphic macro virus. It contains four actual function:
Auto_Open, Auto_Close, Delay, Poly, as well as random number of junk
functions with random names.

On closing an infected file the virus searches and infects files in the
current directory. While infecting the virus depending on system random
counter inserts into the top of its code functions with random name and
random contents (polymorphic).

On opening an infected file the virus erases menu items Format/Sheet/Hide
and Format/Sheet/Unhide… (stealth).

Depending on random counter the virus displays to the Excel caption the
running line:

Microsoft Excel