Virus.MSExcel.Tjoro

Class Virus
Platform MSExcel
Description

Technical Details


This Excel macro virus contains one macro (module) named “NoMercy”, the
macro contains six functions: Auto_Open, cek_global, infectglobal,
inFuckIt, Fuck, Auto_Close.


To infect the system the virus creates the infected GLOBAL.XLM file in
Excel startup directory and sets macros Fuck as auto-macro that is called
when any sheet is activated. As a result the virus hooks sheets activating,
and infects them. While infecting the virus searches for “NoMercy” module
to prevent duplicate infection. If there are no such module, the virus
copies its code to there.


On 11th of any month the virus displays the MessageBox:


Hello…
Hello there…you are infected with NoMercy!