This is Excel97 macro virus. It hooks sheets activation event and infects
corresponding files. It also creates the infected file ALEVIRUSCS.XLM in
the Excel startup directory and disables the Macro Virus Protection by
running a short macro in a temporary MS Word application that is executed
by the virus in hidden window.
The virus uses procedure from the “Macro.Excel97.Papa”
virus to send own copies via e-mail, but in contrast to Papa virus it also infects
other workbooks. So, when just infected workbook will be opened next time,
this workbook (that may contain confidential information) will be sent to
addresses stored in Outlook address book.
The e-mail message has:
Fwd: Millions DEADS!!!
Urgent info inside. The III War is Begin!!! Read The Secret’s in XLS!
To the message the infected workbook is attached.
After infection the virus creates the directories:
c:Arquivos de programasMicrosoft OfficeOfficeXLINICIO
c:Programs FilesMicrosoft OfficeOfficeXLINICIO
Latest closed document the virus saves in the “C:WINDOWS” folder with
names WAR3.XLS, SEXO.XLS, FONE.XLS, AVP.XLS, CAIXA.XLS.
The virus also tries to replace default script of many popular IRC clients
by own one which sends infected workbook to everybody joined to IRC
On May 19th the virus shows office assistent balloon with message:
Primeiro Excel97>Email>MIRC> Virus Brasileiro by AlevirusSCS [Brasil]1999!
Em Breve Alevirus Excel97 Formula Virus!Mande-me Um EMAIL!
The virus blocks Visual Basic Editor hot-key displays message box:
Este programa executou uma instrucao ilegal por favor feche o Windows