Virus.MSOffice.Hopper

Technical Details

These are multi-platform macro-viruses infecting Office97 components: Word

documents and Excel sheets. The viruses contain two auto-macros in Excel

sheets and Word documents: Document_Close and Workbook_Deactivate.

The viruses replicate themselves in Excel upon deactivating workbooks. In

Word, the viruses replicate upon document closing. The minor virus version

spreads only from Excel to Word and not back, and the major virus version migrates

from Word to Excel and back with no problems.

The viruses turn off the VirusProtection MS Office option. Depending on the

version, the viruses contain the the following text comments or display them in

MessageBox:

Ex-cell v0.1 /1nternal
Cross.BadSeed v0.1 /1nternal
Cross.BadSeed v0.2 /1nternal
Cross.BadSeed v0.3 /1nternal
Cross.BadSeed v0.4 /1nternal