Detect Date 01/11/2002
Class Virus
Platform MSOffice

This is a multi-platform macro-virus infecting Office97 components: Word documents and Excel workbooks and sheets. The virus contains two auto-macros in Excel sheets and Word documents: Document_Close in Word documents, and Workbook_Deactivate in case of Excel workbook or Worksheet_Deactivate in case of Excel sheet.

The virus replicates itself in Excel upon deactivating workbooks. In Word, the virus replicates upon document closing. Upon spreading, the virus infects not only “native” objects, but also exports its code to another Office component if it is installed in the system.

The virus turns off the VirusProtection MS Office option.

Each month from June to December on the 14th ,the virus displays the message:

V guvax <UserName> vf n ovt fghcvq wrex!
Find out the statistics of the threats spreading in your region