This is a stealth macro-virus. It contains three modules and 11 functions:
“Sparkle” – FileSave, Toolsmacro, Filetemplates, Sparkle,
Toolsmacro, Filetemplates, ViewVbCode,
“userform999” – ListBox2_Click, UserForm_Initialize, CommandButton2_Click,
“userform900” – CommandButton1_Click, CommandButton2_Click,
CommandButton5_Click, CommandButton6_Click, ListBox2_Click,
On saving files (FileSave), the virus disables the VirusProtection, infects
the global macros area and documents.
The virus draws its own dialogue on entering the Tools/Macro menu (stealth).
On pressing any button (except “Cancel”), the virus displays the MessageBox:
This program has performed an illegal operation and will shut down.