macro.excel.disaste
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Macro.Excel.Disaster
This virus infects Excel sheets (XLS files). It contains five macros in one module "Disaster": Auto_Open, Infect, Unvisible, Butterfly, Auto_Close.
While loading an infected document Excel executes auto macros auto_open, and the virus takes control. The virus auto_open macro contains just one command, which defines the Unvisible macro as a handler of OnSheetActivate routine. As a result the virus hooks the sheet activate routine, and while opening a sheet the virus (the Unvisible macro) takes control.
When the Unvisible macro takes control, it executes the Infect macro which infects all active Workbooks. While closing an infected document Excel executes the Auto_Close macro. This macro erases all sheets except having the "Sheet" at the beginning of the name. This macro then saves infected sheet to the Excel Startup directory with the BOOK1.XLS name.
On Monday that falls on 1-5th day or month, or on Friday starting from 25th of month the virus on closing files executes the Butterfly macro that creates new sheet named "A" and deletes all other.
Copyright @2006 macro.excel.disaste