macro.excel97.sugar.
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Macro.Excel97.Sugar.a
These are stealth Excel97 macro-viruses. They hook windows/sheets activation and deactivations events and infect corresponding files. While infecting, the viruses save their code as "class" macros (see also "Macro.Word97.Class").
Sugar.a
It creates the infected BOOK1 file in the Excel start-up directory. It disables the Macro Virus Protection by direct access to the system registry.
Depending on the current minute, day and month, the virus inserts into the current sheet up to 200 cells with a text inside "-(Dr. Diet Mountain Dew)-", changes their size and color, and then inserts the message "The -[Sugar.Poppy]- by VicodinES" to the very first cell of the sheet.
The virus also contains the following comments:
'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
'The Sugar.Poppy Excel Class Object Virus'
' written by VicodinES '
'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
' Can I have a bottle of '
' WARM DIET MOUNTAIN DEW '
'=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
Sugar.b
This virus is very similar to the previous version. It also disables the Macro Virus Protection in the system registry, but does it with the help of MS Word: the virus transfers, to Word's global macros area, the AutoExec macro that by VisualBasic instructions disables VirusWarning when Word is executed.
This virus contains the following comments:
'-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
'Sugar.Poppy.II Excel Class Object Virus'
' written by VicodinES '
'-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
' Can I have a bottle of '
' WARM DIET MOUNTAIN DEW '
'-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
' Now it infects '
' ANY AND ALL CLASS OBJECTS '
'-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
' Module Parasitic Code Added '
'-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-'
Copyright @2006 macro.excel97.sugar.