Macro.Excel97.Phantom
Description Macro.Excel97.Phantom
This is a stealth Excel97 macro-virus. It infects Excel97 spreadsheets (XLS-files). The virus contains two modules: ArtiLife and Replicator. The ArtiLife module contains the auto-function "auto_open". When an infected sheet is opened, the "auto_open" function takes control, infects Excel and sets the DeliverPayload function on execution at 16:00:00. While infecting Excel, the virus creates the infected ~XL.XLA in the Excel Start-up Path directory.
The virus is quite an unusual for macro-viruses: it has a parasitic-virus-like stealth mechanism - the virus removes its modules from sheets upon opening them and infects them again upon closing.
The DeliverPayload that is executed at 16:00 outputs the texts to the StatusBar:
The Phantom
Is watching you!
Beware!
Check other viruses! Be aware! Use Antiviral Software
Macro.Word97.Temple
Description Macro.Word97.Temple
This virus does not manifest itself in any way. It contains four modules:
Documents NORMAL.DOT
AutoOpen TempAutoOpen
TempAutoExec AutoExec
TempFileSave FileSave
TempFileOpen FileOpen
The virus infects the global macros area (NORMAL.DOT) on opening an infected document and writes itself to documents that are opened or saved.
Macro.Word97.Thao
Description Macro.Word97.Thao
It is quite simple macro virus. It contains two macros: FileOpen and AutoClose. On successful infection it displays the MessageBox:
Microsoft Word:
I loce you, Thao.
|