Virus Database

Macro.Excel97.Xlscan

Description Macro.Excel97.Xlscan

It is a stealth Excel97 macro virus. It infects workbooks on their closing. While infecting the virus saves its code in sheets as "class" macros (see also "Macro.Word97.Class"). It also creates the infected MsOffice8.xls file in the Excel startup directory and disables the Macro Virus Protection by direct access to system registry.
Each time an infected document is being closed, the virus creates in the "C:WindowsSystem" folder several files with names generated using current date and time and extension ".INF"

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel97.SW.a

Description Macro.Excel97.SW.a

This Excel macro virus is related to "Macro.Excel.Laroux". It intercepts a sheet's activation routine, and infects Excel worksheets. It contains three macros in the module "sw": Auto_Open, no, Auto_Close.
The virus deletes all menu items, shortcut menus and hot key used to view macros or related to this. Depending on the current time, the virus changes all values in the cells from B4 till G40 - it multiplies all these values by ten. On Saturdays and Sundays, the virus cleans the current sheet, and displays the following in the MessageBox:
Ha! Ha! Ha! Idiot ! ! !
Today is rest day!
Why do you work so hard?
All work and no play make you a dull boy!
Come on! Let's go out and have some fun!

Macro.Excel97.Tracker-based

Description Macro.Excel97.Tracker-based

This is a harmless macro-virus. It infects MS Excel 97/2000 workbooks upon their closing or saving with a new name. The virus disables the MS Excel97 macro-virus protection using direct registry access. In the Excel start-up folder, the virus creates the infected file "Base5874.xls".
Upon infecting every new computer, the virus saves, in document volume, the ID of the drive where Excel is installed. It stores drive IDs as documents custom properties. On tab File->Properties->Custom in the properties list are shown all IDs that the virus stores from moment it was created. All IDs begin with "IVID".
The virus has no payload routines.

Home