ViRobot/HAURI

XF.Sic
種類
Virus
危険度/拡散度
/
発見日
[korea] 0000-00-00 [Foreign] 1999-07-28
Virobot対応
2011-08-02.01 [Able to detect & repair]


This Macro virus is Excel formula virus. When user opens the file, it infects the file. The symptom is to display the message in screen at 6:30 AM/PM.


You can not find virus code by [Tools-Macro] function.

 

So unlike other Excel macro virus, this virus dose not user VBA language but use Formula used for Excel 4. Because it is compatible with low version, it also infects Excel 95, 97, and 2000.

This file includes below sentences.


Classic.Poppy by VicodinES

With Lord Natas

An Excel Formula Macro Virus (XF.Classic)

Hydrocodone/APAP 10-650 For Your Computer

(C) The Narkotic Network 1998


This virus start to work at 6:30 AM and PM. If the infected sheet is opened at 6:30 AM, below message is displayed in status bar.


VicodinES and Lord Natas greet you a good morning!

Moreover, it changes the title from Microsoft Excel to XF.Classic.Poppy.

And at 6:30 PM, show below two sentences.


XF.Classic.Poppy by VicodinES



(c) 1998 The Narkotic Network



Virus infects the normal files, then if the infected file is opened or closed, the error message could be displayed,

 

Update ViRobot Engine to the latest version and scan all drives.