[korea] 0000-00-00 [Foreign] 1999-07-28
2011-08-02.01 [Able to detect & repair]

This Macro virus is Excel formula virus. When user opens the file, it infects the file. The symptom is to display the message in screen at 6:30 AM/PM.

You can not find virus code by [Tools-Macro] function.


So unlike other Excel macro virus, this virus dose not user VBA language but use Formula used for Excel 4. Because it is compatible with low version, it also infects Excel 95, 97, and 2000.

This file includes below sentences.

Classic.Poppy by VicodinES

With Lord Natas

An Excel Formula Macro Virus (XF.Classic)

Hydrocodone/APAP 10-650 For Your Computer

(C) The Narkotic Network 1998

This virus start to work at 6:30 AM and PM. If the infected sheet is opened at 6:30 AM, below message is displayed in status bar.

VicodinES and Lord Natas greet you a good morning!

Moreover, it changes the title from Microsoft Excel to XF.Classic.Poppy.

And at 6:30 PM, show below two sentences.

XF.Classic.Poppy by VicodinES

(c) 1998 The Narkotic Network

Virus infects the normal files, then if the infected file is opened or closed, the error message could be displayed,


Update ViRobot Engine to the latest version and scan all drives.