| Description:
|
Details
Macro.Excel.Delta.a
This is an Excel macro virus. It contains one module Delta that contains 28 macros: API, Auto_Close, Auto_Open, bt_1, bt_2, Chk1, Chk2, Dstr, Ghst, Hdn, Hlt, Icn_1, Icn_3, ins, Ky, mcr, mcr1, mcr2, min, Prt, tgu, Trl, Thc1, Tim, Thc2, txt, xl4, Waw.
On opening an infected file the Auto_Open macro is executed. This macro to install the virus on computer runs macros: Tim, Icn_1, Icn_3, Chk1, Chk2, Dstr, mcr, xl4, Hdn.
Tim - sets macro Hlt on timer (is executed every 20 minutes)
Icn_1 - sets macro bt_1 on entering the File/New menu
Icn_3 - sets macro bt_2 on entering the File/Close menu
Chk1 - creates the infected file C:MSOFFICEEXCELXLSTARTEXCELVBA.XLA
Chk2 - copies the current file to EXCELVBA.XLA
Dstr - on January 5 it erases C:WINDOWSSYSTEM*.*, A:*.*, B:*.* and
displays the InputBox:
Delta Viruses
This Is The Example Of My Viruses ! You Can Modified, Added in
Order to be a Good Hacker ! Please Type My Virus Name to Continued
or I'll Destroy Your Computer ! < By Bui'95 >
If virus name is entered not correct, the virus displays the MessageBox
and shutdowns Word:
Sorry ..!, My Virus Name is Delta
mcr - erases the menu that contains the "Macro" substring
xl4 - sets new user name: "Delta Viruses (c)1995 Ver 1.20"
The virus also creates the C:MSOFFICEEXCELLIBRARYEXCELVBS.TXT file, writes its code to there and uses it on infecting. |
