| Description:
|
Details
Macro.Excel.Legend
This is an Excel macro virus. It contains one module (macro) named Legend containing two routines - Auto_Open and Infect. While opening an infected document Excel runs this Auto_Open routine. That routine then sets routine Infect as a SheetActivate handler, i.e. on activation of any sheet Excel will call the Infect routine.
When executed Infect routine infects either PERSONAL.XLS file, or current book (file), depending on the situation - if already infected file is opened, the virus infects PERSONAL.XLS. When not infected file is opened, the virus infects it.
After infecting the virus deletes the Tools/Macro menu item. If UserName is "Pyro" and OrganizationName is "VBB", the virus does not perform any action. Depending on the system date and system random counter the virus displays the message box:
Pyro [VBB]
You've Been Infected By Legend! |
