|
|
Macro.Excel.Do Viruses Information
| Name: |
Macro.Excel.Do |
| Category: |
Viruses |
| Description:
|
Details
Macro.Excel.Don
This is an Excel macro virus. It contains one module DON that contains one function AutoOpen. The infection routine present in the virus code consists of 49 encrypted text strings. In case of need (on infection) the virus decrypts them, saves to the DON.TXT file, then copies this file to the macros area with name "Replicate" and executes it. After executing (i.e. after infecting a file or system) the virus deletes the "Replicate" module.
If an infected file is opened from Excel startup directory (i.e. the system is already infected) it sets its AutoOpen function on sheets deactivating (OnSheetDeactivate function) and infects the Workbooks on changing active sheet. Otherwise the virus creates an infected file with name .DON in Excel startup directory, i.e. infects the system.
The virus can be easily detected by the presence of a file in the XLSTART directory. The virus also creates the DON2.TXT file and writes to there the name of active Workbook. |
Top Viruses Visited Pages:
Invader. - 231 visits
not-a-virus:RiskWare.Tool.RegPatch. - 69 visits
Worm.P2P.Harex. - 63 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 55 visits
Small.58. - 55 visits
Coito.64 - 53 visits
I-Worm.Mapson. - 45 visits
Win16.Klon.1177 - 41 visits
Win32.Hidra - 41 visits
Marine.500 - 34 visits
Random Viruses Pages:
Trojan.VBS.Carewm
Moctezuma Famil
Win32.Ev
TPVO.Glacier.118
Turnip.29
Kicsit.59
Worm.Win32.Padobot.
Urke
Worm.P2P.Mandragor
CCC.38
|
|
