LAROUX VIRUS

Information about the Laroux virus:

This virus infects the workbook (XLS) files of Excel 5 and Excel for Windows 95. The virus code is contained in two macros named "auto_open" and "check_files".

When the first infected workbook is opened by Excel the virus gets control and it checks whether the PERSONAL.XLS file is infected. If it is not infected then the virus copies its macros to PERSONAL.XLS file and there by infecting it. Then onwards the virus will be infecting all the new workbooks files created in that computer.

Laroux virus first appeared in August 1996 and it is in the wild.

Variants of Laroux virus:

Laroux has several variants. The size of the macro code varies in these variants from the first virus.


Other names of Laroux :
This worm is also known as XM/Laroux, Excel.Laroux and PLDT.

TRIPLICATE VIRUS

Information about the triplicate virus:

This virus infects Word 97 documents NORMAL.DOT file of Word 97 and Word 2000. Through Word97 it infects Excel spread sheets and PowerPoint files.

When the infected file is opened under Word 97 it disables Macro virus protection of the MSWord, after this it will infect NORMAL.DOT which is a global template there by it transfers virus code in to that. Virus removes all the macros from the global template and inserts a procedure DisableAV(). This procedure carries code which disables Macro virus protection of Excel and Power Point in the registry.

Virus will invoke MS Excel and creates a file called BOOK1.XLS under Excel startup directory.

If the file BOOK1.XLS is already present then it would not infect Excel. In the last virus will launch Power Point and searches for a module called Triplicate, if this module does not exists then it will insert a shape in the first slide Blank Presentation which is under template directory.


The infected file carries the following text which is visible in all the infected documents:

Triplicate v0.1 /1nternal

Triplicate virus first appeared in May 1999 and it is in the wild.

Variants of triplicate virus :

Triplicate B:

This variant almost same as Triplicate. There is some minor bug fix in the virus code and the text in the infected document has been changed to:

"Triplilcate.b": Triplicate v0.11 /1nternal

Triplicate C:

This variant almost same as Triplicate. There is some minor modifications in the virus code and the text in the infected document has been changed to:

"Triplilcate.c": Triplicate v0.2 /1nternal

Triplicate D:

This variant almost same as Triplicate. There is some minor modifications in the virus code and the text in the infected document has been changed to:

"Triplilcate.d": Triplicate v0.21 /1nternal


Other names of triplicate virus :
This worm is also known as W97M/Tristate.

PAPA WORM

Information about the Papa worm:

This is a worm that uses Excel 97 Workbook as a base to spread on its own. This worm works on both Excel 97 and Excel 2000.

This worm is similar to Melissa virus in its capability to spread. It has the ability to spread itself very fast using email. When the Workbook infected by Papa worm is opened for the first time, it checks whether the user's computer is installed with MS Outlook. If it finds Outlook then the worm sends email to 60 addresses found in the address book of outlook. The email sent by the worm will contain the subject "Fwd: Workbook from all.net and Fred Cohen". The body of the email will contain "Urgent info inside. Disregard macro warning." The worm will attach the infected workbook in the name of PASS.XLS to the message. The worm can spread very fast because of this method.

Papa will not infect PERSONAL.XLS or other workbook. It will only spread via email. It does not have any destructive code.

Papa worm first appeared in March 1999 and it is not in the wild.


Other names of Papa worm:
This worm is also known as X97M/Papa, Excel.Papa, Password, Papa.B.

CYBERNET.A VIRUS

Information about the CyberNet.A:

This is a macro virus with worm characteristics infecting Word 97, Excel 97 and Office 2000 documents. This virus comes as an email attachment with a subject “You’ve GOT Mail !!!” and the content of the mail would be :

“Please, saved the document after you read and don’t show to anyone else. The document is also VIRUS FREE… so DISREGARD the virus protection warning !!!”

The macro virus infects the NORMAL.DOT of MS-Word and creates a file CYBERNET.XLS under XLSTART folder. It mails an infected file as an attachment to the first 50 addresses found in the address book automatically.

It overwrites the AUTOEXEC.BAT with FORMAT C: /AUTOTEST /Q /U, with the text below

##########################################

# Vine...Vide...Vice...Moslem Power Never End... #

# I'm Really Sorry, This System Have Been Recycled By -= CyberNET =- Virus!!! #

# Brought To You From INDONESIA... #

##########################################

and CONFIG.SYS with the instructions AUTOEXEC.BAT: SWITCHES=/N.

It also has the payload of inserting random shapes and figures into the documents which are already opened. It is set to trigger on August 17 and December 25.

The CyberNET.A macro virus first appeared in May 2000


Other names of CyberNet.A:
This macro virus is also known as CyberNet, XL97/CyberNet.A