Threat behavior
Virus:XF/Sic.E is an Excel formula virus that infects Excel worksheets. It infects documents as they are opened. It does not contain a destructive payload.
Spreads Via…
File Infection
When an infected worksheet is opened, Virus:XF/Sic.E creates the following workbook:
This workbook is loaded every time Excel is started, and is used to infect Excel files as they are opened (by adding a new worksheet named "XL4Poppy").
Payload
Displays Messages
Virus:XF/Sic.E may display the following messages:
Virus:XF/Sic.E also adds the message "VicodinES and Lord Natas greet you a good morning!" to the taskbar of infected documents.
Additional Information
The following formatted string is also found in the virus' code:
The virus attempts to execute a number of macros at particular times - for example:
If the time is 6:30 PM, Virus:XF/Sic.E attempts to run a macro with the name "Hello".
If the time is 6:30 AM Virus:XF/Sic.E, attempts to run a macro with the name "Morning"
Users should note, however, that Virus:XF/Sic.E does not contain macros with these names and hence nothing occurs at these times.
Prevention
