Sonicwall Signatures


Go to All Categories list.

This virus is also known as:
  • Formula.Excel.Classic
  • Sic
  • XF.Classic.Poppy
  • XF.Sic
  • XF/Sic.gen
  • XF97/Poppy

The is a macro virus written in Excel4 macro code. It contains 9 "defined names", two of which are Auto_Open and Auto_Close in order to propagate. This virus can infect both Excel95 and Excel97 format file types. This virus creates an Excel4 macro code sheet called XL4POPPY with "veryhidden" attributes.

When opening infected documents at 6:30am, infected user may notice the Excel title bar change to this text: XF.Classic.Poppy Also in the status bar, this text may be visible: VicodinES and Lord Natas Greet you a good morning!

Relevant Information