Virus Alert Info this page last updated 12-06-98

The XF/SIC.A virus uses Excel4.0-Formula language to infect workbooks created under Microsoft Excel5.0/95 and Excel97. On an infected system it drops a file "Book1" (extension is missing) into the \XLSTART folder, which, like all infected files, contains a hidden sheet "XL4Poppy". Then it will try to infect other workbooks on the open, close and Sheet-activate event.

Symptoms of an infection:
- existing file "Book1" in the \XLSTART subdirectory
- visible sheet name "XL4Poppy" listed when viewing Properties|Contents of a file from Windows Explorer or Excel
- 2 message boxes, displaying the name of the virus creator, might appear around 6:30PM during an Excel session
- the application title changes from "Microsoft Excel" to "XF/Classic.Poppy" (around 6:30AM) during a session

Solution:
McAfee VirusScan 4.0.1 using 4001 DAT files can detect and clean the virus; VirusScan 3.1.9 or higher using the 3112 DAT files can detect the virus; cleaning requires 3201 DAT (see beta area).

Known issue:
After cleaning Excel97 files infected by the XF/SIC.A virus you might encounter an Excel - confirmation box like: "Cannot find XXXX, which has been assigned to run each time... Cancel opening...?" YES|NO

You are safe to click on > NO <. To avoid that confirmation box in the future goto the INSERT|NAMES|DEFINE menu in your Excel application and DELETE the two name entries "Auto_Open" and "Auto_Close".

Removal Information
Recommend scanning all files since the infector file in the XLSTART folder does not have an extension and will be skipped!