Security Info

  • Security Center
    • Virus
  • Security Dictionary
  • Security Service
  • Free Download!!

Threats DB


Aliases  Classic
Typical Symptoms  File infection,Prints screen
Discovered  [korea] 0000-00-00
 [Foreign] 1999-07-28
Type  Virus ActiveField  Macro
Origin  others Encryption  NO
Location  Macro Memory residence  YES
Scan engine needed
2011-08-02.01 [Able to detect & repair]
  • Free trial download

This Macro virus is Excel formula virus. When user opens the file, it infects the file. The symptom is to display the message in screen at 6:30 AM/PM.

You can not find virus code by [Tools-Macro] function.


So unlike other Excel macro virus, this virus dose not user VBA language but use Formula used for Excel 4. Because it is compatible with low version, it also infects Excel 95, 97, and 2000.

This file includes below sentences.

Classic.Poppy by VicodinES

With Lord Natas

An Excel Formula Macro Virus (XF.Classic)

Hydrocodone/APAP 10-650 For Your Computer

(C) The Narkotic Network 1998

This virus start to work at 6:30 AM and PM. If the infected sheet is opened at 6:30 AM, below message is displayed in status bar.

VicodinES and Lord Natas greet you a good morning!

Moreover, it changes the title from Microsoft Excel to XF.Classic.Poppy.

And at 6:30 PM, show below two sentences.

XF.Classic.Poppy by VicodinES

(c) 1998 The Narkotic Network

Virus infects the normal files, then if the infected file is opened or closed, the error message could be displayed,

Removal Instructions


Update ViRobot Engine to the latest version and scan all drives.

Copyright 2008 @ HAURI Inc. All rights reserved. SiteMap