[Debut] 'k4 'macro virus excludes the original New Excel macro virus exclusive Tool

Recently, a large number of Excel files in the company have discovered an office macro virus. They cannot be killed when using Kingsoft 360. Downloading Kingsoft version's macro virus excludes only part of the virus, another type of macro virus cannot be killed in any way.

Attack symptoms

Office macro virus exclusive tool download: http://download.csdn.net/detail/tao2581/4524743

Search materials: This macro virus is called the K4 macro virus. Many anti-virus software cannot find it. It may not be a major problem to kill software. You can further use the macro command to hide the table and see the following code:

In the Excel document of office macro virus Ctrl + F11 new module, enter the following code: press Ctrl + F8 to display the hidden table to see the hidden macro virus

 

Sub shows the hidden table () dim I as integer dim cname as name'. All hidden tables are displayed as for I = 1 to sheets. count sheets (I ). visible = true next 'find the hidden name for each cname in workbooks ("book1.xls "). names msgbox cname. name next cnameend sub

The macro content is shown as follows:

 

This workbook cannot be deleted separately. The prompt is displayed.# Ref not found! $ A $2The poisoned workbook uses a hidden name: auto_avtivate;

 

Based on the above principle, VB6 is used to create a simple exclusive killing tool. Only the K4 macro virus is very effective.

 

Office macro virus exclusive tool download: http://download.csdn.net/detail/tao2581/4524743