Teocotl (Strange Days) Question

[Chris Baker]

Does anyone know what exactly O97M.teocotl (Strange Days virus) does to
Excel files? Any way to fix them?

I was able to recover a couple of lost files with File Scavenger, but they
unopenable in Excel. I can open them in Word Pad and it looks like the data
is all there. The virus probably just changed a couple of crucial
characters.

Anyone?, anyone?

TIA

 

[David H. Lipman]

O97M indicates it is a Office 97 Macro virus. However, I can find no information on
"teocotl".

What AV software package indicated this infector.

--
Dave




| Does anyone know what exactly O97M.teocotl (Strange Days virus) does to
| Excel files? Any way to fix them?
|
| I was able to recover a couple of lost files with File Scavenger, but they
| unopenable in Excel. I can open them in Word Pad and it looks like the data
| is all there. The virus probably just changed a couple of crucial
| characters.
|
| Anyone?, anyone?
|
| TIA

 

[Chris Baker]

O97M indicates it is a Office 97 Macro virus. However, I can find no
information on "teocotl".

What AV software package indicated this infector.

Alright, you got me. I've got NAV up to date and running nightly, yet I
lost a number of Excel files in the early morning of Jan. 26th. The only
virus I was able to find by my searching that affects Word and Excel
files on the 26th of each month is Strange Days or O97M.teocotl (NAV's
name for it).
I never did get a notification of infection and this apparently this
virus works in very tricky ways to avoid detection.

There's a pretty good description of it at:
http://www.viruslibrary.com/virusinfo/Macro.Office.Teocatl.htm

Chris

 

[David H. Lipman]

Well that explains why I didn't find it -- You posted as TEOCOTL when it is TEOCATL !

McAfee calls this the Shiver Macro Virus -
O97M/Shiver -- http://vil.nai.com/vil/content/v_10164.htm

Maybe the McAfee description can help.

Accordingly, its is ~5 years old and NAV or *any* AV software should have caught this.

--
Dave




| |
| > O97M indicates it is a Office 97 Macro virus. However, I can find no
| > information on "teocotl".
| >
| > What AV software package indicated this infector.
| >
|
| Alright, you got me. I've got NAV up to date and running nightly, yet I
| lost a number of Excel files in the early morning of Jan. 26th. The only
| virus I was able to find by my searching that affects Word and Excel
| files on the 26th of each month is Strange Days or O97M.teocotl (NAV's
| name for it).
| I never did get a notification of infection and this apparently this
| virus works in very tricky ways to avoid detection.
|
| There's a pretty good description of it at:
| http://www.viruslibrary.com/virusinfo/Macro.Office.Teocatl.htm
|
| Chris