| Cross | |
|---|---|
| Type | Macro virus |
| Creator | 1nternal |
| Date Discovered | 1999.06.06 |
| Place of Origin | Brisbane, Australia |
| Source Language | Visual Basic |
| Platform | MS Office |
| File Type(s) | .vbs, .doc, .html |
| Infection Length | |
Cross, also known as Hopper is a virus that can infect Word documents as well as .vbs and .html files. It was created by 1nternal, the creator of Triplicate.
Behavior
When the virus is run, it checks if the file is already infected. If not, it appends its code to the .vbs and .html files. If it is opened from a .doc file, it immediately infects the Normal.doc template. A .doc file becomes infected when it is closed. When infecting .vbs and .doc file, it simply comments out the html-specific parts of itself. It turns off the VirusProtection option for MS Office.
Variants
Some variants infect other types of office documents including Excel. Others may also infect .hta and .htt files. There are a few that lower Internet Explorer's security settings. Those that can infect Excel files often do not infect Excel files when executed from a Word file.
Origin
Cross was created by 1nternal, who was also responsible for the Triplicate virus, a virus that can infect across different types of MS Office documents. VicodenES, believed to be or have a connection to David Smith, creator of Melissa, also had a hand in some variants of this virus.
Sources
1nternal. actiVeX/COM Technology and Viruses.
Katrin Tocheva. F-Secure, F-Secure Virus Descriptions : Hopper.
Kaspersky Lab. SecureList.com, Virus.MSOffice.Hopper.