Cross
Cross
Type Macro virus
Creator 1nternal
Date Discovered 1999.06.06
Place of Origin Brisbane, Australia
Source Language Visual Basic
Platform MS Office
File Type(s) .vbs, .doc, .html
Infection Length

Cross, also known as Hopper is a virus that can infect Word documents as well as .vbs and .html files. It was created by 1nternal, the creator of Triplicate.

Behavior

When the virus is run, it checks if the file is already infected. If not, it appends its code to the .vbs and .html files. If it is opened from a .doc file, it immediately infects the Normal.doc template. A .doc file becomes infected when it is closed. When infecting .vbs and .doc file, it simply comments out the html-specific parts of itself. It turns off the VirusProtection option for MS Office.

Variants

Some variants infect other types of office documents including Excel. Others may also infect .hta and .htt files. There are a few that lower Internet Explorer's security settings. Those that can infect Excel files often do not infect Excel files when executed from a Word file.

Origin

Cross was created by 1nternal, who was also responsible for the Triplicate virus, a virus that can infect across different types of MS Office documents. VicodenES, believed to be or have a connection to David Smith, creator of Melissa, also had a hand in some variants of this virus.

Sources

1nternal. actiVeX/COM Technology and Viruses.

Katrin Tocheva. F-Secure, F-Secure Virus Descriptions : Hopper.

Kaspersky Lab. SecureList.com, Virus.MSOffice.Hopper.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License