Neg (also known as Virus.MSExcel.Neg) (also breifly Lord) is a macro virus on Win32. It is a Microsoft Excel document with a macro attached.
It appears as 3 files. NegB, NegE, and NegC. When NegB is opened, it appears as a blank document. However, when the macro is inspected, it has six macros, along with three files. The macro creates a hidden worksheet that will infect new worksheets that are created. It also turns off screen updating so that the user cannot see what is happening, and then opens the hidden worksheet, and turns back on screen updating. If the user opens the document again, and then closes it, it will display a message that says:
Get the best Excel Scanner!!!! -NVT98-
When the user clicks "ok" The document then closes. When NegE is opened, it appears to be a file with top text that says: "Sophos Goat File" followed by random numbers. When the macro is inspected, it appears to be nine macros. The code itself appears to hide every hidden file, so the user cannot easily find the files. When the date is the 13th, and the user attempts to close the file, a message will pop up saying:
Microsoft Visual Basic Ambigous name detected: Auto_Close
Pressing "Ok" Will display another message:
This XM.N-E-G generated with NEG , the world first Excel Generator!
When NegC is opened, it appears as a blank document like NegB. This time, inspecting it will show fifteen macros. This macro appears to trigger Autoexec.bat on the first day of the month, and then it will edit it to make it format the C:\ Drive. Restarting the computer now will cause the computer to be unable to load, due to the format.