This is a Microsoft Excel macro virus. Sofa spreads to Excel spreadsheets once it has copied its virus code to the default startup directory. It does this by creating a file called \MSOFFICE\EXCEL\STARTUP\BOOK.XLT
Sofa contains these macros: Auto_Open, Auto_Range, Current_Open, and Auto_Close.
Sofa activates by checking the title bar text of Excel to read
Otherwise, the virus just spreads.
Sofa was found in the wild in USA in December 1996.
Disinfection & Removal
Description Created: Mikko Hypponen, F-Secure