high
Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for disinfecting macro viruses.
More Information
XM97/Laroux-BK contains two macros, AUTO_OPEN and VRS.
The AUTO_OPEN macro is run when the infected document is opened, and instructs Excel to call the VRS macro every time a new worksheet is activated.
When this happens, the virus creates a file in the XLSTART directory called DIMON.XLS and copies the viral macros into it. This file is automatically opened every time Excel is run, much like Word's NORMAL.DOT. From then on it infects every workbook used.
When DIMON.XLS is infected, the virus will be loaded every time Excel is started.
|
