Summary
Summary
More Information
| Included in our products from | April 2000 (3.32) |
|---|---|
| Detected by | All Sophos products |
More Information
- Summary
- More Information
XM97/Laroux-DZ is a variant of the XM97/Laroux Excel macro virus.
It contains two macros, AUTO_OPEN and CK_FILES.
The AUTO_OPEN macro is run when the infected document is opened, and merely instructs Excel to call the CK_FILES macro every time a new worksheet is activated.
When this happens, the virus creates a file in the XLSTART directory called RESULTS.XLS and copies the viral macros into it. This file is automatically opened every time Excel is run, much like Word's NORMAL.DOT. From then on it infects every workbook used.
When RESULTS.XLS is infected, the virus will be loaded every time Excel is started.
|
