Virus.X97M.LAROUX.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Andere Details

Es macht Folgendes:

• It will remain active every time Excel is launched, infecting any new workbooks created and previously saved workbooks when they are opened.
• It checks for a file named "PERSONAL.XLS" in the Excel startup path and if the currently active workbook contains any VBA modules.
  • If PERSONAL.XLS exists and the currently active workbook does not contain any VBA modules:
    • It copies a sheet named "laroux" from "PERSONAL.XLS" and paste it as the first sheet in the currently active Excel workbook.
    • It sets the copied sheet to hidden.
    • It assigns a macro from "PERSONAL.XLS" in the currently active Excel workbook for persistence
  • If PERSONAL.XLS doesn't exist and the currently active workbook contains any VBA modules:
    • It unhides a sheet named "laroux" in the currently active workbook
    • It copies the "laroux" sheet into a new workbook.
    • It sets the copied sheet to hidden.
    • It sets the following file attributes to null:
      • Title
      • Author
      • Subject
      • Keywords
      • Comments
    • It saves the new workbook as:
      • %Application Data%\Microsoft\Excel\XLSTART\PERSONAL.XLS
    • It assigns a macro from "PERSONAL.XLS" in the currently active Excel workbook for persistence

(Hinweis: %Application Data% ist der Ordner 'Anwendungsdaten' für den aktuellen Benutzer, normalerweise C:\Windows\Profile\{Benutzername}\Anwendungsdaten unter Windows 98 und ME, C:\WINNT\Profile\{Benutzername}\Anwendungsdaten unter Windows NT, C:\Dokumente und Einstellungen\{Benutzername}\Lokale Einstellungen\Anwendungsdaten unter Windows 2000(32-bit), XP und Server 2003(32-bit) und C:\Users\{Benutzername}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) und 10(64-bit).)