X97M_LAROUX.EQ

Once this malicious Microsoft Excel file is opened, it copies its code to a specific Excel file. It also copies its code to newly created Excel documents.

This malware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes certain actions WITHIN the affected computer.

Arrival Details

This malware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This malware drops the following files:

• %User Profile%\Application Data\Microsoft\Excel\XLSTART\BOOK1.xls

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

This malware executes the following:

• Once this malicious Microsoft Excel file is opened, it copies its code to the BOOK1.xls file. It also copies its code to newly created Excel documents.