|
|
||
|
|
||
|
||
XM/Compat.AXM/Compat XM/Compat is a polymorhic Excel95 (version 5 and 7) virus. Known to be in the field. It does not spread on systems where Office97 is installed, however Excel97 will convert the virus into a slightly different form. This upconverted form does not replicate but the payload may still work. The virus drops a file called "Off97com.xla" into the ....\Excel\Library directory within the Office installation and registers it as an add-in for Excel. On a Macintosh the name of the file is "Office 97 Compatibility". The virus also creates a harmless file in the ...\Excel folder named "VBA_XL.TXT". This file contains just a text of the VBA program virus is using. The XM/Compat viruses have extremely nasty payload. Starting on 31 August 98 when Excel is being closed the virus selects a random sheet in a workbook (avoiding the active sheet). Then it checks to see if the cells in use are not protected, that they contain numeric values (no text, no formula) and then the virus goes through all cells in the used range (but not more then 1000 cells) changing each of them with 1% probability. The change of the number is random, but always within +-5% without changing the number of digits (length of original value is preserved). The only way to restore the contents of spreadsheet after payload has been activated is to use a backup Detection for this virus has been added to the VirusScan Hourly DAT file at http://beta.nai.COM/public/datafiles/ If you are a Dr Solomon user you can find the extra driver for this virus at http://beta.mcafee.com/public/stand_alone/NAI_DRSOL.HTM |
||
|
|
||