Virus.X97M.LAROUX.F

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

该恶意软件不具(jù)有(yǒu)任何后门例程。

该恶意软件不具(jù)有(yǒu)任何信息窃取功能(néng)。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

安(ān)装(zhuāng)

它使用(yòng)不同的文(wén)件名(míng)在下列文(wén)件夹中(zhōng)植入自身的副本：

• {Excel Application Path}\XLSTART\mypersonnel.xls → if the malware file is not executed in this location.

后门例程

该恶意软件不具(jù)有(yǒu)任何后门例程。

信息窃取

该恶意软件不具(jù)有(yǒu)任何信息窃取功能(néng)。

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It disables the Escape key to prevent users from cancelling the script's execution.
• It checks for the following conditions:
  • If the file is in ".xlsx" format.
  • If the version of the file is Microsoft Office Excel 2007 or newer.
• If one of the conditions is met, it will create a copy of itself with the following filename and version and deletes the original file afterwards:
  • {Malware Path}\{Malware Name}.xls → file version set to Microsoft Excel 97-2003
• It remains active every time Excel is launched, infecting any new workbooks created and previously saved workbooks when they are opened.
• If the first sheet is not named "Kangatang", it copies a sheet named "Kangatang" containing the malicious script to the beginning of the active workbook to ensure infection and propagation.