02.08.2013 Views

Macro Virus Table - Defense Technical Information Center

Macro Virus Table - Defense Technical Information Center

Macro Virus Table - Defense Technical Information Center

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

<strong>Macro</strong> <strong>Virus</strong>es<br />

MACRO<br />

Protection: Set the attributes of your personal.xls file to read only. If you don’t have a personal.xls<br />

file, create a blank one and set its attributes to read only.<br />

Name: XM.Laroux.B<br />

Aliases: XM.Laroux.B, Laroux.B Type: <strong>Macro</strong>.<br />

Disk Location: Excel <strong>Macro</strong> files.<br />

Document file. Personal.xls<br />

Global macro file.<br />

Features: No damage, only replicates.<br />

Damage: No damage, only Size: Adds macros to Excel See Also:<br />

replicates.<br />

files.<br />

Notes: The LAROUX.B virus is an Excel macro language virus that infects Excel 5 and later<br />

documents and infects the Personal.xls file. If Personal.xls does not exist, the virus creates it.<br />

When personal has been infected, all new Excel workbooks (documents) are infected.<br />

Does not spread on the Macintosh because of the way it searches for personal.xls but causes an<br />

error "Path not found"<br />

<strong>Macro</strong>s installed:<br />

auto_open<br />

check_files<br />

Hidden worksheet:<br />

laroux<br />

Removal: delete the two macros auto_open and check_files.<br />

Protection: Set the attributes of your personal.xls file to read only. If you don’t have a personal.xls<br />

file, create a blank one and set its attributes to read only.<br />

Name: XM.Sofa<br />

Aliases: XM.Sofa, Sofa Type: <strong>Macro</strong>.<br />

Disk Location: Excel macro files. Features: No damage, only replicates.<br />

Damage: No damage, only Size: Adds macros to Excel See Also:<br />

replicates.<br />

macro documents.<br />

Notes: This is an Excel macro virus.<br />

Does not spread on the Macintosh but causes the error "Runtime error 1005, Unable to set<br />

caption property of the application class".<br />

<strong>Macro</strong>s installed:<br />

auto_open<br />

May 21, 1998 CIAC Computer <strong>Virus</strong> <strong>Information</strong> Update 57

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!