Virus.X97M.LAROUX.F

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

该恶意软件不具有任何后门例程。

该恶意软件不具有任何信息窃取功能。

新病毒详细信息

它以文件的形式出现在系统中，可能是其他恶意软件投放的，或者是用户在访问恶意网站时无意中下载的。

安装

它使用不同的文件名在下列文件夹中植入自身的副本：

• {Excel Application Path}\XLSTART\mypersonnel.xls → if the malware file is not executed in this location.

后门例程

该恶意软件不具有任何后门例程。

信息窃取

该恶意软件不具有任何信息窃取功能。

其他详细信息

该程序执行以下操作：

• It disables the Escape key to prevent users from cancelling the script's execution.
• It checks for the following conditions:
  • If the file is in ".xlsx" format.
  • If the version of the file is Microsoft Office Excel 2007 or newer.
• If one of the conditions is met, it will create a copy of itself with the following filename and version and deletes the original file afterwards:
  • {Malware Path}\{Malware Name}.xls → file version set to Microsoft Excel 97-2003
• It remains active every time Excel is launched, infecting any new workbooks created and previously saved workbooks when they are opened.
• If the first sheet is not named "Kangatang", it copies a sheet named "Kangatang" containing the malicious script to the beginning of the active workbook to ensure infection and propagation.