Virus.X97M.SLACKER.L

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de puerta trasera.

Este malware no tiene ninguna capacidad para robar información.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Robo de información

Este malware no tiene ninguna capacidad para robar información.

Otros detalles

Hace lo siguiente:

• If the user opens an uninfected workbook or switches to another workbook (whose ThisWorkbook code doesn't start with 'OOO):
  • It injects the full malicious VBA code into the target workbook’s ThisWorkbook module.
  • The infection propagates to every uninfected workbook the user opens next.
• It drops the following malicious file in Excel’s Startup folder to maintain persistence:
  • Filename: %Application Data%\Microsoft\Excel\XLSTART\book1
  • Contents: A workbook containing the malicious macro code
  • Trigger: Dropped when the user switches away from an infected workbook
  • Effect: Auto-opens silently whenever Excel launches, enabling further spread
• It creates the following hidden backup of each infected workbook:
  • C:\TMP\{Original Filename}.xlsm
• On opening, if the infected workbook contains a "Controls" sheet:
  • It activates that sheet and scrolls to the "DashboardScenario" named range (if it exists).
  • If not, it defaults to the first visible worksheet.

(Nota: %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).