VirusX97M/Laroux.HO
Analysis
- Virus hooks Excel event handler which prevents
the opening of infected files in order to run its
code
- Virus exists in a code module named "MARS"
- Virus verifies if it has infected the Excel environment
by searching for the file "PERSONAL.XLS"
in the XLStart folder - if the file does not exist,
a new workbook is created, infected and then saved
as "PERSONAL.XLS" in the XLStart folder
- Virus contains this comment line at the end of
its code -
' Bengkalis, 10 Januari 1997
Telemetry
Detection Availability
| FortiClient | |
|---|---|
| Extreme | |
| FortiMail | |
| Extreme | |
| FortiSandbox | |
| Extreme | |
| FortiWeb | |
| Extreme | |
| Web Application Firewall | |
| Extreme | |
| FortiIsolator | |
| Extreme | |
| FortiDeceptor | |
| Extreme | |
| FortiEDR |