Virus

X97M/Barisada.AG

Analysis

  • Virus hooks Excel event handler of deselecting a worksheet in order to run its code
  • Virus exists in the class code module, normally named "ThisWorkbook"
  • Virus verifies if it has infected the Excel environment by searching for the file "book.xls" in the XLStart folder - if the file does not exist, a new workbook is created and infected, and then saved as "book.xls" in the XLStart folder
  • Virus tests if the date is April 24 and the time is 2pm - if these conditions are met, the virus will display a message box asking a yes or no question -
    1st Qusetion
    Question : What is the Sword Which Karl Styner(=Gray Scavenger) used?
    Answer : Barisada
    [Yes] [No]
  • If the user selects "No", then the virus exits the cell deletion code
  • If the user selects "Yes" then the virus will display one additional question with a yes or no choice, where a selection of "No" will cause the cell deletion code to execute -
    Wrong Answer may cause The Serious Problem!
    Summoning Xavier is the Ultimate Magic. Right?
    [Yes] [No]

Recommended Action

Check the main screen using the web interface for your FortiGate unit to ensure that the latest AV/NIDS database has been downloaded and installed on your system - if required, enable the "Allow Push Update" option