Virus

XF97/Wisab.A

Analysis

  • Virus hooks Excel event handler of opening or closing infected documents in order to run its code
  • Virus was coded using Excel4 macros and contains the following macro routines, identified in infected workbooks via the menu Insert/Names/Define -

    Auto_Close
    Auto_Open
    Bust
    Continue
    Documents_array
    Hello
    MakeIt
    Morning
    TaxTV
    TaxXL
    Test5

  • Each macro routine references a cell where its code is inserted as hidden content, and is not visible under normal circumstances or by using the Visual Basic Editor environment