X97M/Divi is an Excel macro virus. VARIANT:Divi.A When an infected workbook is opened, this macro virus creates an infected workbook to the Excel's startup directory, "BASE5874.XLS". After that all closed or saved workbooks are infected. The virus also adds an variable to every infected workbook. The variable starts with a string "IVID" and ends with a hex number. Beside that, the virus does nothing but replicate. VARIANT:Divi.B X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
VARIANT:Divi.A When an infected workbook is opened, this macro virus creates an infected workbook to the Excel's startup directory, "BASE5874.XLS". After that all closed or saved workbooks are infected. The virus also adds an variable to every infected workbook. The variable starts with a string "IVID" and ends with a hex number. Beside that, the virus does nothing but replicate. VARIANT:Divi.B X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
When an infected workbook is opened, this macro virus creates an infected workbook to the Excel's startup directory, "BASE5874.XLS". After that all closed or saved workbooks are infected. The virus also adds an variable to every infected workbook. The variable starts with a string "IVID" and ends with a hex number. Beside that, the virus does nothing but replicate. VARIANT:Divi.B X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
After that all closed or saved workbooks are infected. The virus also adds an variable to every infected workbook. The variable starts with a string "IVID" and ends with a hex number. Beside that, the virus does nothing but replicate. VARIANT:Divi.B X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
The virus also adds an variable to every infected workbook. The variable starts with a string "IVID" and ends with a hex number. Beside that, the virus does nothing but replicate. VARIANT:Divi.B X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
Beside that, the virus does nothing but replicate. VARIANT:Divi.B X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
VARIANT:Divi.B X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
X97M/Divi.B is functionally identical with X97M/Divi.A. VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
VARIANT:Divi.C Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
Divi.C is functionally the same as Divi.A VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
VARIANT:Divi.D When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A. [Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]
