Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Divi


Aliases:


Divi
Tracker

Malware
Virus
X97M

Summary

X97M/Divi is an Excel macro virus.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details


Variant:Divi.A

When an infected workbook is opened, this macro virus creates an infected workbook to the Excel's startup directory, "BASE5874.XLS".

After that all closed or saved workbooks are infected.

The virus also adds an variable to every infected workbook. The variable starts with a string "IVID" and ends with a hex number.

Beside that, the virus does nothing but replicate.


Variant:Divi.B

X97M/Divi.B is functionally identical with X97M/Divi.A.


Variant:Divi.C

Divi.C is functionally the same as Divi.A


Variant:Divi.D

When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A.





Technical Details: Katrin Tocheva and Sami Rautiainen, F-Secure



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free