When a sheet is activated from an infected workbook, X97M/Diablo.A if
a workbook "PERSONAL.XLS" is exists in the Excel's startup directory.
If the workbook does not exist, the virus creates a new workbook and
infects it. After that it infects all workbooks that are opened.
The virus activates its payload in the random dates, when it changes
the size of toolbar buttons to large.
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]