Threat Description

Divi

Details

Aliases: Divi, Tracker
Category: Malware
Type: Virus
Platform: X97M

Summary


X97M/Divi is an Excel macro virus.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.



Technical Details



Variant:Divi.A

When an infected workbook is opened, this macro virus creates an infected workbook to the Excel's startup directory, "BASE5874.XLS".

After that all closed or saved workbooks are infected.

The virus also adds an variable to every infected workbook. The variable starts with a string "IVID" and ends with a hex number.

Beside that, the virus does nothing but replicate.


Variant:Divi.B

X97M/Divi.B is functionally identical with X97M/Divi.A.


Variant:Divi.C

Divi.C is functionally the same as Divi.A


Variant:Divi.D

When an infected workbook is opened, X97M/Divi.D creates an infected workbook to the Excel's startup directory, "874.XLS". Otherwise this variant is functionally identical with X97M/Divi.A.



Technical Details:Katrin Tocheva and Sami Rautiainen, F-Secure

SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More