Virus.MSExcel.Kmaster

Class Virus
Platform MSExcel
Description

Technical Details


This is French specific Word macro virus related to
“Macro.Excel.Laroux”. It infects Excel worksheets (XLS-files). It
contains two macros in module KMaster: Auto_ouvrir, check_files.


The Auto_ouvrir macro is auto-macros (auto_open) and it is executed on
opening an infected file. The virus takes control and installs itself into
Excel. To do that the virus created the infected file PERSONAL.XLM in the
Excel StartupPath directory. To intercept sheets to infect them the virus
sets its “check_file” macro (infection routine) to be executed on any sheet
activation.


To detect already infected files the virus looks for KMaster module in
there, then for the Feuil1 page, then for the text “Knowledge is power” at
the first field of this page.