Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Threats » X97M/Barisada.A

Overview

Threat Risk LOW LOW
Destructivity LOW LOW
Payload
Detection files published 09 Aug 2000 03:00:00
Description created 15 Aug 2000 03:00:00
Description updated 15 Aug 2000 03:00:00
Malware type VIRUS
Alias
Spreading mechanism FILE_INFECTION
Summary None

X97M/Barisada.A

Spreading

X97M/Barisada.A is a small virus. The virus will spread on closing of the spreadsheet. It will check if the file HJB.XLS already exists in the Excel Startup directory. If not, it will drop this infected template there. The next time Excel is loaded, it will automatically load this infected file as well. The next action is to infect all modules and worksheets in all loaded spreadsheets.

Payload Details

The payload for all three members of the X97M/Barisada family is the same and highly destructive. On 24 April of any year, between 14.00 hour and 15.00 hour, when closing an infected spreadsheet, the user will get a pop-up box with questions. The first pop-up box will display:


(Image not available)


If you give the correct answer No, the pop-up

(Image not available)


will be displayed and the user may continue without problems.

If the answer given was Yes, the user is warned

(Image not available)


and shown the next question:


(Image not available)


If the answer given is Yes, the user gets the message

(Image not available)


and may continue safely.

However, if the answer given is No, the user gets the message:


(Image not available)


and when pressing the OK button, the virus will clear all cells in all open spreadsheets thus destroying potentially precious data.

Analysis

n/a

Removal

n/a


Last Updated: 12 Nov 2015 11:06:15