1. /
  2. Security Response/
  3. XM.Register

XM.Register

Risk Level 1: Very Low

Discovered:
August 30, 2000
Updated:
February 13, 2007 12:46:50 PM
Also Known As:
XM.Register.A, XM.Register.B
Type:
Macro

XM.Register is designed to work with the French version of Microsoft Excel. It is difficult to replicate it in other versions of Excel. There currently two known variants of XM.Register.

XM.Register makes the following changes:

· Replaces author name with a random string of 15 characters.
· Saves files in the C:\Windows\Temp\ directory only as random file names of eight characters.
· Disables the Unhide... option on the Window menu.
· Inserts the file C:\MSOffice\Excel\XLOuvrir\Normal.xls to ensure that XM.Register runs on every Excel session.
· Every 30 seconds, XM.Register searches for infected active workbooks. If it finds an uninfected workbook, it attempts to infect it.

Antivirus Protection Dates

  • Initial Rapid Release version September 5, 2000
  • Latest Rapid Release version September 5, 2000
  • Initial Daily Certified version September 5, 2000
  • Latest Daily Certified version September 5, 2000
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy

Damage

  • Damage Level: Low

Distribution

  • Distribution Level: Low
Writeup By: Andre Post

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver