Risk Level 1: Very Low

February 13, 2007 12:11:15 PM
Also Known As:

The XM.Sofa virus is the first member of the second family of Excel macro viruses. First discovered by SARC in early December of 1996 (west coast USA), XM.Sofa, like other Excel macro viruses, is written in MS Visual Basic and it spreads by copying its own viral macros to other MS Excel spreadsheet hosts. Unlike XM.Laroux (the first known, viable Excel macro virus) which infects by creating a file called PERSONAL.XLS in the default startup directory, XM.Sofa spreads by way of a file called BOOK.XLT placed in the alternate startup directory.

Antivirus Protection Dates

  • Initial Rapid Release version December 19, 2000
  • Latest Rapid Release version December 19, 2000
  • Initial Daily Certified version December 19, 2000
  • Latest Daily Certified version December 19, 2000
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment


  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy


  • Damage Level: Low


  • Distribution Level: Low

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report