XM.Register makes the following changes:
· Replaces author name with a random string of 15 characters.
· Saves files in the C:\Windows\Temp\ directory only as random file names of eight characters.
· Disables the Unhide... option on the Window menu.
· Inserts the file C:\MSOffice\Excel\XLOuvrir\Normal.xls to ensure that XM.Register runs on every Excel session.
· Every 30 seconds, XM.Register searches for infected active workbooks. If it finds an uninfected workbook, it attempts to infect it.