XM.Register is designed to work with the French version of Microsoft Excel. It is difficult to replicate it in other versions of Excel. There currently two known variants of XM.Register.
XM.Register makes the following changes:
· Replaces author name with a random string of 15 characters.
· Saves files in the C:\Windows\Temp\ directory only as random file names of eight characters.
· Disables the Unhide... option on the Window menu.
· Inserts the file C:\MSOffice\Excel\XLOuvrir\Normal.xls to ensure that XM.Register runs on every Excel session.
· Every 30 seconds, XM.Register searches for infected active workbooks. If it finds an uninfected workbook, it attempts to infect it.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.