Aliases: Macro.Excel97.Yawn, X97M/Laroux.KV

X97M/Yawn.A is a macro virus operating in the Microsoft Excel environment. If the macro virus is active it attacks all worksheets in an open Excel workbook.
The macro virus consists of two VBA modules. Name of the first one is variable and it consists of two capital letters (e.g. EQ, SP, FT etc), name of the second module is Class1.
In the first module, on 9th line of the code, the virus contains the string ‘taitai which it uses as an identifier of infection. This module finds out whether there is the file PERSONAL.XLS in the directory marked symbolically Application.StartupPath (typically ...\Microsoft Office\Office\XLStart\). If it does not find it the virus exports its code to the file t in the directory Application.StartupPath, creates the file PERSONAL.XLS and imports contents of the file t into it. This file is run always when the program Microsoft Excel is started.
If the file PERSONAL.XLS already exists the virus X97M/Yawn.A deletes it and replaces by its own one.
The contents of the second macro are formed by a code which ensures execution of the virus macro upon opening a file by Excel.
This macro virus tries to conceal its presence in the system by disabling the item Tools/Macro in the Microsoft Excel menu. Moreover, it disables displaying of the window warning about presence of macros in a file being opened.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.