Virus

XF/Wisab.A

Analysis

XF/Wisab.A is classified as a macro virus. It uses hidden worksheet formulas to infect other spreadsheets and to spread itself.

  • It creates the following file:
    • undefinedXLSTARTundefined\Book1
    The undefinedXLSTARTundefined folder is usually C:\Documents and Settings\Administrator\Application Data\Microsoft\Excel\XLSTART\.
  • It creates a hidden worksheet named XL4Test5  to save its codes.

  • Its behavior is very similar to XF97/Wisab.A.