XM.Register

SUMMARY

XM.Register is designed to work with the French version of Microsoft Excel. It is difficult to replicate it in other versions of Excel. There currently two known variants of XM.Register.

XM.Register makes the following changes:

· Replaces author name with a random string of 15 characters.
· Saves files in the C:WindowsTemp directory only as random file names of eight characters.
· Disables the Unhide... option on the Window menu.
· Inserts the file C:MSOfficeExcelXLOuvrirNormal.xls to ensure that XM.Register runs on every Excel session.
· Every 30 seconds, XM.Register searches for infected active workbooks. If it finds an uninfected workbook, it attempts to infect it.

Protection

• Virus Definitions (Intelligent Updater) September 5, 2000

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low

TECHNICAL DETAILS

The module name used by XM.Register is MODULE9999. XM.Register searches all active workbooks for a module named MODULE9999. If it does not find this module in a workbook, the infection routine is triggered. The infection routine attempts to copy this viral module into any clean workbook found.

XM.Register performs the iteration every 30 seconds. A timer is set to activate the iteration function at the current time plus 30 seconds.

Screen updating is turned off, which suppresses any visual hints of a viral presence. This is done in addition to disabling alerts.

Recommendations

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

REMOVAL

Norton AntiVirus repairs any infections found.