X97M/Divi

X97M/Divi	Destructivity: Spreading: Overall risk:

• Detected by virus detection files published: 11/16/2000	• Type: Virus
• Virus characteristics first published: 11/16/2000	• Spreading mechanism: File Infection
• Virus characteristics latest update: 12/17/2003	• Overall risk: Low
• Infection type: Microsoft Excel 6.0/95

Virus type

Spreading
mechanism

Destructivity
and payload

Additional
descriptions

Detection
and removal

X97M\Divi.A

When an infected spreadsheet is opened the virus it drops a file named, BASE5874.XLS to MS Excel's startup path, this file will be loaded each time MS Excel is started. BASE5874.XLS will then infect all spreadsheets opened and created in MS Excel. Divi writes a custom property (File, Properties, Custom) to all spreadsheets it infects. This property is given the value IVID + a hex number. This property is used to determine whether the spreadsheet has already been infected or not; if already infected, it will not be reinfected.

X97M\Divi.B

This is very similar to the A variant.

X97M\Divi.D

This variant drop a file named 874.XLS to MS Excel's startup path, instead of BASE5874.XLS like the original A variant.

X97M\Divi.G

This drops a file with same name as Divi.A, BASE5874.XLS.

X97M\Divi.N

Divi.N drops a file named hr223.XLS to MS Excel's startup path.

# - A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z