Excel macro virus, related to "Macro.Excel.Laroux". It infects Excel worksheets. It contains two macros in one module Riots: Auto_Open, Auto_Close, Fuck.
On opening an infected table Excel executes auto-macro auto_open which installs the virus into the system: copies the virus code to newly created file RIOTS.XLM in the Excel Startup directory. The virus then defines the "Fuck" macro as sheet activation handler, so the virus intercepts sheets opening procedure and infects them.
On file closing on 13th of any month the virus removes current sheet and displays the Balloon:
XM97.Riots!
by: Sbkm/AbZreplIvehfGrnz
Encripted for safe me :o)
It then displays the MessageBox:
>>XM.Riots<< if U smart you can read it!
Jr jnag ersbezngvba!
1. Ybj Gur cevpr
2. Oevat onpx zl Ehcvnu
3. Ab Zber Fbrunegb Pyna!
Sbkm/AbZreplIvehfGrnz
