McAfee > Theat Center > Virus Detail Page

Overview

-- Update May 9, 2006 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://software.silicon.com/malware/0,3800003100,39158763,00.htm

--

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

X97F/Yagnuul is a Microsoft Excel formula virus.  It pretends to contain a fantasy football league table listing all of the English Premiership Football League teams.

When it is executed it will infect other MS Excel files which are already open at the time.

It will create files on the system which have the following filename format.

LuuNgay[todays date]filename.xls

For example if you already have an innocent excel file open, (XLtest1.xls), when the virus is executed it will create a new file with the name LuuNagay[todays Date]XLtest1.xls.  These files are created for all the Excel files which are currently open on your system.

The virus code is copied to these files.

Symptoms

Presence of filenames starting with 'LuuNgay'.

Method of Infection

The virus will copy it's code to other currently opened MS Excel files.

Removal

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants

N/A

All Information

Overview -

-- Update May 9, 2006 --
The risk assessment of this threat has been updated to Low-Profiled due to media attention at:
http://software.silicon.com/malware/0,3800003100,39158763,00.htm

--

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

Characteristics -

X97F/Yagnuul is a Microsoft Excel formula virus.  It pretends to contain a fantasy football league table listing all of the English Premiership Football League teams.

When it is executed it will infect other MS Excel files which are already open at the time.

It will create files on the system which have the following filename format.

LuuNgay[todays date]filename.xls

For example if you already have an innocent excel file open, (XLtest1.xls), when the virus is executed it will create a new file with the name LuuNagay[todays Date]XLtest1.xls.  These files are created for all the Excel files which are currently open on your system.

The virus code is copied to these files.

Symptoms

Symptoms -

Presence of filenames starting with 'LuuNgay'.

Method of Infection

Method of Infection -

The virus will copy it's code to other currently opened MS Excel files.

Removal -

Removal -

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations

Variants

Variants -

N/A