XM97/Morx-A virus attacks Excel Spreadsheets

By Steve Malone

Posted on 2 Apr 2003 at 10:10

Virus security company Sophos is warning of a new virus which attacks through Excel spreadsheet macros.

The virus is activated when Excel workbooks are opened. As an Excel macro virus, when an infected document is opened the viral macros are copied into a file in the XLSTART directory. This is automatically loaded into other documents when they are opened.

In the case of XM97/Morx-A, the macro creates a file rom.xla in the folder C:\Program Files\Microsoft Office\Office\Library\Analysis

The virus also goes by the names of X97M.Romlax, X97M_MORX.A, X97M/Morx, Macro.Excel97.Morx. An IDE file can be obtained from

• Email to a friend
• Print this article