XF.Padrepex

Updated: March 20, 2013 Virus 0 Comment

XF.Padrepex is a macro virus created specifically for Microsoft Excel program. This threat will insert itself on any Microsoft .XLS files found on the compromised computer.

When initiated, the virus will drop the following file:
%UserProfile%\Application Data\Microsoft\Excel\XLSTART\rpt_pdm2cvs.xls

Then, the virus will perform certain system modifications that will allow the computer to run the above file whenever user runs Microsoft Excel. Once the virus is running, it will search the contents of the affected computer and infects all .XLS files with own harmful code.

Once the infected file is opened, it will perform a series of tasks. It may also damage the affected filer by appending its code into their header.

Spam email is the usual carrier of XF.Padrepex. When user executed an attached file from this emails, the virus will initiate and install the main executable file on the computer. Most macro viruses launch along with the corresponding programs and propagate to infect other files. In this case, XF.Padrepex focus are mainly Excel program and spreadsheet files. This virus only attacks office files, templates, and not the program. There are no reports that the virus can spread over a network or through removable drives.

Damage Level: Low

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

Manual Removal of XF.Padrepex

1. If using Windows Me/XP, System Restore must be disabled to prevent the threat from restoring itself. [how to]
2. Database, pattern and definition files of installed antivirus programs must be updated.
3. Restart Windows in Safe Mode.
4. Run a full system scan and clean/delete all infected files.
5. Restart Windows in normal mode.

Scan with Norton Power Eraser:
A free removal tool from Norton Antivirus was developed to remove unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.

How to Protect Computer From XF.Padrepex

Use security programs:
- Install antivirus and always update the database to ensure that it will detect new threats and viruses.
- Use a firewall to block all unwanted incoming Internet traffic.
- Anti-malware is also advise aside from installed antivirus programs.

Communication Precautions:
- Be cautious in opening e-mail attachments. Spam messages that pretend to be from a known source may contain infected attached files.
- Never click on a suspicious link sent through instant messaging programs.