WE1280: Virus Search Add-in

• Microsoft Excel for Windows 95, version 7.0
• Microsoft Excel for Windows, versions 5.0, 5.0c
• Microsoft Excel 97 for Windows

SUMMARY

The Application Note "Virus Search Add-in" (WE1280) is now available from Microsoft Technical Support. The disk included with this Application Note contains versions 1.2 and 2.0 of the Virus Search add-in. You can use the add-in to remove the ExcelMacro/Laroux concept virus, which affects Microsoft Excel versions 5.0 and 5.0c for Windows, and Microsoft Excel for Windows 95, version 7.0, and Microsoft Excel 97 for Windows.

After you obtain the Application Note, read the We1280.doc file included on the disk or with the downloaded file for installation instructions.

You can obtain this Application Note from the following sources:

• Microsoft's World Wide Web Site on the Internet
• The Internet (Microsoft anonymous ftp server)
• Microsoft Download Service (MSDL)
• Microsoft Technical Support

THE TEXT OF WE1280

  Microsoft(R) Product Support Services Application Note (Text File)
            WE1280: Virus Search Add-in, Version 1.2

                                                  Revision Date: 9/96
                                                       1 Disk Included

INTRODUCTION

This Application Note contains versions 1.2 and 2.0 of the Virus Search add- in. You can use this add-in to remove the Laroux virus from your computer. If you are using Microsoft Excel 97 for Windows, you need to use version 2.0 of the Virus Search add-in. If you are using Microsoft Excel versions 5.0 or 7.0 for Windows, you need to use version 1.2 of the Virus Search add- in.

WHAT IS THE LAROUX VIRUS?

The Laroux macro is a nonharmful, nondestructive "concept" virus that appends a module named "Laroux" to a workbook. It does not affect data or anything else in the workbook. This is the first replicating macro virus ever discovered in Microsoft Excel. The virus affects workbooks created in the following versions of Microsoft Excel:

• Microsoft Excel version 5.x for Windows 3.x
• Microsoft Excel version 5.x for Windows NT®
• Microsoft Excel for Windows 95, version 7.0 (for Windows 95 and Windows NT)
• Microsoft Excel 97 for Windows
• Certain localized versions of Microsoft Excel (for example, versions of Microsoft Excel translated to German)

DETECTING THE LAROUX VIRUS

To determine if you have the virus:

1. Start Microsoft Excel.

2. Open a workbook that you suspect contains the virus.

3. On the Tools menu, point to Macro, and then click Macros.

4. If you see the following macro names in the list, the Laroux virus may be present:

         Auto_Open
         Check_Files
         PERSONAL.XLS!auto_open
         PERSONAL.XLS!check_files
   

   Note: If you see only the Auto_Open macro, without the Check_Files macro, it's possible that the workbook does not contain the virus.

5. If any workbooks that you have open in the background also contain the virus, you may also see the following names listed

         'bookname'!auto_open
         'bookname'!check_files
   

   where 'bookname'! is the name of the open workbook.

6. You can confirm the existence of the virus macro by clicking the Unhide command on the Window menu and then clicking the Personal.xls file name.

MICROSOFT EXCEL 97: USING THE VIRUS SEARCH ADD-IN VERSION 2.0

NOTE: The English language version of the Microsoft Excel Virus Search add- In is not supported for use with the international versions of Microsoft Excel.

The add-in program includes four files and a readme file. To install the Virus Search version 2.0 add-in, use the following steps:

1. Quit Microsoft Excel.

2. If you received a disk with this Application Note, insert the disk in the appropriate floppy drive.

   If you downloaded this Application Note, skip to step 3. This procedure assumes that you have already downloaded and extracted the compressed file.

3. On the Windows Start menu, click Run, and then type drive:location\Xlscan97.exe

   where drive and location point to the location of the file. For example, if the file is located in the C:\Downloads folder, type:

         c:\Downloads\Xlscan97.exe
   

   A dialog box will display the following message:

         This program will install the Microsoft Excel 97 Laroux Virus
         Scanner. Do you want to continue?
   

4. Click Yes to install the add-in.

To Load the Add-in in Microsoft Excel

To load the add-in, use the following steps:

1. Start Microsoft Excel.

2. On the Tools menu, click Add-Ins.

3. Click to select the Microsoft Excel Virus Search check box.

   If you don't see this add-in listed, click Browse, and use the Browse dialog box to locate and select the Xlscan97.xla file. In the Add-Ins dialog box, click OK.

   The Virus Search add-in program will be started.

4. When prompted to search for the Laroux virus, click Yes.

Once you have installed the add-in, you can remove the virus from workbook files on your hard disk and shared network folders. After doing this, you can continue to use the Virus Search add-in to periodically search for viruses.

Troubleshooting Installation Problems

If you have problems with the installation, check the files listed in the following table to be sure they were installed to the appropriate directories.

 This file     Should be located in this folder  Default location of folder
 --------------------------------------------------------------------------

 Xlscan97.xla   Library                          C:\Program
                                                 Files\Microsoft
                                                 Office\Office\Library

 Xvbscan.exe    Library                          C:\Program
                                                 Files\Microsoft
                                                 Office\Office\Library

 Scanload.dll   Office                           C:\Program Files\Microsoft
                                                 Office\Office

 Msvbvm50.dll   Windows 95 System or              C:\Windows\System or
                Windows NT System                 C:\Winnt\System32

Using the Add-in to Remove the Laroux Virus

NOTE: Before cleaning files on your disk or on shared network folders, close any other programs that are running. While the Virus Search add-in is running, do not start other programs.

To clean the files on your disk or shared network directories

1. Close any open workbooks.

2. If the Virus Search add-in is not currently running, click Virus Search on the Tools menu.

   If the Virus Search add-in is already running, respond to the prompt asking if you want to scan your files for the virus by clicking the Yes button.

3. Click the Currently Open Workbooks And Disk Files option, and then click OK.

4. When prompted that open workbooks will be saved, click OK.

5. When prompted about scanning workbooks older than the date when the Laroux virus was first detected, do either of the following:

       - If you want to check all workbooks regardless of their age, click
         Yes.
   

       - If you want to check only workbooks that have been saved since
         the Laroux virus appeared, click No.
   

   NOTE: Clicking No may speed up the process by scanning fewer workbooks.

6. In the dialog box that prompts you to type the path of the folder to search, do the following:

   a. In the Directory box, type the path to the folder on your

         hard disk or on a shared network folder in which you want to start
         scanning for the virus.
   

   b. In the File Types box, type all file extensions used on your

         system for Microsoft Excel workbooks or workbook templates.
   

         For example, .xls and .xlt are the default extensions. Type the
         extensions in the format shown, and separate each entry with a
         semicolon, as in the following example:
   

            *.xls; *.xlt
   
   

7. To search all folders within the top-level folder you specified, make sure the Include Subfolders check box is checked, and click OK.

1. Click Start to begin the scan. The add-in removes the Laroux virus from any files in which it is detected and saves the cleaned files automatically.

2. When the scan is complete, click Yes to repeat the search starting from a different top-level folder, or click No to exit.

To remove the virus from a protected, read-only, or shared workbook

If a workbook is protected for structure, is read-only, or is a shared workbook, the virus cannot be removed. If you have a workbook of any of these types, you can scan it to determine whether it has the virus. If the virus is found, unprotect the workbook, make it read/write, or remove it from shared use, and then repeat the virus scan.

Opening New Workbooks Safely in Microsoft Excel 97

Microsoft Excel 97 includes a Macro Virus Protection feature. This feature automatically checks all workbooks and workbook templates that you open by using Open on the File menu or the Open button on the Standard toolbar. If a workbook contains macros, the scanner displays a warning message that lets you decide how to open the workbook.

Macro Virus Protection does not recognize any particular virus, it just detects macros stored within a workbook. Therefore, you will see this warning even when the macros are "safe." If you are unsure whether a particular workbook with macros is safe, click the Disable Macros button. Then if you have installed the Virus Search add-in, use Virus Search on the Tools menu to search the workbook for the Laroux Virus.

By default, the Macro Virus Protection feature is turned on in Microsoft Excel 97. To confirm that the feature is turned on, click Options on the Tools menu, and then click the General tab. If the Macro Virus Protection check box is cleared, click the Macro Virus Protection box to select it, and then click OK.

MANUALLY CHECKING A FILE FOR THE LAROUX VIRUS

To examine macros manually for the Laroux virus

1. If you do not have the Virus Search add-in installed, click Disable Macros when you open the workbook.

   The workbook will be opened without running any macros.

2. On the Tools menu, point to Macro, and then click Macros.

3. In the list of macros, delete any of the following macro names that appear:

         Auto_Open
         Check_Files
         PERSONAL.XLS!auto_open
         PERSONAL.XLS!check_files
   

   If the list contains the Auto_Open macro but the Check_Files macro is not present, the file may not contain the Laroux virus.

4. Click OK.

5. On the File menu, click Exit, and then click Yes to save all changes.

UNINSTALLING THE MICROSOFT EXCEL VIRUS SEARCH 2.0 ADD-IN

To uninstall the Virus Search add-in

1. On the Tools menu, click Add-Ins.

2. Clear the Microsoft Excel Virus Search check box, and then click OK.

MICROSOFT EXCEL 5.0 OR 7.0: USING THE VIRUS SEARCH ADD-IN VERSION 1.2

Note: The English language version of the Microsoft Excel Virus Search add- In is not supported for use with the international versions of Microsoft Excel.

Installing the Microsoft Excel Virus Search Add-in

To install the Virus Search add-in

1. Quit Microsoft Excel.

2. If you received a disk with this Application Note, insert the disk in the appropriate floppy disk drive.

   If you downloaded this Application Note from an online service, skip to step 3. This procedure assumes that you have already downloaded and extracted the compressed file.

3. Copy the Xlscan.xla file from the WE1280 disk (or from the directory to which you downloaded and extracted WE1280.exe) to the Microsoft Excel Library folder using Windows Explorer or File Manager. The default locations for the Library folder are listed in the following table.

      Microsoft Excel version   Default folder location
      -------------------------------------------------
   
      7.0                       C:\MSOffice\Excel\Library
   
      5.x                       C:\Excel\Library
   
   

Loading the Add-in in Microsoft Excel

To load the add in, use the following steps:

1. Start Microsoft Excel.

2. On the Tools menu, click Add-Ins.

3. Make sure the Microsoft Excel Virus Search check box is selected.

   If you don't see this add-in listed, click Browse and use the Browse dialog box to locate and select the Xlscan.xla file. In the Add-Ins dialog box, click OK. The Virus Search add-in program will be started.

4. Click Yes to begin the scan.

5. If the Virus Search add-in reports that the Laroux virus was found and removed from a workbook, it prompts you to save the workbook. Click Yes, so that the clean version of the workbook is saved over the version with the virus.

In this scenario            Do this

If you aren't sure that     Click the Open Without Macros button.
the workbook is from a      The workbook is opened, but neither
reliable source, but you    Microsoft Excel 4.x (.xlm) nor Visual
want to see the contents    Basic macros are included. If you
of the workbook             then save the workbook with the same
                            name, it is saved without the macros, and all
                            macros previously in the workbook are
                            permanently lost. It's a good
                            idea to save the workbook with a different name
                            if you want a copy of the
                            workbook without the macros.

                            -or-

                            Click the Cancel button and use the Virus
                            Search add-in to check the file
                            on disk.
                            After the Virus Search add-in has scanned and
                            cleaned the file, you can open the file with
                            its macros and be sure that the Laroux virus is
                            not present.

If you are certain of       Click the Open With Macros button to
the reliability of the      open the workbook and use the macros.

If you want to examine     Select the Do Not Run Auto_Open Macro
the macros manually for    check box, and then click the Open
viruses                    With Macros button.
                           The workbook and its macros are opened, but any
                           macros that typically run automatically when the
                           workbook is opened do not run. Macros of this
                           type are a common mechanism by which viruses,
                           such as the Laroux virus, introduce themselves
                           into a computer. For more information about
                           manual checking, see the "Manually Checking a
                           File for the Laroux Virus" section on page 9 of
                           this document.

USING THE ADD-IN TO REMOVE THE LAROUX VIRUS

To remove the virus from files on your computer

When the add-in is loaded, files on your computer are automatically scanned when you open them by clicking Open on the File menu or by clicking the Open button (on the Standard toolbar). In addition, the Virus Search command is added to the Tools menu. You can use this command to use the add- in to open workbook files safely and prevent the virus from being reintroduced onto your computer.

To remove the virus from files that are on a disk or that are located on a shared network drive

1. Close any open workbooks.

2. If the Virus Search add-in is not currently running, click the Virus Search command on the Tools menu.

   If the Virus Search add-in is already running, respond to the prompt asking if you want to scan your files for the virus by clicking Yes.

3. Click Currently Open Workbooks And Disk Files, and then click OK.

4. When you are prompted that the add-in will save open workbooks, click OK.

5. When prompted about scanning workbooks older than the date when the Laroux virus was first detected, do either of the following:

   If you want to check all workbooks regardless of their age, click Yes.

   If you want to check only workbooks that have been saved since the Laroux virus appeared, click No.

   NOTE: Clicking No may speed up the process by scanning fewer workbooks.

6. In the dialog box that prompts you to type the path to the folder to search, do the following:

   a. In the Directory box, type the path to the folder on your

         hard disk or on a shared network folder in which you want to start
         scanning for the virus.
   

   b. In the File Types box, type all file extensions used on your

         computer for Microsoft Excel workbooks or workbook templates.
         For example, .xls and .xlt are the default extensions. Type the
         Extensions in the format shown, and separate each entry with a
          semicolon, as in the following example:
   

            *.xls; *.xlt
   
   

7. Select either of the following check boxes as appropriate:

   To search all folders within the top-level folder you specified click to select the Scan Subdirectories check box.

   To display a worksheet that lists the results when the scan is complete, click to select the Log Searched Files check box.

8. Click OK to begin scanning the files.

To remove the virus from a protected, read-only, or shared workbook

If a workbook is protected for structure, is read-only, or is a shared workbook, the virus cannot be removed. If you have a workbook of any of these types, you can scan it to determine whether it has the virus. If the virus is found, unprotect the workbook, make it read/write, or remove it from shared use, and then repeat the virus scan.

To remove the virus from a workbook opened from a source other than Microsoft Excel

If you open a workbook from File Manager or Windows Explorer, from an electronic mail message, or from a Web browser such as Microsoft Internet Explorer, the workbook is not scanned automatically for macros that may contain viruses. If you open workbooks in any of these ways, or if you decide to open a workbook with macros, use the following steps to check the workbook and remove the Laroux virus before you save the workbooks (if you don't do use these steps before you save the workbook, you may inadvertently infect another workbook with the virus):

1. On the Tools menu, click Virus Search.

2. Click the Currently Open Workbooks option, and then click OK.

3. If the Virus Search add-in reports that the Laroux virus was found and removed from a workbook, it prompts you to save the workbook. Click Yes, so that the clean version of the workbook is saved on your Disk over the version that has the virus.

MANUALLY CHECKING A FILE FOR THE LAROUX VIRUS

To examine macros manually for the Laroux virus

1. If you do not have the Virus Search add-in installed, hold down the shift key while you open the workbook.

   The workbook is opened without running any macros (if you don't hold down the shift key, some macros run automatically when you open a workbook).

   Note: If you have the Virus Search add-in installed, the SHIFT+Open capability is disabled. Click Open on the File menu, double-click the workbook you want to open, select the Do Not Run Auto_Open Macro check box, and then click Open With Macros.

2. On the Tools menu, click Macro.

3. In the list of macros, delete any of the following macro names that appear:

         Auto_Open
         Check_Files
         PERSONAL.XLS!auto_open
         PERSONAL.XLS!check_files
   

   NOTE: If the list contains the Auto_Open macro, but the Check_Files macro is not present, the file may not contain the Laroux virus.

4. Click OK.

5. On the File menu, click Exit, and then click Yes to save all changes.

PREVENTING THE LAROUX AND OTHER VIRUSES FROM INFECTING YOUR COMPUTER

After you have scanned your workbooks and removed the Laroux virus, you can prevent the virus from returning by taking the following precautions:

• Open workbooks by clicking Open on the File menu or by clicking the Open button (on the Standard toolbar). When you open workbooks in this way, they are automatically scanned for macros when you have the add-in loaded.
• If you open a workbook from File Manager or Windows Explorer, from an electronic mail message, or from a Web browser, such as Microsoft Internet Explorer, immediately check the workbook for the Laroux virus By using the Virus Search command on the Tools menu, as explained in the "To remove the virus from a workbook opened from a source other than Microsoft Excel" section on page 8 of this document. Workbooks opened in any of these ways are not automatically scanned for macros, so it's important for you to check them for the virus.
• The Microsoft Excel Virus Search add-in can detect and remove the Laroux virus only. If new viruses are discovered in the future, Microsoft will provide information about what you need to do to remove them from your files and prevent them from recurring. To minimize the possibility of acquiring any new viruses that may appear, do the following:

  1. Always open workbooks by clicking Open on the File menu or by

        clicking the Open button (on the Standard toolbar).
  

  2. Open workbooks with their macros only if you are certain of the

        reliability of the source from which you obtained the workbook.
  

  3. If you aren't sure about the source of a workbook, open it

        without macros.
  

HOW THE VIRUS SEARCH ADD-IN VERSION 1.2 CHANGES MICROSOFT EXCEL

The Virus Search add-in makes several changes to Microsoft Excel that affect how you open files.

The Recently Used Files List Is Removed

With the Virus Search add-in installed, you do not see a list of recently opened files when you click the File menu. To open a recently used file, click Open on the File menu or click the Open button (on the Standard toolbar).

Not All File Types Are Listed in the Files of Type Box in the Open Dialog Box

When you install the Virus Search add-in, the Files Of Type list in the Open dialog box no longer lists certain rarely used file types. However, you can still open files of these types. If you don't see the file type you're looking for in the Files Of Type list, click All Files (*.*) (the first selection in the list), click the name of the file you want, and click the Open button.

Can't Open Workbooks as Read-Only from the Open Dialog Box

When you install the Virus Search add-in, the Open dialog box (the dialog box that is displayed when you click Open on the File menu) no longer lets you open a workbook as read-only.

To open a workbook as read-only, uninstall the Virus Search add-in, or use the following steps:

1. On the File menu, click Open, and then open the workbook.

2. On the View menu, click Toolbars. In the Toolbars box, select the Workgroup check box, and then click OK.

3. To make the workbook read-only, click the Toggle Read Only button on the Workgroup toolbar.

Can't Use SHIFT+Open to Prevent Auto_Open from Running

With the Virus Search add-in installed, holding down the shift key while opening files will no longer prevent the Auto_Open macro from running. Instead, use Open on the File menu to open a workbook. If you do not want the Auto_Open macro to run, select the Do Not Run Auto_Open Macro check box, and then click Open With Macros.

Text Import Wizard Does Not Start Automatically

When you open a text file, Microsoft Excel typically starts the Text Import Wizard. With the Virus Search add-in installed, Microsoft Excel cannot start the Text Import Wizard as it usually does. Instead, Microsoft Excel asks whether you want to use the Text Import Wizard. If you click OK, the Virus Search add-in turns off its detection capabilities, and displays the Open dialog box with the text file selected by default. Click OK to open the text file and run the Text Import Wizard.

UNINSTALLING THE MICROSOFT EXCEL VIRUS SEARCH 1.2 ADD-IN

To uninstall the Virus Search add-in

1. On the Tools menu, click Add-ins.

2. Clear the Microsoft Excel Virus Search check box, and then click OK.

ANSWERS TO COMMON QUESTIONS

For more information about macro viruses, see the following Microsoft sites on the World Wide Web:

   http://www.microsoft.com/office/antivirus/
   http://www.microsoft.com/msexcel/productinfo/vbavirus/emvolc.htm
   http://www.microsoft.com/excel/productinfo/vbavirus/add_in.htm

1. Q. What are macro viruses?

   A. Macro viruses are a type of virus that use an application's own macro
      programming language to distribute themselves. Unlike previous
      viruses, macro viruses do not infect programs; they infect documents.

2. Q. What is Sofa?

   A. This is a non-harmful, non-destructive macro virus that does not
      Affect data in any way. Infected files display the application header
      "Microsofa Excel" instead of "Microsoft Excel."

3. Q. What is ExcelMacro/Laroux?

   A. This is a non-harmful, non-destructive concept virus. It simply
      Appends a macro sheet called "laroux" to workbooks. It does not
      affect data or anything else in the workbook. This is the first
      replicating macro virus ever discovered in Microsoft Excel.

4. Q. What is Laroux B?

   A. Laroux B is a variation of the original virus that is the same
      in all respects, but can overwrite existing macros on the user's
      Personal.xls macro sheet.

TO OBTAIN THIS APPLICATION NOTE

The following file is available for download from the Microsoft Software Library:

 ~ We1280.exe (size: 1122407 bytes) 

   ARTICLE-ID: Q119591
   TITLE     : How to Obtain Microsoft Support Files from Online Services