XL98: How to Use the Virus Search Add-in for Microsoft Excel 98

ID: Q193665

The information in this article applies to:
  • Microsoft Excel 98 Macintosh Edition

SUMMARY

This article contains information about the obtaining and installing the Virus Search add-in for Microsoft Excel 98 Macintosh Edition.


MORE INFORMATION

What Is the Laroux Virus?

In July 1996, Microsoft learned that Microsoft Excel was the target of a non-destructive, non-harmful macro virus called ExcelMacro/Laroux. This macro virus does not harm data but does replicate. In November 1996, a variation of the macro virus called Laroux B was reported.

Though Laroux does not harm data, Microsoft has developed a tool to address the problem. The Microsoft Excel Virus Search add-in detects and removes Laroux when you scan an infected file.

The virus affects workbooks created in the following versions of Microsoft Excel:
  • Microsoft Excel version 5.x for Windows 3.x


  • Microsoft Excel version 5.x for Windows NT


  • Microsoft Excel version 5.x for the Macintosh


  • Microsoft Excel for Windows 95, version 7.0


  • Microsoft Excel 97 for Windows


  • Microsoft Excel 98 Macintosh Edition


  • Certain localized versions of Microsoft Excel (for example, versions of Microsoft Excel translated to German)


Detecting the Laroux Virus

To determine if you have the virus:
  1. Start Microsoft Excel.


  2. Open a workbook that you suspect contains the virus. Click Disable Macros when you are prompted with the Macro Virus Protection warning.

    NOTE: If you are not prompted with a macro virus warning when you open a file that contains macros, follow these steps to enable the prompt:

    1. On the Tools menu, click Preferences.


    2. On the General tab, click to select the Macro Virus Protection check box, and then click OK.




  3. On the Tools menu, point to Macro, and then click Macros.


  4. If you see the following macro names in the list, the Laroux virus may be present:
    Auto_Open
    Check_Files
    Personal Macro Workbook!auto_open
    Personal Macro Workbook!check_files
    Note: If you see only the Auto_Open macro, without the Check_Files macro, it's possible that the workbook does not contain the virus.


  5. If any workbooks that you have open in the background also contain the virus, you may also see the following names listed
    'bookname'!auto_open
    'bookname'!check_files
    where 'bookname'! is the name of the open workbook.


  6. To confirm the existence of the Laroux macro virus, follow these steps:

    1. Start the Visual Basic Editor (press OPTION+F11).


    2. In the View menu, click Project Explorer.


    3. In the Project Explorer window, click the triangle next to "VBAProject (Personal Macro Workbook)" to show a list of objects in the Personal Macro Workbook.


    4. Click the triangle next to Modules.


    If you see a module named Laroux, then your installation of Microsoft Excel is infected with the Laroux macro virus.


Obtaining and Using the Virus Search Add-in

To obtain the Virus Search add-in for Microsoft Excel 98, open the following World Wide Web address in your Web browser:
http://www.microsoft.com/macoffice/laroux.sit.hqx
For more information about downloading files from the Microsoft Software Library, please see the following article in the Microsoft Knowledge Base:
Q119591 How to Obtain Microsoft Support Files from Online Services
Then, follow these steps to install the virus Search Add-in:
  1. Use an appropriate program to decode and decompress the Virus Search add-in.


  2. Copy the "Excel Virus Search Add-In" file to the following folder:
    Microsoft Office 98:Office:Excel Add-Ins


  3. Start Microsoft Excel.


  4. On the Tools menu, click Add-Ins.


  5. Click to select the "Excel Virus Search Add-In" check box, and then click OK.


To Clean the Files on Your Disk or Shared Network Directories

  1. Close any open workbooks.


  2. On the Tools menu, click Virus Search.


  3. Click the Currently Open Workbooks And Disk Files option, and then click OK.


  4. In the "Enter the path to the folder that you want to search" box, type the search path.

    Note: To search all folders within the top-level folder you specified, make sure the Include Subfolders check box is checked.


  5. If you want to scan files that were last modified before Laroux was discovered, click to select the "Include files modified before July 1996" check box.


  6. If you frequently share files with Windows-based personal computer (PC) users, click to select the "Search files that are marked as 'TEXT'" check box.


  7. Click OK to begin the scan. The add-in removes the Laroux virus from any files in which it is detected and saves the cleaned files automatically.


  8. When the scan is complete, click Yes to repeat the search starting from a different top-level folder, or click No to exit.


NOTE: If an alert message appears while scanning, click OK to continue the search. If Microsoft Excel or the Virus Search add-in stops responding because it encounters a corrupted workbook file, manually delete the file from your hard disk or from the shared network drive and run the add-in again.

To Remove the Virus from a Protected, Read-Only, or Shared Workbook

If a workbook is protected for structure, is read-only, or is a shared workbook, the virus cannot be removed. If you have a workbook of any of these types, you can scan it to determine whether it has the virus. If the virus is found, unprotect the workbook, make it read/write, or remove it from shared use, and then repeat the virus scan.

Opening New Workbooks Safely in Microsoft Excel 98

Microsoft Excel 98 includes a Macro Virus Protection feature. This feature automatically checks all workbooks and workbook templates that you open by using Open on the File menu or the Open button on the Standard toolbar. If a workbook contains macros, the scanner displays a warning message that lets you decide how to open the workbook.

Macro Virus Protection does not recognize any particular virus, it just detects macros stored within a workbook. Therefore, you will see this warning even when the macros are "safe." If you are unsure whether a particular workbook with macros is safe, click the Disable Macros button. Then if you have installed the Virus Search add-in, use Virus Search on the Tools menu to search the workbook for the Laroux Virus.

By default, the Macro Virus Protection feature is turned on in Microsoft Excel 98. To confirm that the feature is turned on, click Preferences on the Tools menu, and then click the General tab. If the Macro Virus Protection check box is cleared, click the Macro Virus Protection box to select it, and then click OK.


REFERENCES

For additional information about the Laroux macro virus, please see the following articles in the Microsoft Knowledge Base:

Q154131 XL: Q&A about Excel Macro/Laroux Macro Virus

Additional query words: XL98

Keywords : kbfile kbdta kbvirus xlwiz xladdins
Version : MACINTOSH:98
Platform : MACINTOSH
Issue type : kbhowto


Last Reviewed: August 5, 1999
© 2000 Microsoft Corporation. All rights reserved. Terms of Use.