>Good evening to all:
>
>Today I scanned for viruses 3 machines. One had 15, the other
73, and
>the last one 10 instances of the same virus. The virus is
LAROUX, maybe
>HLAROUX or something like that. It's was in Excel files. I have
scanned
>these machines before and I still find viruses everytime I scan
them.
>
>After the scan and cleanup, I got a "Module Not Enabled"
message when I
>started Excel. When tried to open some of the files the same
message
>came back and there was no file.
>
>Can't say that I know what a Macro is, never use them. Have
heard of
>Macro viruses though. Here's what I think is going on, then
again I
>don't know if this is what Macro viruses are supposed to do.
>
>Let's say this LAROUX is a Macro virus, I clean it and it's
dead. Next
>time the user fills in his invoice, form, whatever, and uses
the Macro
>the virus is activated again and spreads to the new file.
>
>Does any of this make sense? Please enlighthen me.
>

Hi,
   The company I work at is having a real bad problem with this
virus, so I have a good idea what it works.  It is a macro
virus, specifically, it is a macro that is designed to create
the file Results.xls in the XLSTART directory (any file in this
directory gets started everytime you open Excel) and to create
copies of itself in any file that is "clean".  It does not have
a payload currently (a payload is the part of a virus that does
something other than replication).  After you have scanned and
cleaned the computers, delete the file Results.xls in the
XLSTART directory.  Also, see if your virus scanner has some
form of autoprotect (McAfee and Norton Anti-Virus does).  Next
go into the options for your auto-protect and make sure it is
scanning .xls files (for example Norton defaults to "Program
Files Only" and you must change it to "All Files" or it will
miss this virus.  You may also need to change the action that
occurs if it is set to something like "deny access".  Finnally,
educate your users.  Let them know that if there computer tells
them that a file they are using is infected, then have the
person who gave them that file to contact their computer people
about getting Anti-virus software installed and configured
properly (current virus definition files and settings) on the
machine the infected file came from.

Sorry if this is long winded, viruses are one of my major pet
peeves.

HTH,
Donald Gaither

                                  -----
                PCSOFT mailing list -  http://nospin.com
         Bob Wright:[log in to unmask] - Drew Dunn:[log in to unmask]