Excel Macro Virus? (Excel 2000)

Topic

New Reply

When a colleague of mine starts her Excel, instead of opening up with a blank “Book 1”, it automatically loads a workbook called “freshmen 3.eml”. The workbook contains only one sheet (freshmen 3) and neither the sheet nor the workbook contain any vba code (as far as I can tell).

I have searched her pc for a file called freshmen_3.eml but found nothing. I am wondering if anybody has seen this before and can provide some info.

How can I prevent Excel from loading this file? Personal.xls does not load so I am not suspecting it.

Thanks for help

Reply | Quote

Replies

kmedgyes

This might not be a virus at all.

You see Excel can start with a bunch of workbooks that the user likes all automatically. If you place anything in the XLSTART folder the Excel will start that workbook for you.

To look for this “file” you need to search all her drives, network drives and local, because the XLSTART folder may be on a network drive, I think. Once you located this “file” move it out of where it is.

Also it maybe a hyper link that your Perosnal.xls is calling so test the first option and report back for more information.

Wassim

Reply | Quote

Hi Wassim,

As you suggested, we found the eml file in the XLstartup file on the D: drive and deleted it.

When we ran Excel anew, it started with a fresh Book1, to which we responded with much elation.

However, we didn’t just want to look at the new Book1, so we ventured into new territory; we actually tried a File|Open.

The result was not encouraging.
We got Msgboxes and one dialog window:

Message: Dial-up Networking : Cannot load dialog
Error 623: Cannot find the phonebook entry.

Dialog: Find Fast
(D) Update automatically 3/28/02
© Update automatically 3/28/02

Msgbox: Dr Watson for Windows NT
An application error has occurred and an error log is
being generated.

Such an abundance of information! And I haven’t got the slightest idea what all this means.

We are in need of an oracle.

Reply | Quote

Ken

OK there is something that is going on here, that is not of the ordinary. I would say now that it might be a virus.

This message seems like it is trying to instanciate MS-Outlook or something else. So I would now suggest that you run your virus detection software and see what that file you moved out of the XLSTART was all about. But before you panic, keep looking at the more obvious.

When you ventured into the XLStart did you find any other workbooks? It seems to me that Excel is trying to do something, and the only way it can do that is if you open a workbook that has an Auto_Open or an On Open event code, possibly the Personal.xls workbook has that code in it, or something else.

Once you have opened Excel, go to the Windows menu and see if the Unhide option is aviliable. If it is that means you have a hidden workbook open, most probably its the Personal.xls and unhide it.

Check if it has any code behind it, and to do that, while in Excel press Alt+F11 to bring up the Visual BASIC editor.

Good luck and DO not forget to run the anti-virus.

Wassim

Reply | Quote

Hi Wassim,

Thanks for reply!

Re: virus software. Not sure whether they have any. I have alerted our IS people.

There was one additional file in the XLstart folder: MScreate.dir. I have 112 instances of this file on my own pc and they are all zero byte files. So I told her to delete it.

We found no Personal.xls on C: or D: and the Windows|Unhide option was greyed out.

I am also suspecting a network problem. Maybe a dll is missing an we may need to re-install. Or perhaps
she lacks certain rights on D:.

I’ve asked the IS people to become involved now.

Thanks!!

Reply | Quote

Excel should not open .EML (email) files, period. One of the recent nasty viruses used a flaw in IE (MIME header vulnerability) to automatically download/open an EML file, which caused all sorts of havoc.

If the user does not have software, use the online scanner at http://housecall.antivirus.com/housecall/start_frame.asp%5B/url%5D.

Reply | Quote

Hi jscher,

re: One of the recent nasty viruses used a flaw in IE (MIME header vulnerability) to automatically download/open an EML file, which caused all sorts of havoc…..

Yup, PE NIMDA.A-O caused all the havoc. 285 corrupt files. Luckily, antivirus.com had a fix tool.

Back on track! Phew…

Reply | Quote