Reference number: CH000105

Information on Excel/Laroux virus.

Issue:

Information on Excel/Laroux virus.

Solution:

Excel Macro/Laroux consists of two macros, auto_open and check_files.

The auto_open macro executes whenever an infected Spreadsheet is opened, followed by the check_files macro that determines the startup path of Excel. If there is no file named PERSONAL.XLS in the startup path, the virus creates one. This file contains a module called "Laroux".

PERSONAL.XLS is the default filename for any macros recorded under Excel. Thus, you might have PERSONAL.XLS on your system even though you are not infected by this virus. The startup path is by default set as \MSOffice\EXCEL\XLSTART, but it can be changed from Excel's Tools/Options/General/Alternate Startup File menu option.

If an infected workbook resides on a write-protected floppy, an error will occur when Excel tries to open it and the virus will not be able to replicate. Excel Macro/Laroux is not intentionally destructive and contains no payload; it just replicates, so most likely will not harm Office97.