Check your Excel files, too ....

We kept warning people, and nobody believed us until the Word macro 
viruses hit.  (I suspect people *still* don''t believe us.  Or, possibly, 
don't understand what is going on.  However ...)  For much the same 
reasons, it is possible to write viruses for Excel, Access and other 
applications with a significant macro language behind them.  Excel has 
now followed Word in having a macro virus that has been found "in the wild".

It isn't a serious threat at present.  The macro viruses can cross 
computer platforms, but they are platform dependent in that they require 
the parent application in order to function.  Fewer people use Excel than 
use Word, so Excel macro viruses have a lower "carrier" density, and 
therefore less chance of spread.

The following is information provided by S&S International, makers of 
"Dr. Solomon's Anti-Virus Toolkit":


Dr. Solomon's Excel virus information: XM.Laroux

XM.Laroux (an Excel Macro virus) is the first macro virus for
Microsoft Excel which actually works. The virus intercepts Excel's
Auto_Open automacro.  When an infected spreadsheet is opened, the
virus activates and checks whether the system is already infected. If
not, the virus creates an Excel file named PERSONAL.XLS in the Excel
default startup directory XLSTART (e.g. C:\MSOFFICE\EXCEL\XLSTART) 
and copies itself there. The spreadsheets and macros from that directory
are automatically loaded whenever Excel is run. From then on, every
spreadsheet being opened or created on an infected system will become
infected with the virus.

XM.Laroux does not have any intentional payload - it just replicates.
The virus works under Excel versions 5 and 7, running under Windows
3.x, Windows 95 and Windows NT.  It does not work on Apple Macintosh.

Infected spreadsheets contain a hidden sheet named 'laroux'. Here is a
*fast* check to tell whether you have the virus:

   in Excel, go to Tools/Macro . If you see the macros
   'auto_open' and 'check_files' and/or 'personal.xls!auto_open'
   and 'personal.xls!check_files' - your system is infected.  You can
   use Tools/Macro/Delete to get rid of it.

IMPORTANT: So far there have been only two cases of the virus
reported, both within the same company although on different
continents (one in Africa, another in Alaska).  This virus is not
currently considered to be widespread.