Description

     CHKEXCEL.BAT:

       Runs Dr Solomon's FindVirus with appropriate parameters to
       scan for the new Excel macro virus, XM.Laroux


Virus Description

     XM.Laroux (an eXcel Macro virus) is the first macro virus for Microsoft
     Excel which actually works. The virus intercepts Excel's Auto_Open
     automacro.  When an infected spreadsheet is opened, the virus
     activates and checks whether the system is already infected. If not,
     the virus creates an Excel file named PERSONAL.XLS in the Excel
     default startup directory XLSTART (e.g. C:\MSOFFICE\EXCEL\XLSTART)
     and copies itself there. The spreadsheets and macros from that
     directory are automatically loaded whenever Excel is run. From then
     on, every spreadsheet being opened or created on an infected system
     will become infected with the virus.

     XM.Laroux does not have any intentional payload - it just replicates. 
     The virus works under Excel versions 5 and 7, running under Windows 
     3.x, Windows 95 and Windows NT.  It does not work on Apple Macintosh.

     Infected spreadsheets contain a hidded sheet named 'laroux'. Here is a 
     *fast* check to tell whether you have the virus:

        in Excel, go to Tools/Macro . If you see the macros
        'auto_open' and 'check_files' and/or 'personal.xls!auto_open'
        and 'personal.xls!check_files' - your system is infected.  You
        can use Tools/Macro/Delete to get rid of it.

     IMPORTANT: So far there have been only two cases of the virus
     reported, both within the same company although on different
     continents (one in Africa, another in Alaska).  This virus is
     not currently considered to be widespread.

     There is an extra driver (LAROUX.DRV) for Dr Solomon's FindVirus
     available which should detect infected Excel files when used with the
     following syntax:

         FINDVIRU /EXTRA=LAROUX.DRV /DOALLFILES

     Because Dr Solomon's FindVirus does not scan .XLS files by default,
     the /DOALLFILES command-line switch is required.  This extra driver
     can be used by Dr Solomon's FindVirus for DOS, Windows 3.x, Windows 95,
     Windows NT, OS/2, Novell NetWare, and SCO UNIX.

     Please note: You will need FindVirus v7.60 or later.

     It will also work with Dr Solomon's WinGuard for Windows 3.x,
     Windows 95, and Windows NT providing on-access virus protection.
     Again, WinGuard will need to be configured to 'check all files'
     in order to intercept .XLS files.

     Please note: You will need WinGuard v7.60 or later.
     
     Dr Solomon's FindVirus cannot currently repair infected files.
     Any infected files can be repaired manually by deleting the macros
     mentioned above via the Tools/Macro/Delete menu command.

     Copyright (c) 1996 S&S International -
     developers of Dr Solomon's Anti-Virus Toolkit
