Results 1 to 7 of 7
  1. #1
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Winnipeg, Canada
    Posts
    109
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Excel Macro Virus? (Excel 2000)

    When a colleague of mine starts her Excel, instead of opening up with a blank "Book 1", it automatically loads a workbook called "freshmen 3.eml". The workbook contains only one sheet (freshmen 3) and neither the sheet nor the workbook contain any vba code (as far as I can tell).

    I have searched her pc for a file called freshmen_3.eml but found nothing. I am wondering if anybody has seen this before and can provide some info.

    How can I prevent Excel from loading this file? Personal.xls does not load so I am not suspecting it.

    Thanks for help <img src=/S/grin.gif border=0 alt=grin width=15 height=15>

  2. #2
    Bronze Lounger
    Join Date
    Jun 2001
    Location
    New York, New York, Lebanon
    Posts
    1,449
    Thanks
    1
    Thanked 1 Time in 1 Post

    Re: Excel Macro Virus? (Excel 2000)

    <img src=/S/hello.gif border=0 alt=hello width=25 height=29> kmedgyes

    This might not be a virus at all.

    You see Excel can start with a bunch of workbooks that the user likes all automatically. If you place anything in the XLSTART folder the Excel will start that workbook for you.

    To look for this "file" you need to search all her drives, network drives and local, because the XLSTART folder may be on a network drive, I think. Once you located this "file" move it out of where it is.

    Also it maybe a hyper link that your Perosnal.xls is calling so test the first option and report back for more information.

    Wassim <img src=/S/compute.gif border=0 alt=compute width=40 height=20>
    <img src=/S/compute.gif border=0 alt=compute width=40 height=20> in the <img src=/S/bagged.gif border=0 alt=bagged width=22 height=22>

  3. #3
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Winnipeg, Canada
    Posts
    109
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Excel Macro Virus? (Excel 2000)

    Hi Wassim,

    As you suggested, we found the eml file in the XLstartup file on the D: drive and deleted it.

    When we ran Excel anew, it started with a fresh Book1, to which we responded with much elation. <img src=/S/bravo.gif border=0 alt=bravo width=16 height=30>

    However, we didn't just want to look at the new Book1, so we ventured into new territory; we actually tried a File|Open.

    The result was not encouraging. <img src=/S/bummer.gif border=0 alt=bummer width=15 height=15>
    We got Msgboxes and one dialog window:

    Message: Dial-up Networking : Cannot load dialog
    Error 623: Cannot find the phonebook entry. <img src=/S/confused.gif border=0 alt=confused width=15 height=20>

    Dialog: Find Fast
    (D) Update automatically 3/28/02
    Update automatically 3/28/02

    Msgbox: Dr Watson for Windows NT
    An application error has occurred and an error log is
    being generated.

    Such an abundance of information! And I haven't got the slightest idea what all this means.

    We are in need of an oracle. <img src=/S/dizzy.gif border=0 alt=dizzy width=15 height=15>

  4. #4
    Bronze Lounger
    Join Date
    Jun 2001
    Location
    New York, New York, Lebanon
    Posts
    1,449
    Thanks
    1
    Thanked 1 Time in 1 Post

    Re: Excel Macro Virus? (Excel 2000)

    <img src=/S/hello.gif border=0 alt=hello width=25 height=29> Ken

    OK there is something that is going on here, that is not of the ordinary. I would say now that it might be a virus.

    This message seems like it is trying to instanciate MS-Outlook or something else. So I would now suggest that you run your virus detection software and see what that file you moved out of the XLSTART was all about. But before you panic, keep looking at the more obvious.

    When you ventured into the XLStart did you find any other workbooks? It seems to me that Excel is trying to do something, and the only way it can do that is if you open a workbook that has an Auto_Open or an On Open event code, possibly the Personal.xls workbook has that code in it, or something else.

    Once you have opened Excel, go to the Windows menu and see if the Unhide option is aviliable. If it is that means you have a hidden workbook open, most probably its the Personal.xls and unhide it.

    Check if it has any code behind it, and to do that, while in Excel press Alt+F11 to bring up the Visual BASIC editor.

    Good luck and DO not forget to run the anti-virus.

    Wassim <img src=/S/compute.gif border=0 alt=compute width=40 height=20>
    <img src=/S/compute.gif border=0 alt=compute width=40 height=20> in the <img src=/S/bagged.gif border=0 alt=bagged width=22 height=22>

  5. #5
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Winnipeg, Canada
    Posts
    109
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Excel Macro Virus? (Excel 2000)

    Hi Wassim,

    Thanks for reply!

    Re: virus software. Not sure whether they have any. I have alerted our IS people.

    There was one additional file in the XLstart folder: MScreate.dir. I have 112 instances of this file on my own pc and they are all zero byte files. So I told her to delete it.

    We found no Personal.xls on C: or D: and the Windows|Unhide option was greyed out.

    I am also suspecting a network problem. Maybe a dll is missing an we may need to re-install. Or perhaps
    she lacks certain rights on D:.

    I've asked the IS people to become involved now.

    Thanks!!

  6. #6
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: Excel Macro Virus? (Excel 2000)

    Excel should not open .EML (email) files, period. One of the recent nasty viruses used a flaw in IE (MIME header vulnerability) to automatically download/open an EML file, which caused all sorts of havoc.

    If the user does not have software, use the online scanner at http://housecall.antivirus.com/house...tart_frame.asp.

  7. #7
    2 Star Lounger
    Join Date
    Jan 2001
    Location
    Winnipeg, Canada
    Posts
    109
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Excel Macro Virus? (Excel 2000)

    Hi jscher,

    re: One of the recent nasty viruses used a flaw in IE (MIME header vulnerability) to automatically download/open an EML file, which caused all sorts of havoc.....

    Yup, PE NIMDA.A-O caused all the havoc. 285 corrupt files. Luckily, antivirus.com had a fix tool.

    Back on track! Phew...

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •