XL: How to Identify and Remove PLDT (Laroux) Macro Virus

• Microsoft Excel for Windows, versions 5.0, 5.0c
• Microsoft Excel for Windows 95, versions 7.0, 7.0a
• Microsoft Excel 97 for Windows

SUMMARY

In November 1997, Microsoft identified a new macro virus that infects workbooks in Microsoft Excel for Windows called the PLDT macro virus, also known as PLDT97 or Laroux E.

This article contains information about this macro virus, including how to tell when your workbooks have been infected and how to remove the macro virus from your workbooks.

MORE INFORMATION

General Information About Macro Viruses

The PLDT macro virus is a strain of the Laroux macro virus, which was first identified in July 1996. For more information about the Laroux macro virus, please see the following articles in the Microsoft Knowledge Base:

   ARTICLE-ID: Q154131
   TITLE     : XL: Q&A About Excel Macro/Laroux Macro Virus

   ARTICLE-ID: Q150990
   TITLE     : WE1280: Virus Search Add-in

Detecting and Removing the PLDT Macro Virus

If the PLDT macro virus has infected any of your workbooks, the workbook Pldt.xls will be found in one of the following folders on your computer:

   C:\Excel\Xlstart

   C:\Program Files\Microsoft Office\Office\Xlstart

To remove the PLDT macro virus from your workbooks, perform the following steps:

In Microsoft Excel 97

1. On the Tools menu, click Options. Click the General tab. Click the Macro Virus Protection checkbox, and then click OK.

2. Quit Microsoft Excel 97.

3. Using Windows Explorer, go to the C:\Program Files\Microsoft Office\Office\Xlstart folder. Select the file Pldt.xls. On the File menu, click Delete. Click Yes if you are asked if you want to move the file to the Recycle Bin.

4. Start Microsoft Excel 97.

5. Open a workbook that you believe to be infected with the PLDT macro virus. If you receive the following message:

   The workbook you are opening contains macros. Some macros may contain viruses that could be harmful to your computer.

   If you are sure this workbook is from a trusted source, click 'Enable Macros'. If you are not sure and want to prevent any macros from running, click 'Disable Macros'.

   click Disable Macros.

6. On the Tools menu, point to Macro, and then click Visual Basic Editor.

7. Click Project Explorer on the View menu to make sure the Project Window is visible.

8. In the Project window, click the plus sign (+) to the left of the word Modules below the name of the workbook you just opened.

   If a module named "pldt" is listed, right-click the module name. On the shortcut menu, click "Remove pldt." Click No when you are asked if you want to export the module.

9. On the File menu, click "Close and Return to Microsoft Excel."

10. On the File menu, click Save. On the File menu, click Close.

11. Repeat steps 5-10 for all workbooks that you believe to be infected with the PLDT macro virus.

    Also, if any other workbooks, such as Personal.xls, are listed in the Project window in the Visual Basic Editor, click the plus sign to the left of the word Modules below each workbook's name. If any modules named "pldt" are displayed, right-click the module name, and then click "Remove pldt" on the shortcut menu.

NOTE: If you have exchanged workbooks with anyone else, you should alert them to the possibility that their workbooks may also be infected by the PLDT macro virus.

In Microsoft Excel 5.0 or 7.0

1. Quit Microsoft Excel.

2. Using Windows Explorer, go to the Xlstart folder for your version of Microsoft Excel. Select the file Pldt.xls, and click Delete on the File menu. Click Yes if you are asked if you want to move the file to the Recycle Bin.

3. Start Microsoft Excel.

4. Open a workbook that you believe to be infected with the PLDT macro virus. As you open the workbook, hold down the SHIFT key; this will prevent any Auto_Open macros in the workbook from running.

5. On the Format menu, point to Sheet, and click Unhide. If "pldt" is listed in the Unhide Sheet list box, select it, and then click OK.

6. On the Edit menu, click Delete Sheet. Click OK to permanently delete the sheet.

7. On the File menu, click Save. On the File menu, click Close.

8. Repeat steps 4-7 for all workbooks that you believe to be infected with the PLDT macro virus.

   Also, if you have a personal macro workbook (Personal.xls), you may need to unhide it (on the Window menu, click Unhide), perform steps 5 and 6, and then rehide the personal macro workbook (on the Window menu, click Hide). When you quit Microsoft Excel, click Yes to save changes to the personal macro workbook.

NOTE: If you have exchanged workbooks with anyone else, you should alert them to the possibility that their workbooks may also be infected by the PLDT macro virus.

Using Third-party Anti-virus Software to Remove Macro Viruses

Some third-party anti-virus programs have developed updated signature files that allow you to detect and remove macro viruses such as the PLDT macro virus. For information about updated signature files, check the Web site of the company that developed your anti-virus program.

The following are Web addresses for some commonly-used anti-virus programs:

   Program             Web Address
   ----------------------------------------------------------

   Norton AntiVirus    http://www.symantec.com/nav/
   McAfee VirusScan    http://www.mcafee.com/down/upgrade.asp
   F-Prot              http://www.datafellows.com/f-prot/
   Cheyenne InocuLAN   http://www.cheyenne.com/virusinfo/