Stiller Research Report on the Excel Macro Virus

Laroux was discovered July of 1996. This is the first working macro
virus to infect MicroSoft Excel spreadsheets (*.XLS files).  It follows
in the footsteps of the viruses that infect Microsoft Word
documents/templates. We anticipated the appearance of such a virus since
Excel uses a macro language (Visual Basic for Applications) very similar
to that used by the Microsoft Word product. Just as is the case with
Microsoft Word macro viruses, this virus is only a threat to users of
Microsoft Excel (version 5 or later) product. Several anti-virus companies have released
press-releases raising alarm over this "new threat".  There is no reason
for alarm; Laroux is easily detected, not destructive, and it is not
receiving the massive distribution that Concept (the first Word Macro
virus received.)


ALSO A THREAT TO APPLE COMPUTERS

According to our tests, Laroux will not replicate on the Apple Macintosh
version of Excel. Unfortunately, we expect that just as Word Macro
viruses pose a threat to any user of the Word product, Excel macro
viruses will potentially (if carefully written) be able to infect any
computer that uses MS Excel.  Since there is
also a version of MS Excel for Apple Macintosh computers as well as PCs,
this virus will spread to (or from) a Macintosh if an infected
spreadsheet is exchanged.


ANOTHER RULE BREAKING VIRUS?

If you take a quick look at Laroux, it seems to break the rules for
viruses. Laroux infects MS Excel spreadsheets.  Simply opening an
infected spreadsheet causes the virus to infect your PC.  This is
possible because Excel Spreadsheets can contain macros (essentially
programs imbedded in the spreadsheet) that are automatically executed
when certain events occur (such as the opening of a spreadsheet).  This
allows the same techniques to be used with Excel spreadsheets that
virus writers have been using with MS Word.  Since both MS Word and
Excel support a macro programming language based on BASIC (a very
simple language) it is easy for novice programmers to write or modify
these viruses.

Laroux consists of two macros (auto_open and check_files) inside Excel
spreadsheets (*.XLS files).  When you receive an infected spreadsheet
and open it, the portion of the virus in the auto_open macro executes.
If Laroux is not already present, it installs itself in file
PERSONAL.XLS in the Excel startup directory, XLSTART (e.g.,
C:\MSOFFICE\EXCEL\XLSTART). By placing itself in the XLSTART
subdirectory, Laroux makes sure that it executes each time Excel is
started.  This allows the virus to be present and infect any
spreadsheets opened from this point forward.


HOW SERIOUS IS THIS THREAT?

Unless you use Microsoft Excel and share spreadsheets this new type of
virus poses no threat to your PC.  Laroux does not have a destructive
payload.  Since spreadsheets are not shared to the extent that Microsoft
Word document are, there is less risk of this type of virus spreading
widely.  Still, we expect to see a large number of Excel macro based
viruses, These viruses will make a lot of work for anti-virus vendors
since even unskilled programmers can quickly write or modify this type
of virus.

Laroux will not replicate on the few non-English language versions of
Excel that have been tested, so this minimizes its threat somewhat
on a world-wide basis.  This probably won't be true for future Excel
viruses since there's no reason these viruses can't be written to
execute non-English versions of Excel or written for a specific non-English
release of Excel.  We have seen the same thing happen for Microsoft
Word macro viruses. The original virus, Concept, was also limited to
English language versions but later viruses did not have this limitation.

When Concept (the first Microsoft Word macro based virus) was released,
it achieved wide distribution on CDs. This created a huge problem very
quickly.  As of July 30, 1996, there are only two reported companies
infected by this virus; these companies are related.  As a result, we
do not expect the type of rapid spread for Laroux in specific or Excel
macro viruses in general.


EASY VIRUS CHECK AND REMOVAL

It's fortunately easy to check for and remove the Laroux virus. Start
Excel and click on Tools then Macro.  Check the existing macros. If
Laroux is present you will see "auto_open" and "check_files" (e.g.,
"personal.xls!auto_open" and "personal.xls!check_files").  Use the
Delete command on the Tools menu to delete these macros to remove this
virus.

Future Excel viruses will probably not be so easy to detect and remove
but for now you can take the following steps to make sure you
are safe from Excel macro viruses:

1) Scan any new spreadsheets before loading them. Integrity Master and other
   products will be updated to recognize the new Excel macro viruses as
   they appear.

   Integrity Master already checks OLE/2 files (this is the type of file
   used to store Excel spreadsheets).  If you are using the 2.60c or
   later release of Integrity Master, run SetupIM and under "Advanced
   Options" set "Check all files for Macros" to "On" or add "*.XL?" to
   the list of executable programs.

2) Be aware of what macros are legitimately used by your spreadsheets so
   you can recognize a new one planted by a virus.

3) Keep an eye on your XLSTART directory and beware of any new files
   placed in that directory.


                                  # # #

