Microsoft KB Archive/213512

= HOW TO: Identify and Remove PLDT, CAR, and SGV Macro Viruses in Excel 2000 =

Article ID: 213512

Article Last Modified on 1/27/2005

-

APPLIES TO


 * Microsoft Excel 2000 Standard Edition

-



This article was previously published under Q213512



For a Microsoft Excel 97 and earlier version of this article, see 176807.

IN THIS TASK
SUMMARY
 * General Information About Macro Viruses
 * How to Detect the PLDT, CAR, and SGV Macro Viruses
 * How to Remove the PLDT, CAR, and SGV Macro Viruses
 * Using Third-party Antivirus Software to Remove Macro Viruses



SUMMARY
This step-by-step article shows you how to identify and remove PLDT, CAR, and SGV macro viruses in Excel 2000.

In November 1997, Microsoft identified a new macro virus, the PLDT macro virus, that infects workbooks in Microsoft Excel for Windows. This macro virus is also known as PLDT97 or Laroux E.

In April 1998, Microsoft identified another new macro virus, the CAR macro virus. And, in June 1998, Microsoft identified yet another new macro virus, the SGV macro virus.

This article contains information about these macro viruses, including how to tell when your workbooks have been infected and how to remove the macro viruses from your workbooks.

back to the top

General Information About Macro Viruses
The PLDT, CAR, and SGV macro viruses are strains of the Laroux macro virus, which was first identified in July 1996.

For additional information about macro viruses, click the article number below to view the article in the Microsoft Knowledge Base:

263188 XL2000: Q&A About Excel Macro/Laroux Macro Virus

back to the top

How to Detect the PLDT, CAR, and SGV Macro Viruses
 If the PLDT macro virus has infected any of your workbooks, the workbook Pldt.xls file or the Results.xls file is in one of the following folders on your computer:

 C:\Excel\Xlstart C:\Program Files\Microsoft Office\Office\Xlstart

Also, any workbooks that are infected by the macro virus contain a Visual Basic module called "pldt".

 If the CAR macro virus has infected any of your workbooks, the workbook Car.xls is in one of the following folders on your computer:

 C:\Excel\Xlstart</li> C:\Program Files\Microsoft Office\Office\Xlstart</li></ul>

Also, any workbooks that are infected by the macro virus will contain a Visual Basic module called "car".</li></ul>

 If the SGV macro virus has infected any of your workbooks, the workbook Sgv.xls will be found in one of the following folders on your computer:

 

</li> C:\Excel\Xlstart</li> C:\Program Files\Microsoft Office\Office\Xlstart</li></ul>

Also, any workbooks that are infected by the macro virus will contain a Visual Basic module called "sgv".</li></ul>

back to the top

How to Remove the PLDT, CAR, and SGV Macro Viruses
To remove the PLDT, CAR, and SGV macro viruses from your workbooks, follow these steps: <ol> On the Tools menu, point to Macro and click Security. Click the Security Level tab. Click Medium, and then click OK.</li> Quit Excel.</li> In Windows Explorer, go to all of the XLSTART folders listed previously, and then follow these steps.

<ol style="list-style-type: lower-alpha;"> If the Pldt.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.</li> If the Car.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.</li> If the Sgv.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.</li></ol> </li> Start Microsoft Excel.</li> Open a workbook that you believe to be infected with the PLDT, CAR, or SGV macro virus.

If you receive the following message

contains macros.

Macros may contain viruses. It is always safe to disable macros, but if the macros are legitimate, you might lose some functionality.

click Disable Macros.</li> <li>On the Tools menu, point to Macro, and then click Visual Basic Editor.</li> <li>Click Project Explorer on the View menu to make sure the Project window is visible.</li> <li>In the Project window, click the plus sign (+) to the left of the word "Modules" below the name of the workbook you just opened.

If a module named "pldt", "car", or "sgv" is listed, right-click the module name. On the shortcut menu, click Remove . Click No when you are asked whether to export the module.</li> <li>On the File menu, click Close and Return to Microsoft Excel.</li> <li>On the Format menu, click Style.</li> <li>In the Style name list, look for styles whose names contain "pldt", "car", "sgv", or "laroux". If you see such a style listed, select it and then click Delete. Repeat this step until no more styles such as these remain.</li> <li>On the File menu, click Save. On the File menu, click Close.</li> <li>Repeat steps 5 through 12 for all workbooks that you think are infected with the PLDT, CAR, or SGV macro virus.

Also, if any other workbooks, such as Personal.xls, are listed in the Project window in the Visual Basic Editor, click the plus sign to the left of the word Modules below each workbook's name. If any modules named "pldt", "car", or "sgv" are displayed, right-click the module name, and then click Remove  on the shortcut menu.</li></ol>

Until you are absolutely certain that the PLDT, CAR, and SGV macro viruses have been completely removed from your computer, click Disable Macros every time that you open a workbook. If you open a workbook that contains the PLDT, CAR, or SGV macro virus and click Enable Macros, the macro virus will begin to infect your workbooks again.

NOTE: If you have exchanged workbooks with anyone else, you should alert them to the possibility that their workbooks may also be infected by the PLDT, CAR, or SGV macro virus.

back to the top

How to Use Third-party Antivirus Software to Remove Macro Viruses
Some third-party antivirus programs have developed updated signature files that allow you to detect and remove macro viruses such as the PLDT, CAR, and SGV macro viruses. For information about updated signature files, check the Web site of the company that developed your antivirus program.

The following are Web addresses for some commonly used antivirus programs.

<pre class="fixed_text">  Program             Web Address --  Norton AntiVirus    http://www.symantec.com/nav/ McAfee VirusScan   http://www.mcafee.com/down/upgrade.asp F-Prot             http://www.datafellows.com/ Cheyenne InocuLAN  http://www.cheyenne.com/virusinfo/ Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

For information about how to contact these companies, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:

65416 Hardware and Software Third-Party Vendor Contact List, A-K

60781 Hardware and Software Third-Party Vendor Contact List, L-P

60782 Hardware and Software Third-Party Vendor Contact List, Q-Z

back to the top

Additional query words: laroux.e pldt.xls car.xls cecilia sgv.xls XL2000

Keywords: kbhowtomaster KB213512

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.