Article ID: 213512
Article Last Modified on 1/27/2005
APPLIES TO
- Microsoft Excel 2000 Standard Edition
This article was previously published under Q213512
For a Microsoft Excel 97 and earlier version of this article, see 176807.
IN THIS TASK
- General Information About Macro Viruses
- How to Detect the PLDT, CAR, and SGV Macro Viruses
- How to Remove the PLDT, CAR, and SGV Macro Viruses
- Using Third-party Antivirus Software to Remove Macro Viruses
SUMMARY
This step-by-step article shows you how to identify and remove PLDT, CAR, and SGV macro viruses in Excel 2000.
In November 1997, Microsoft identified a new macro virus, the PLDT macro virus, that infects workbooks in Microsoft Excel for Windows. This macro virus is also known as PLDT97 or Laroux E.
In April 1998, Microsoft identified another new macro virus, the CAR macro virus. And, in June 1998, Microsoft identified yet another new macro virus, the SGV macro virus.
This article contains information about these macro viruses, including how to tell when your workbooks have been infected and how to remove the macro viruses from your workbooks.
back to the top
General Information About Macro Viruses
The PLDT, CAR, and SGV macro viruses are strains of the Laroux macro virus, which was first identified in July 1996.
For additional information about macro viruses, click the article number below to view the article in the Microsoft Knowledge Base:
263188 XL2000: Q&A About Excel Macro/Laroux Macro Virus
How to Detect the PLDT, CAR, and SGV Macro Viruses
- If the PLDT macro virus has infected any of your workbooks, the workbook Pldt.xls file or the Results.xls file is in one of the following folders on your computer:
- C:\Excel\Xlstart
- C:\Program Files\Microsoft Office\Office\Xlstart
- If the CAR macro virus has infected any of your workbooks, the workbook Car.xls is in one of the following folders on your computer:
- C:\Excel\Xlstart
- C:\Program Files\Microsoft Office\Office\Xlstart
- If the SGV macro virus has infected any of your workbooks, the workbook Sgv.xls will be found in one of the following folders on your computer:
- C:\Excel\Xlstart
- C:\Program Files\Microsoft Office\Office\Xlstart
How to Remove the PLDT, CAR, and SGV Macro Viruses
To remove the PLDT, CAR, and SGV macro viruses from your workbooks, follow these steps:
- On the Tools menu, point to Macro and click Security. Click the Security Level tab. Click Medium, and then click OK.
- Quit Excel.
- In Windows Explorer, go to all of the XLSTART folders listed previously, and then follow these steps.
- If the Pldt.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.
- If the Car.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.
- If the Sgv.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.
- Start Microsoft Excel.
- Open a workbook that you believe to be infected with the PLDT, CAR, or SGV macro virus.
If you receive the following message click Disable Macros. - On the Tools menu, point to Macro, and then click Visual Basic Editor.
- Click Project Explorer on the View menu to make sure the Project window is visible.
- In the Project window, click the plus sign (+) to the left of the word "Modules" below the name of the workbook you just opened.
If a module named "pldt", "car", or "sgv" is listed, right-click the module name. On the shortcut menu, click Removemodule. Click No when you are asked whether to export the module. - On the File menu, click Close and Return to Microsoft Excel.
- On the Format menu, click Style.
- In the Style name list, look for styles whose names contain "pldt", "car", "sgv", or "laroux". If you see such a style listed, select it and then click Delete. Repeat this step until no more styles such as these remain.
- On the File menu, click Save. On the File menu, click Close.
- Repeat steps 5 through 12 for all workbooks that you think are infected with the PLDT, CAR, or SGV macro virus.
Also, if any other workbooks, such as Personal.xls, are listed in the Project window in the Visual Basic Editor, click the plus sign to the left of the word Modules below each workbook's name. If any modules named "pldt", "car", or "sgv" are displayed, right-click the module name, and then click Removemoduleon the shortcut menu.
Until you are absolutely certain that the PLDT, CAR, and SGV macro viruses have been completely removed from your computer, click Disable Macros every time that you open a workbook. If you open a workbook that contains the PLDT, CAR, or SGV macro virus and click Enable Macros, the macro virus will begin to infect your workbooks again.
NOTE: If you have exchanged workbooks with anyone else, you should alert them to the possibility that their workbooks may also be infected by the PLDT, CAR, or SGV macro virus.
back to the top
How to Use Third-party Antivirus Software to Remove Macro Viruses
Some third-party antivirus programs have developed updated signature files that allow you to detect and remove macro viruses such as the PLDT, CAR, and SGV macro viruses. For information about updated signature files, check the Web site of the company that developed your antivirus program.
The following are Web addresses for some commonly used antivirus programs.
Program Web Address ---------------------------------------------------------- Norton AntiVirus http://www.symantec.com/nav/ McAfee VirusScan http://www.mcafee.com/down/upgrade.asp F-Prot http://www.datafellows.com/ Cheyenne InocuLAN http://www.cheyenne.com/virusinfo/
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
For information about how to contact these companies, click the appropriate article number in the following list to view the article in the Microsoft Knowledge Base:
Additional query words: laroux.e pldt.xls car.xls cecilia sgv.xls XL2000
Keywords: kbhowtomaster KB213512
