Excel virus gets antidote
Microsoft comes up with the antidote to a recently discovered macro virus that infects Excel spreadsheets.
The antivirus tool was first developed to combat a five-month-old virus known as Laroux. But it has been tested and proven to work in wiping out a mutant strain of the virus, which experts dubbed Laroux.B after it surfaced at two companies in the last couple of weeks, according to Tom Williams, Excel product manager. He said Microsoft has received no word of new cases of Laroux.B since CNET first reported the outbreak last week.
Macro viruses, which got their name because they are written with Microsoft's WordBasic and Visual Basic for Applications macro languages, have mostly afflicted Word documents that users commonly share with each other. Laroux was reportedly the first macro virus to affect Excel when it was discovered last July.
Yet this new breed of macro virus has caused some concern among businesspeople since Excel viruses could potentially corrupt important financial data.
That is not the case with either of the Laroux infections, though, experts said. The original Laroux merely spread from file to file without affecting data. Its offspring, Laroux.B, is more bothersome. It wipes out macro commands saved by users in a file called personal.XLS and replaces them with the word "Laroux."
"That can be a big problem for an accountant who has saved 50 or 60 macros" for frequent use on spreadsheet documents, according to Jonathan Wheat, the virus lab manager at the National Computer Security Association.
The organization--which researches, analyzes, and reports on viruses and other computer security issues for its membership of 30,000 developers, security experts, and end users--sent out a press release November 14 alerting Excel users of the threat.
Wheat said he has taken a look at two Laroux.B cases that were forwarded to him by antivirus software developers. The "specimens" came from two different oil companies operating in Saudi Arabia, an indication that the virus is now spreading from company to company. He added that the infection hides itself inside the Excel program so that some users may not know they have been infected, but he declined to estimate its potential impact.
"These two could be the only cases we see, or it could go crazy" with cases proliferating rapidly, Wheat said.
David Chess, a researcher at IBM's T.J. Watson Research Center, said he has seen one case firsthand and has heard two other reports from reliable sources since the end of October. But he stressed that Laroux.B "certainly is not a widespread virus."
While spreadsheets seemed immune from computer viruses until earlier this year, Sarah Gordon, a researcher with Command Software Systems, a maker of antivirus software, said there is concern that infections could alter important financial information.
While Laroux and Laroux.B do not alter the content of spreadsheets, Gordon said "viruses that infect spreadsheets can [potentially] affect the integrity of the data."
She called the original virus and its offspring "rather unremarkable" but noted that even the most benign viruses take their toll on IS departments. "While they have no destructive payload, they cost you time, money, and effort."
NCSA's Wheat suggests Excel users should back up their macros just in case the virus finds its way into their programs.
Experts said they can usually come up with antidotes for most viruses within a day; several server-based approaches to ensure network-wide protection are also being developed by antivirus software vendors.
IBM's Chess said his company is working on an "immune system" to protect programs from infection before they come down with the rapidly proliferating viruses.
In addition to working with the NCSA and antivirus software vendors, Microsoft will incorporate tools to detect and delete viruses in Excel 97, due by year's end. Antivirus tools are already available in the most recent versions of Word.