This document describes the XLSFIX.EXE file, which should be used for
correcting problems in EXCEL files introduced during the process of 
removing EXCEL macro viruses. Please use this utility with care and
only if you need it.


Problems addressed by this utility:

A. After cleaning EXCEL is no longer able to load the cleaned document
   with message "Module not found" or "No read access"
   
B. Cleaned EXCEL spreadsheets would not load in EXCEL after they have been
   edited the first time after the cleaning.



============




A. After cleaning EXCEL is no longer able to load the cleaned document
   with message "Module not found" or "No read access"


Removing a macro virus from an EXCEL document is a complex task, which 
involves not only proper identification and removal of the viral macro 
code, but also readjustment of references inside the EXCEL spreadsheet
so that EXCEL no longer expects to find the viral macros when opening
the cleaned file. 

If some of the references to the viral macro code are not removed from
an infected spreadsheet at the time it was cleaned, EXCEL will fail to
load that spreadsheet with a message "Module not found". 

XLSFIX.EXE is able to locate and correct this problem in most cases when
the problem was introduced during virus removal. 

==




B. Cleaned EXCEL spreadsheets would not load in EXCEL after they have been
   edited the first time after the cleaning.


When the Laroux virus infects EXCEL spreadsheets it inserts an extra 
hidden sheet named laroux before all existing sheets in the target 
document. This makes all the existing sheets shift one position.  This 
shift forces EXCEL to recalculate all formulas 

Unfortunately although EXCEL keeps track of the names of the sheets being 
used in formulas, when calculating the formulas, EXCEL uses the absolute 
number of each referenced sheet rather than the name of the sheet. 

Therefore when VirusScan removes the Laroux virus, including its hidden 
sheet, the cross references are left out of alignment due to the infection.  
This causes formulas referencing elements in other sheets to fail or work 
incorrectly. 

This problem has been addressed in the current beta version of VirusScan 
for DOS (beta 3.03 v3007 7/14/97) available at http://beta.mcafee.com in 
the hourly build section and will be addressed in all version of VirusScan 
in their next releases.

Users experiencing this problem can use the attached tool until they are 
able to upgrade their product. 

This tool, however, will not be effective in cases when the spreadsheet is 
disinfected by VirusScan, and has been modified by the user in EXCEL 
releases 5.0 through 7.0. 

Symptom indicating such a case are as follows: 

a) A Laroux infected spreadsheet is being cleaned with VirusScan
b) The already clean spreadsheet is loaded in Excel 95 and saved with  
   or without any modifications
c) The Next time EXCEL 95 tries to load the same spreadsheet it        
   generates an error and exits - the spreadsheet can no longer be     
   loaded in EXCEL versions prior to Excel 97.

For those cases the user is advised to follow these few steps:

1. Open spreadsheet in Excel 97
2. Save spreadsheet in Excel 95 compatible format
3. Open spreadsheet in Excel 95, verify and correct all formulas 4. 
   Save spreadsheet 
   
==


If you have any questions or concerns regarding this issue, please feel 
free to contact me via email at virus_research@cc.mcafee.com or by direct 
phone at 408.653.3096.


