RMVclean Virus Remover      Version 5.08.21     last updated August 21, 2000

Disclosure
==========
This Excel95/97 "add-in" utility program has not been approved by Quality Assurance. It has been designed to help you address various issues and should be used as recommended by your AVERT representative.

Overview
========
RMVclean.XLS is a utility to clean Excel95/97 workbooks of the following viruses-
XM/Laroux (includes .ic variant which password protects workbooks!)
X97M/Laroux
X97M/Jerk
X97M/Tristate
XF/Paix.a
XF/Sic.a

RMVclean can clear invalid sheets in Excel95/97 workbooks which were previously cleaned of a virus by VirusScan 3x product. RMVclean can remove the parasitic effects of the XF/Sugar.d virus, which appends code to Excel97 workbook modules.
RMVclean now removes excessive styles automatically, reducing the size of the workbook tremendously.

RMVclean.xls replaces the utility previously known as RMVPAIX.XLS.

Issues addressed by the utility
===============================
- removes "pldt" module left after cleaning by older scan engines
- removes multiple sheets with "**" in the name
- show hidden sheets in workbook using "zShow_hiddensheets" (run manually)
- version information is in dialog boxes displayed or "zHelp_about" macro
- GENERIC detection of potential virus macro modules
- if GENERIC detection of virus, code module exoprted to file "CODE_RMV.BAS" and suggestive message to user to send copy of file to "virus_research@nai.com" for analysis

- removes styles using "zCheck_styles" macro (run automatically)
- removes XF/SIC.A infections on access
- removes XM/LAROUX infections on access
- removes XM/EXTRAS infections on access
- removes X97M/Jerk infections on access
- removes X97M/Tristate infections on access
- removes XF/PAIX.A infections on access 
- removes leftover "define names" from XF/SIC.A virus cleanings by AV products
- remove the parasitic effects of the XF/Sugar.d virus, which appends code to Excel97 workbook modules
- removes known infected workbooks from XLSTART folder
- scans worksheet class properties for virus content
- virus module exported to file "CODE_RMV.BAS"

*NEW since v4.11.18*
====================
- added removal for X97M/Jini.a1 on access



Prerequisites for running Program
=================================
This utility was designed originally to remove the XF/PAIX.A virus from files. It has also been modified and upgraded to remove additional viruses and remnants of viruses from workbooks through time and evolution of this utility.

Before using this utility, it is recommended that VirusScan v4.0.70 with current .DAT files be used to identify and clean viruses on your system(s). In the event you do not have VirusScan, or cannot get this version, RMVclean.XLS can be used to clean files on access of a limited number of viruses.

Also before using RMVclean.XLS
- check your local system for the file XLSHEET.XLA - if found, please remove it. This file is a known XF/PAIX.A infected workbook, and if present, normally found in C:\WINDOWS
- check the XLSTART folder for Microsoft Office for unknown workbooks such as PLDT.XLS, PERSONAL.XLS or BINV.XLS - if found, remove them.


INSTALLATION INSTRUCTIONS
=========================
Please close Excel95/97 at this time, if it is running. 
Use Windows 95/NT "START  FIND" feature to search for the XLSTART folder on your local system. When found, copy RMVclean.XLS into that folder (overwrite if exist). The typical XLSTART folder path are-

Excel95- "\msoffice\excel\xlstart"
Excel97- "\program files\microsoft office\office\xlstart"


Operating Instructions
======================
Use Excel95 or Excel97 as you normally would. In the background, RMVclean.XLS is working to remove infection and virus remnants on any workbook you may open.

In addition, it will remove invalid styles placed into workbooks by various versions of "LAROUX" and also "XF/PAIX.A" Excel macro viruses. Style removal is now running automatically, with an option to not remove styles in the workbook.

The following macros are part of RMVclean utility:

RMVclean.xls!Auto_Close		- checks workbooks on close
RMVclean.xls!Auto_Open		- checks workbooks on open
RMVclean.xls!File_Close		- checks workbooks on close
RMVclean.xls!RMVclean		- main macro routine
RMVclean.xls!zCheck_styles	- removes excessive styles
RMVclean.xls!zHelp_About	- Help About screen
RMVclean.xls!zNinja_Laroux_scan	- scan a path for X97M/Jini.a & XM/Laroux.ic and remove
RMVclean.xls!zShow_hiddensheets	- display all hidden worksheets

Error messages
==============
Please report any errors to virus_research@nai.com, please reference the version of RMVclean.XLS you are using. Version information is in the dialog message box of the zHelp_About macro.