[ale] [OFFTOPIC] virus info

Thu Apr 22 16:20:50 EDT 1999

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------ =_NextPart_001_01BE8CFD.9DB4C73C
Content-Type: text/plain

I havent read this entire thread, so i dont know if this solution has been
presented or not, but here goes.  Excel looks at the /program
files/msoffice/xlstart directory everytime it is loaded.  if there are any
files, xl or otherwise in that dir, they will be loaded when excel is
started.  most excel viruses will be in macros in some xl file in that dir.
i recommend closing excel, going to that dir, and deleting anything in it.
then restarting excel and see what happens.

hope this helps!

Matt Williams

> -----Original Message-----
> From:	Russell Enderby [SMTP:Russell.Enderby at arris-i.com]
> Sent:	Thursday, April 22, 1999 11:15 AM
> To:	ale at ale.org
> Subject:	Re: [ale] [OFFTOPIC] virus info
> 
> I have similar problems.  It appears the tri-state virus infects the
> 'blank
> document' form that is used to show all documents.  Therefore everytime I
> pull something into excel it gets infected.  The latest norton and mcaffee
> do not detect the 'INFECTOR' but does detect the infected excel documents
> and cleans them.
> 
> Very annoying.
> Russell
> 
> Dunlap, Randy wrote:
> 
> > http://www.DataFellows.com/
> > http://www.datafellows.com/v-descs/tristate.htm
> >
> > No results (i.e., not found) at McAfee, Symantec,
> > and about 3 others (Trend, Sophos, ...).
> >
> > /Randy
> >
> > PS.1:  Note [OFFTOPIC]
> > PS.2:  Did you try a web search? (similar to V's comment earlier today)
> >
> > > -----Original Message-----
> > > From: Greg_Cook at vfc.com [mailto:Greg_Cook at vfc.com]
> > > Sent: Wednesday, April 21, 1999 12:33 PM
> > > To: ale at ale.org
> > > Subject: [ale] virus info
> > >
> > >
> > >
> > >
> > > hi guys,
> > >
> > > we seem to have a word macro virus here ( in addition to the
> > > windows 95/nt
> > > virus) referenced as 'X97M/Tristate.c'....i can't find
> > > anything about it on
> > > mcafee or my old copy of technet....does anyone have a clue
> > > about this or know a
> > > good site for info on word macro viruses.
> > >
> > > thanks again,
> > >
> > > greg ( cookg at vfc.com)
> > >
> > >
> 
> 
> 
> --
> Russell T. Enderby                                        Arris
> Interactive
> 
> Software Engineer                                         3871 Lakefield
> Dr, Suite 300
> Cornerstone Software Development Group   Suwanee, GA 30024-1242
> Email: Russell.Enderby at arris-i.com
> 

------ =_NextPart_001_01BE8CFD.9DB4C73C
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
</pre>
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3DUS-ASCII">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.0.1460.9">
<TITLE>RE: [ale] [OFFTOPIC] virus info</TITLE>
</HEAD>
<BODY>

I havent read this =
entire thread, so i dont know if this solution has been presented or =
not, but here goes. Excel looks at the /program =
files/msoffice/xlstart directory everytime it is loaded. if there =
are any files, xl or otherwise in that dir, they will be loaded when =
excel is started. most excel viruses will be in macros in some xl =
file in that dir. i recommend closing excel, going to that dir, =
and deleting anything in it. then restarting excel and see what =
happens.

<P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">hope this =
helps!</FONT>
</P>

<P><FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial">Matt Williams</FONT>
</P>
<UL>
<P><FONT SIZE=3D1 FACE=3D"Arial">-----Original Message-----</FONT>
<BR><B><FONT SIZE=3D1 FACE=3D"Arial">From:  </FONT></B> <FONT =
SIZE=3D1 FACE=3D"Arial">Russell Enderby =
[SMTP:Russell.Enderby at arris-i.com]</FONT>
<BR><B><FONT SIZE=3D1 FACE=3D"Arial">Sent:  </FONT></B> <FONT =
SIZE=3D1 FACE=3D"Arial">Thursday, April 22, 1999 11:15 AM</FONT>
<BR><B><FONT SIZE=3D1 =
FACE=3D"Arial">To:    </FONT></B> <FONT SIZE=3D1 =
FACE=3D"Arial">ale at ale.org</FONT>
<BR><B><FONT SIZE=3D1 =
FACE=3D"Arial">Subject:       </FONT>=
</B> <FONT SIZE=3D1 FACE=3D"Arial">Re: [ale] [OFFTOPIC] virus =
info</FONT>
</P>

I have similar =
problems. It appears the tri-state virus infects the =
'blank
 document' form that =
is used to show all documents. Therefore everytime I
 pull something into =
excel it gets infected. The latest norton and mcaffee
 do not detect the =
'INFECTOR' but does detect the infected excel documents
 and cleans =
them.

<P><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Very =
annoying.</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Russell</FONT>
</P>

<P><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Dunlap, Randy =
wrote:</FONT>
</P>

<P><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">></FONT><U> <FONT =
COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial"><A =
HREF=3D"http://www.DataFellows.com/" =
TARGET=3D"_blank">http://www.DataFellows.com/</A></FONT></U>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">></FONT><U> =
<FONT COLOR=3D"#0000FF" SIZE=3D2 FACE=3D"Arial"><A =
HREF=3D"http://www.datafellows.com/v-descs/tristate.htm" =
TARGET=3D"_blank">http://www.datafellows.com/v-descs/tristate.htm</A></F=
ONT></U>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> No results =
(i.e., not found) at McAfee, Symantec,</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> and about 3 =
others (Trend, Sophos, ...).</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> /Randy</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> PS.1:  =
Note [OFFTOPIC]</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> PS.2:  =
Did you try a web search? (similar to V's comment earlier today)</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > =
-----Original Message-----</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > From: =
Greg_Cook at vfc.com [</FONT><U><FONT COLOR=3D"#0000FF" SIZE=3D2 =
FACE=3D"Arial"><A HREF=3D"mailto:Greg_Cook at vfc.com" =
TARGET=3D"_blank">mailto:Greg_Cook at vfc.com</A></FONT></U><FONT =
COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">]</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > Sent: =
Wednesday, April 21, 1999 12:33 PM</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > To: =
ale at ale.org</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > Subject: =
[ale] virus info</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > hi =
guys,</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > we seem =
to have a word macro virus here ( in addition to the</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > windows =
95/nt</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > virus) =
referenced as 'X97M/Tristate.c'....i can't find</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > anything =
about it on</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > mcafee or =
my old copy of technet....does anyone have a clue</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > about =
this or know a</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > good site =
for info on word macro viruses.</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > thanks =
again,</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> > greg ( =
cookg at vfc.com)</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">> ></FONT>
</P>
<BR>
<BR>

<P><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">--</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Russell T. =
Enderby          &nbsp=
;           &nbsp=
;           &nbsp=
;     Arris Interactive</FONT>
</P>

<P><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Software =
Engineer          &nbs=
p;           &nbs=
p;           &nbs=
p;      3871 Lakefield</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Dr, Suite =
300</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Cornerstone =
Software Development Group   Suwanee, GA 30024-1242</FONT>
<BR><FONT COLOR=3D"#000000" SIZE=3D2 FACE=3D"Arial">Email: =
Russell.Enderby at arris-i.com</FONT>
</P>
</UL>
</BODY>
</HTML>
<pre>
------ =_NextPart_001_01BE8CFD.9DB4C73C--