[ale] [OFFTOPIC] virus info
Russell Enderby
Russell.Enderby at arris-i.com
Thu Apr 22 17:55:16 EDT 1999
--------------47756ED3178C6D8EB88E9DD2
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Matt,
This fixed the problem perfectly! I have passed this info along to
others with this problem.
Thanks much,
Russell
Matt Williams wrote:
>
>
> I havent read this entire thread, so i dont know if this solution has
> been presented or not, but here goes. Excel looks at the /program
> files/msoffice/xlstart directory everytime it is loaded. if there are
> any files, xl or otherwise in that dir, they will be loaded when excel
> is started. most excel viruses will be in macros in some xl file in
> that dir. i recommend closing excel, going to that dir, and deleting
> anything in it. then restarting excel and see what happens.
>
> hope this helps!
>
> Matt Williams
>
> -----Original Message-----
> From: Russell Enderby [SMTP:Russell.Enderby at arris-i.com]
> Sent: Thursday, April 22, 1999 11:15 AM
> To: ale at ale.org
> Subject: Re: [ale] [OFFTOPIC] virus info
>
> I have similar problems. It appears the tri-state virus infects
> the 'blank
> document' form that is used to show all documents. Therefore
> everytime I
> pull something into excel it gets infected. The latest norton
> and mcaffee
> do not detect the 'INFECTOR' but does detect the infected excel
> documents
> and cleans them.
>
> Very annoying.
> Russell
>
> Dunlap, Randy wrote:
>
> > http://www.DataFellows.com/
> > http://www.datafellows.com/v-descs/tristate.htm
> >
> > No results (i.e., not found) at McAfee, Symantec,
> > and about 3 others (Trend, Sophos, ...).
> >
> > /Randy
> >
> > PS.1: Note [OFFTOPIC]
> > PS.2: Did you try a web search? (similar to V's comment
> earlier today)
> >
> > > -----Original Message-----
> > > From: Greg_Cook at vfc.com [mailto:Greg_Cook at vfc.com]
> > > Sent: Wednesday, April 21, 1999 12:33 PM
> > > To: ale at ale.org
> > > Subject: [ale] virus info
> > >
> > >
> > >
> > >
> > > hi guys,
> > >
> > > we seem to have a word macro virus here ( in addition to the
> > > windows 95/nt
> > > virus) referenced as 'X97M/Tristate.c'....i can't find
> > > anything about it on
> > > mcafee or my old copy of technet....does anyone have a clue
> > > about this or know a
> > > good site for info on word macro viruses.
> > >
> > > thanks again,
> > >
> > > greg ( cookg at vfc.com)
> > >
> > >
>
>
> --
> Russell T. Enderby Arris
> Interactive
>
> Software Engineer 3871
> Lakefield
> Dr, Suite 300
> Cornerstone Software Development Group Suwanee, GA 30024-1242
> Email: Russell.Enderby at arris-i.com
>
--
Russell T. Enderby Arris
Interactive
Software Engineer 3871 Lakefield
Dr, Suite 300
Cornerstone Software Development Group Suwanee, GA 30024-1242
Email: Russell.Enderby at arris-i.com
--------------47756ED3178C6D8EB88E9DD2
Content-Type: text/html; charset=us-ascii
Content-Transfer-Encoding: 7bit
</pre>
<HTML>
Matt,
<P>This fixed the problem perfectly! I have passed this info along
to others with this problem.
<BR>Thanks much,
<BR>Russell
<P>Matt Williams wrote:
<BLOCKQUOTE TYPE=CITE>
<P><FONT FACE="Arial"><FONT COLOR="#0000FF"><FONT SIZE=-1>I havent read
this entire thread, so i dont know if this solution has been presented
or not, but here goes. Excel looks at the /program files/msoffice/xlstart
directory everytime it is loaded. if there are any files, xl or otherwise
in that dir, they will be loaded when excel is started. most excel
viruses will be in macros in some xl file in that dir. i recommend
closing excel, going to that dir, and deleting anything in it. then
restarting excel and see what happens.</FONT></FONT></FONT>
<P><FONT FACE="Arial"><FONT COLOR="#0000FF"><FONT SIZE=-1>hope this helps!</FONT></FONT></FONT>
<P><FONT FACE="Arial"><FONT COLOR="#0000FF"><FONT SIZE=-1>Matt Williams</FONT></FONT></FONT>
<UL><FONT FACE="Arial"><FONT SIZE=-2>-----Original Message-----</FONT></FONT>
<BR><B><FONT FACE="Arial"><FONT SIZE=-2>From: </FONT></FONT></B>
<FONT FACE="Arial"><FONT SIZE=-2>Russell Enderby [SMTP:Russell.Enderby at arris-i.com]</FONT></FONT>
<BR><B><FONT FACE="Arial"><FONT SIZE=-2>Sent: </FONT></FONT></B>
<FONT FACE="Arial"><FONT SIZE=-2>Thursday, April 22, 1999 11:15 AM</FONT></FONT>
<BR><B><FONT FACE="Arial"><FONT SIZE=-2>To: </FONT></FONT></B>
<FONT FACE="Arial"><FONT SIZE=-2>ale at ale.org</FONT></FONT>
<BR><B><FONT FACE="Arial"><FONT SIZE=-2>Subject: </FONT></FONT></B>
<FONT FACE="Arial"><FONT SIZE=-2>Re: [ale] [OFFTOPIC] virus info</FONT></FONT>
<P><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>I have similar
problems. It appears the tri-state virus infects the 'blank</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>document' form
that is used to show all documents. Therefore everytime I</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>pull something
into excel it gets infected. The latest norton and mcaffee</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>do not detect
the 'INFECTOR' but does detect the infected excel documents</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>and cleans them.</FONT></FONT></FONT>
<P><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Very annoying.</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Russell</FONT></FONT></FONT>
<P><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Dunlap, Randy
wrote:</FONT></FONT></FONT>
<P><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>></FONT></FONT></FONT><U>
<FONT FACE="Arial"><FONT COLOR="#0000FF"><FONT SIZE=-1>http://www.DataFellows.com/</FONT></FONT></FONT></U>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>></FONT></FONT></FONT><U>
<FONT FACE="Arial"><FONT COLOR="#0000FF"><FONT SIZE=-1>http://www.datafellows.com/v-descs/tristate.htm</FONT></FONT></FONT></U>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> No results
(i.e., not found) at McAfee, Symantec,</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> and about
3 others (Trend, Sophos, ...).</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> /Randy</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> PS.1:
Note [OFFTOPIC]</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> PS.2:
Did you try a web search? (similar to V's comment earlier today)</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > -----Original
Message-----</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT SIZE=-1><FONT COLOR="#000000">> > From: Greg_Cook at vfc.com
[</FONT><U><FONT COLOR="#0000FF">mailto:Greg_Cook at vfc.com</FONT></U><FONT COLOR="#000000">]</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > Sent: Wednesday,
April 21, 1999 12:33 PM</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > To: ale at ale.org</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > Subject:
[ale] virus info</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > hi guys,</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > we seem
to have a word macro virus here ( in addition to the</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > windows
95/nt</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > virus) referenced
as 'X97M/Tristate.c'....i can't find</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > anything
about it on</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > mcafee or
my old copy of technet....does anyone have a clue</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > about this
or know a</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > good site
for info on word macro viruses.</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > thanks again,</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> > greg ( cookg at vfc.com)</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>> ></FONT></FONT></FONT>
<BR>
<P><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>--</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Russell T. Enderby
Arris Interactive</FONT></FONT></FONT>
<P><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Software Engineer
3871 Lakefield</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Dr, Suite 300</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Cornerstone
Software Development Group Suwanee, GA 30024-1242</FONT></FONT></FONT>
<BR><FONT FACE="Arial"><FONT COLOR="#000000"><FONT SIZE=-1>Email: Russell.Enderby at arris-i.com</FONT></FONT></FONT></UL>
</BLOCKQUOTE>
<P>--
<BR>Russell T. Enderby
Arris Interactive
<BR>Software Engineer
3871 Lakefield Dr, Suite 300
<BR>Cornerstone Software Development Group Suwanee, GA 30024-1242
<BR>Email: Russell.Enderby at arris-i.com
<BR> </HTML>
--------------47756ED3178C6D8EB88E9DD2--
More information about the Ale
mailing list