HOW TO: Identify and Remove PLDT, CAR, and SGV Macro Viruses in Excel 2000

General Information About Macro Viruses

How to Detect the PLDT, CAR, and SGV Macro Viruses

• If the PLDT macro virus has infected any of your workbooks, the workbook Pldt.xls file or the Results.xls file is in one of the following folders on your computer:
  
  
  • C:\Excel\Xlstart
  • C:\Program Files\Microsoft Office\Office\Xlstart
  Also, any workbooks that are infected by the macro virus contain a Visual Basic module called "pldt".

• If the CAR macro virus has infected any of your workbooks, the workbook Car.xls is in one of the following folders on your computer:
  
  
  • C:\Excel\Xlstart
  • C:\Program Files\Microsoft Office\Office\Xlstart
  Also, any workbooks that are infected by the macro virus will contain a Visual Basic module called "car".

• If the SGV macro virus has infected any of your workbooks, the workbook Sgv.xls will be found in one of the following folders on your computer:
  
  • 
    
  • C:\Excel\Xlstart
  • C:\Program Files\Microsoft Office\Office\Xlstart
  Also, any workbooks that are infected by the macro virus will contain a Visual Basic module called "sgv".

How to Remove the PLDT, CAR, and SGV Macro Viruses

1. On the Tools menu, point to Macro and click Security. Click the Security Level tab. Click Medium, and then click OK.
2. Quit Excel.
3. In Windows Explorer, go to all of the XLSTART folders listed previously, and then follow these steps.
   
   
   1. If the Pldt.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.
   2. If the Car.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.
   3. If the Sgv.xls file exists, select it. On the File menu, click Delete. Click Yes if you are asked whether to move the file to the Recycle Bin.
4. Start Microsoft Excel.
5. Open a workbook that you believe to be infected with the PLDT, CAR, or SGV macro virus.
   
   If you receive the following message
   File name contains macros.
   
   Macros may contain viruses. It is always safe to disable macros, but if the macros are legitimate, you might lose some functionality.
   click Disable Macros.
6. On the Tools menu, point to Macro, and then click Visual Basic Editor.
7. Click Project Explorer on the View menu to make sure the Project window is visible.
8. In the Project window, click the plus sign (+) to the left of the word "Modules" below the name of the workbook you just opened.
   
   If a module named "pldt", "car", or "sgv" is listed, right-click the module name. On the shortcut menu, click Remove module. Click No when you are asked whether to export the module.
9. On the File menu, click Close and Return to Microsoft Excel.
10. On the Format menu, click Style.
11. In the Style name list, look for styles whose names contain "pldt", "car", "sgv", or "laroux". If you see such a style listed, select it and then click Delete. Repeat this step until no more styles such as these remain.
12. On the File menu, click Save. On the File menu, click Close.
13. Repeat steps 5 through 12 for all workbooks that you think are infected with the PLDT, CAR, or SGV macro virus.
    
    Also, if any other workbooks, such as Personal.xls, are listed in the Project window in the Visual Basic Editor, click the plus sign to the left of the word Modules below each workbook's name. If any modules named "pldt", "car", or "sgv" are displayed, right-click the module name, and then click Remove module on the shortcut menu.

How to Use Third-party Antivirus Software to Remove Macro Viruses

   Program             Web Address
   ----------------------------------------------------------
   Norton AntiVirus    http://www.symantec.com/nav/ 
   McAfee VirusScan    http://www.mcafee.com/down/upgrade.asp
   F-Prot              http://www.datafellows.com/ 
   Cheyenne InocuLAN   http://www.cheyenne.com/virusinfo/