AVERT - A Division of NAI Labs
AVERT - A Division of NAI Labs

this page last updated 2-24-99

RMVclean Virus Remover
Please take the time to read our Non-Disclosure Agreement before downloading it.


RMVclean Virus Remover Version 4.01.19 last updated January 19, 1999

RMVclean.XLS is a utility to clean files of the XM/LAROUX, XF/PAIX.A virus, and also clear invalid sheets in files previously cleaned. RMVclean.xls replaces the previous utility known as RMVPAIX.XLS.

Issues addressed by the utility
- removes XF/PAIX.A infections on access
- removes "pldt" modules left after cleaning by older scan engines
- notification message that file has been cleaned of XF/PAIX.A
- notification message that file has been cleaned of PLDT module
- removes multiple sheets with "****"
- removes styles using "zRemove_all_styles" macro (run manually)
- removes XM/LAROUX infections on access
- removes XM/EXTRAS infections on access
- searches and removes known XM/LAROUX infected workbooks from XLSTART folder
- show hidden sheets in workbook using "zShow_hiddensheets" (run manually)
- RMVclean version information is in dialog boxes displayed
- removes XF/SIC.A infections on access
- POPUP message that file has been cleaned of XF/SIC.A
- removes leftover "define names" from XF/SIC.A virus cleanings by AV products

*NEW since previous version*
- GENERIC detection of virus module not detected by VirusScan !
- if GENERIC detection of virus, code module exoprted to file "CODE_RMV.BAS" and suggestive message to user to send copy of file to "virus_research@nai.com" for analysis
- remove Excel97 virus modules by removing all lines and replacing with a single comment line
' This module removed by RMVclean! AVERT - RMVclean Utility - version 4.02.24 '
- virus module exported to file "CODE_RMV.BAS"
- remove the parasitic effects of the XF/Sugar.d virus, which appends code to Excel97 workbook modules

Prerequisites for running Program
This utility was designed originally to remove the XF/PAIX.A virus from files. It has also been modified and upgraded to remove PLDT and LAROUX modules from files, cleaning them of possibly new and not detected LAROUX variants and also removing remnant code.

Before using this utility, it is recommended that VirusScan v4.0.2 be used to identify and clean viruses on your system(s). In the event you do not have VirusScan, or cannot get this version, RMVclean.XLS can be used to clean files on access.

Also before using RMVclean.XLS
- check your local system for the file XLSHEET.XLA - if found, please remove it. This file is a known XF/PAIX.A infected workbook, and if present, normally found in C:\WINDOWS
- check the XLSTART folder for Microsoft Office for unknown workbooks such as PLDT.XLS, PERSONAL.XLS or BINV.XLS - if found, remove them.

Please exit Excel95/97 at this time, if it is open.
Use Windows 95/NT "START FIND" feature to search for the XLSTART folder on your local system. When found, place RMVclean.XLS in that folder; typically

Excel95- "\msoffice\excel\xlstart"
Excel97- "\program files\microsoft office\office\xlstart"

Operating Instructions
Use Excel95 or Excel97 as you normally would. In the background, RMVclean.XLS is working to remove the XF/PAIX.A infection on any workbook you may open.

In addition, it will remove invalid styles placed into workbooks by various versions of "LAROUX" and also "XF/PAIX.A" Excel macro viruses. To remove styles requires to run the macro in RMVclean manually.

* Choose TOOLS MACRO (if Excel97 macros)
* Select "RMVclean.xls!zRemove_all_styles" and click Run
* A dialogue box will ask if you want to process the entire workbook
- YES will process the entire workbook and delete incorrect styles
- NO will only process the current sheet and delete incorrect styles
* As styles are checked, they are listed at the bottom of the workbook statusbar

Error messages
Please report any errors to "virus_research@nai.com", please reference the version of RMVclean.XLS you are using. If not sure, locate the file and select "properties" of the file, the version info is in the properties.

This Excel95/97 "add-in" utility program has not been approved by Quality Assurance. It has been designed to help you address various issues and should be used as recommended by your NAI representative.

For any further questions please contact Virus Research at virus_research@nai.com

1999, Network Associates, Inc. and its affiliated Companies. All Rights Reserved.