AVERT - A Division of NAI Labs
AVERT - A Division of NAI Labs

this page last updated 1-14-99

RMVclean Virus Remover

v4.01.14..updated January 14, 1999

Please take the time to read our Non-Disclosure Agreement before downloading it.


RMVclean Virus Remover Version 401.14 last updated January 14, 1999

RMVclean.XLS is a utility to clean files of the XM/LAROUX, XF/PAIX.A virus, and also clear invalid sheets in files previously cleaned. RMVclean.xls replaces the previous utility known as RMVPAIX.XLS.

Issues addressed by the utility
- removes XF/PAIX.A infections on access
- removes "pldt" modules left after cleaning by older scan engines
- notification message that file has been cleaned of XF/PAIX.A
- notification message that file has been cleaned of PLDT module
- removes multiple sheets with "****"
- removes styles using "zRemove_all_styles" macro (run manually)

*NEW since v4.01.14*
- removes XM/LAROUX infections on access
- removes XM/EXTRAS infections on access
- searches and removes known XM/LAROUX infected workbooks from XLSTART folder
- show hidden sheets in workbook using "zShow_hiddensheets" (run manually)
- RMVclean version information is in dialog boxes displayed

Prerequisites for running Program
This utility was designed originally to remove the XF/PAIX.A virus from files. It has also been modified and upgraded to remove PLDT and LAROUX modules from files, cleaning them of possibly new and not detected LAROUX variants and also removing remnant code.

Before using this utility, it is recommended that VirusScan v4.0.2 be used to identify and clean viruses on your system(s). In the event you do not have VirusScan, or cannot get this version, RMVclean.XLS can be used to clean files on access.

Also before using RMVclean.XLS
- check your local system for the file XLSHEET.XLA - if found, please remove it. This file is a known XF/PAIX.A infected workbook, and if present, normally found in C:\WINDOWS
- check the XLSTART folder for Microsoft Office for unknown workbooks such as PLDT.XLS, PERSONAL.XLS or BINV.XLS - if found, remove them.

Please exit Excel95/97 at this time, if it is open.
Use Windows 95/NT "START FIND" feature to search for the XLSTART folder on your local system. When found, place RMVclean.XLS in that folder; typically

Excel95- "\msoffice\excel\xlstart"
Excel97- "\program files\microsoft office\office\xlstart"

Operating Instructions
Use Excel95 or Excel97 as you normally would. In the background, RMVclean.XLS is working to remove the XF/PAIX.A infection on any workbook you may open.

In addition, it will remove invalid styles placed into workbooks by various versions of "LAROUX" and also "XF/PAIX.A" Excel macro viruses. To remove styles requires to run the macro in RMVclean manually.

* Choose TOOLS MACRO (if Excel97 macros)
* Select "RMVclean.xls!zRemove_all_styles" and click Run
* A dialogue box will ask if you want to process the entire workbook
- YES will process the entire workbook and delete incorrect styles
- NO will only process the current sheet and delete incorrect styles
* As styles are checked, they are listed at the bottom of the workbook statusbar

Error messages
Please report any errors to "virus_research@nai.com", please reference the version of RMVclean.XLS you are using. If not sure, locate the file and select "properties" of the file, the version info is in the properties.

This Excel95/97 "add-in" utility program has not been approved by Quality Assurance. It has been designed to help you address various issues and should be used as recommended by your NAI representative.

For any further questions please contact Virus Research at virus_research@nai.com

1999, Network Associates, Inc. and its affiliated Companies. All Rights Reserved.