excel infected?
 

(Excel 2002, SP3; winXP, SP2)

This problem just started. When I open a particular .xls, my firewall
reports that Excel is trying to access the internet. This doesn't
happen with other Excel files. The IP address that it tries to access
belong to Savvis and Level Three Communications. The spreadsheet
doesn't have any (intentional) links of this sort.

From this, I have to wonder if this particular file has gotten
infected.

Is this even possible? The history of this xls file includes contact
with someone else's PC.

If a spreadsheet can be infected, is there a way to clean it? My AV
(AVG) is apparently not detecting anything.

Thanks,
George Eccles

excel infected?
 

Not an expert, but, FWIW;
I have this experience and, in my case, it is related to the fact that I regularly copy
and paste data from the internet to a workbook.
When I do this it asks for access to the internet so I don't think it's an "infection",
but, as I said, I'm not an expert.

--
Regards;
Rob
------------------------------------------------------------------------
"George" wrote in message
...
(Excel 2002, SP3; winXP, SP2)

This problem just started. When I open a particular .xls, my firewall
reports that Excel is trying to access the internet. This doesn't
happen with other Excel files. The IP address that it tries to access
belong to Savvis and Level Three Communications. The spreadsheet
doesn't have any (intentional) links of this sort.

From this, I have to wonder if this particular file has gotten
infected.

Is this even possible? The history of this xls file includes contact
with someone else's PC.

If a spreadsheet can be infected, is there a way to clean it? My AV
(AVG) is apparently not detecting anything.

Thanks,
George Eccles

excel infected?
 

In this regard, can a macro be hidden, so it doesn't show up in <tools
- macros? The only (few) macros I see are all mine, and don't have
anything that looks internet-ish.

George

excel infected?
 

On Sat, 22 Oct 2005 12:14:28 -0500, "RWN" wrote:

Not an expert, but, FWIW;
I have this experience and, in my case, it is related to the fact that I regularly copy
and paste data from the internet to a workbook.
When I do this it asks for access to the internet so I don't think it's an "infection",
but, as I said, I'm not an expert.

Thanks for the reply. I could imagine how that might happen, that
Excel would try to update your pasted data. In my case, I never did
any internet cut/paste to this WB. It's pretty vanilla, though it
does have a few macros. Also, the sites it's requesting are not
consistent, and not anyplace I've been.

George

excel infected?
 

Many things can cause a macro not to show there, if they have arguments to
the macro, if the macro is declared as Private, or if the module is
private.

The best way to check, is to go into the VBIDE (Alt-F11), and check the code
modules in there.

--

HTH

RP
(remove nothere from the email address if mailing direct)


"George" wrote in message
...
In this regard, can a macro be hidden, so it doesn't show up in <tools
- macros? The only (few) macros I see are all mine, and don't have
anything that looks internet-ish.

George

excel infected?
 

On Sat, 22 Oct 2005 19:30:01 +0100, "Bob Phillips"
wrote:

Many things can cause a macro not to show there, if they have arguments to
the macro, if the macro is declared as Private, or if the module is
private.

The best way to check, is to go into the VBIDE (Alt-F11), and check the code
modules in there.

I'd done that. The only things I see are my own macros, which are few
and short, and don't do anything related to the internet. But, you
allude to declaring things private: can this hide it from VBIDE?

George

excel infected?
 

Newer versions of excel (xl2002+, I think) can be set to go off to the MS site
for help. (I don't know what Savvis and Level Three Communications are,
though.)

Tools|Options|General Tab|Service Options Button
is where you'd toggle that setting.

This doesn't ring any bells for me:
http://www.savvis.net
http://www.level3.com


One more place to look:

Add another option to your Tools dropdown.
tools|customize|commands tab|tools category
Scroll down the commands side until you find: COM Add-ins...

Drag that to your favorite toolbar. I dragged it right under Addins under
Tools.

Then look to see if you have any COM Add-ins loaded.



George wrote:

(Excel 2002, SP3; winXP, SP2)

This problem just started. When I open a particular .xls, my firewall
reports that Excel is trying to access the internet. This doesn't
happen with other Excel files. The IP address that it tries to access
belong to Savvis and Level Three Communications. The spreadsheet
doesn't have any (intentional) links of this sort.

From this, I have to wonder if this particular file has gotten
infected.

Is this even possible? The history of this xls file includes contact
with someone else's PC.

If a spreadsheet can be infected, is there a way to clean it? My AV
(AVG) is apparently not detecting anything.

Thanks,
George Eccles

--

Dave Peterson

excel infected?
 

No, if you can get into the VBIDE, you can see them. Private refers to the
procedure's scope, not the VBIDE.

There could also be code in ThisWorkbook, or in sheet code modules.

--

HTH

RP
(remove nothere from the email address if mailing direct)


"George" wrote in message
...
On Sat, 22 Oct 2005 19:30:01 +0100, "Bob Phillips"
wrote:

Many things can cause a macro not to show there, if they have arguments
to
the macro, if the macro is declared as Private, or if the module is
private.

The best way to check, is to go into the VBIDE (Alt-F11), and check the
code
modules in there.

I'd done that. The only things I see are my own macros, which are few
and short, and don't do anything related to the internet. But, you
allude to declaring things private: can this hide it from VBIDE?

George

excel infected?
 

On Sat, 22 Oct 2005 16:18:11 GMT, George
wrote:

(Excel 2002, SP3; winXP, SP2)

This problem just started. When I open a particular .xls, my firewall
reports that Excel is trying to access the internet. ...

Oops: I had created a signature for my macros, and the Internet access
started with the version where I did that. So, apparently not
anything bad. (It seemed like I needed the signature, to allow my
macros to run with a 'high' security setting. But, I could just be
confused about that, too.)

George