MacXL: How to Identify and Remove the PLDT Macro Virus (188794)

MORE INFORMATION

General Information About the PLDT Macro Virus

The PLDT macro virus is a non-destructive virus that copies a file called Pldt.xls into your startup folder, and copies a module that contains an Auto_Open macro into any workbook that you open in Microsoft Excel.

You may be unable to close a workbook that contains this macro. The workbook appears to close, and then automatically reopens.

How to Detect and Remove the PLDT Macro Virus

If the PLDT macro virus has infected any of your workbooks, the workbook Pldt.xls will be in one of the following folders on your computer where hard disk is the hard disk path on which you installed Office. Browse to the folder; locate the Pldt.xls file, and place it in the Trash.

Also, any workbooks that are infected by the macro virus will contain a Visual Basic module called pldt. To remove the PLDT macro virus from your workbooks, use the appropriate method for your version of Excel.

In Microsoft Excel 2001 and Microsoft Excel 98

1. On the Edit menu (or Tools menu in Excel 98), click Preferences.
2. On the General tab, make sure the Macro virus protection check box is selected (checked), and then click OK.
3. Quit Microsoft Excel.
4. Open the following folder on your hard disk:

   hard disk:Microsoft Office version:Office:Startup:Excel

5. If the Pldt.xls file exists, drag this file to the Trash. On the Special menu, click Empty Trash.
6. Start Microsoft Excel.
7. Open a workbook that you believe to be infected with the PLDT macro virus.
   
   If you receive the following message, click Disable Macros:
   The workbook you are opening contains macros. Some macros may contain viruses that could be harmful to your computer.
   
   If you are sure this workbook is from a trusted source, click 'Enable Macros'. If you are not sure and want to prevent any macros from running, click 'Disable Macros'.
8. On the Tools menu, point to Macro, and then click Visual Basic Editor.
9. On the View menu, click Project Explorer, to make sure the Project window is visible.
10. In the Project window, click the triangle to the left of the word Modules, below the name of the workbook that you just opened.
    
    If a module named PLDT is listed, hold down CONTROL and click the module name, and then click Remove PLDT on the shortcut menu. Click YES when you are asked if you are sure you want to remove PLDT.
11. On the File menu, click Close and Return to Microsoft Excel.
12. On the File menu, click Save. On the File menu, click Close.
13. Repeat steps 7-12 for all workbooks that you believe are infected with the PLDT macro virus.
    
    Also, if any other workbooks, such as Personal Macro Workbook, are listed in the Project window in the Visual Basic Editor, click the triangle to the left of the word "Modules" below each workbook's name. If any modules named PLDT are displayed, hold down CONTROL and click the module name, and then click Remove PLDT on the shortcut menu.

Until you are absolutely certain that the PLDT macro virus has been completely removed from your computer, click Disable Macros every time you open a workbook. If you open a workbook that contains the PLDT macro virus and click Enable Macros, the macro virus will begin to infect your workbooks again.

In Microsoft Excel 5.0

1. Quit Microsoft Excel.
2. Open the System Folder:Preferences:Excel Startup (5) folder on your hard disk.
3. If the file Pldt.xls exists, drag this file to the Trash. On the Special menu, click Empty Trash.
4. Start Microsoft Excel.
5. Open a workbook that you believe to be infected with the PLDT macro virus. On the File menu, click Open. Locate and select the workbook. Hold down SHIFT and then click Open. Keep the SHIFT key pressed until the workbook is open.
   
   This will prevent any Auto_Open macros in the workbook from running.
6. On the Format menu, point to Sheet, and then click Unhide. If pldt is listed in the Unhide Sheet list, select it, and then click OK.
7. On the Edit menu, click Delete Sheet. Click OK to permanently delete the sheet.
8. On the File menu, click Save. On the File menu, click Close.
9. Repeat steps 5-8 for all workbooks that you believe are infected with the PLDT macro virus.
   
   Also, if you have a Personal Macro Workbook, you may need to unhide it (on the Window menu, click Unhide), perform steps 6 and 7, and then rehide the Personal Macro Workbook (on the Window menu, click Hide). When you quit Microsoft Excel, click Yes to save changes to the Personal Macro Workbook.

If you are uncertain as to whether or not a workbook is infected with the PLDT macro virus, hold down SHIFT while you open the workbook, and then perform steps 6-8.

NOTE: If you have exchanged workbooks with anyone else, let them know that their workbooks may also be infected by the PLDT macro virus.