Laroux

Sneaking up on the world in July 1996 while everyone was so worried about Word macro viruses, Laroux became the first Microsoft Excel macro virus and opened up yet another data file to worry about.

Laroux is a fairly simple macro virus. The original contains two macros: AUTO_OPEN and CHECK_FILES. The first tells Excel to run the second as soon as a worksheet is opened. CHECK_FILES will look in the Excel startup path (usually the XLSTART directory) for a file called PERSONAL.XLS. If not found one is created; if found the module LAROUX is created in it. Since PERSONAL.XLS is automatically opened whenever Excel is run (much like NORMAL.DOT under Word) the virus will be loaded every time Excel is started and all accessed worksheets infected.

Laroux is written in Visual Basic for Applications (VBA), a macro language based on the Visual Basic programming language. Laroux is not intentionally destructive; it just replicates. Variants, however, frequently appear and there is no guarantee they will be benign.

Laroux, in its many variants, is fairly widespread.