excel infected?

(Excel 2002, SP3; winXP, SP2)

This problem just started. When I open a particular .xls, my firewall
reports that Excel is trying to access the internet. This doesn't
happen with other Excel files. The IP address that it tries to access
belong to Savvis and Level Three Communications. The spreadsheet
doesn't have any (intentional) links of this sort.

From this, I have to wonder if this particular file has gotten
infected.

Is this even possible? The history of this xls file includes contact
with someone else's PC.

If a spreadsheet can be infected, is there a way to clean it? My AV
(AVG) is apparently not detecting anything.

Thanks,
George Eccles

Not an expert, but, FWIW;
I have this experience and, in my case, it is related to the fact that I regularly copy
and paste data from the internet to a workbook.
When I do this it asks for access to the internet so I don't think it's an "infection",
but, as I said, I'm not an expert.

--
Regards;
Rob
------------------------------------------------------------------------
"George" <[email protected]> wrote in message
news:[email protected]...
> (Excel 2002, SP3; winXP, SP2)
>
> This problem just started. When I open a particular .xls, my firewall
> reports that Excel is trying to access the internet. This doesn't
> happen with other Excel files. The IP address that it tries to access
> belong to Savvis and Level Three Communications. The spreadsheet
> doesn't have any (intentional) links of this sort.
>
> From this, I have to wonder if this particular file has gotten
> infected.
>
> Is this even possible? The history of this xls file includes contact
> with someone else's PC.
>
> If a spreadsheet can be infected, is there a way to clean it? My AV
> (AVG) is apparently not detecting anything.
>
> Thanks,
> George Eccles

In this regard, can a macro be hidden, so it doesn't show up in <tools
- macros>? The only (few) macros I see are all mine, and don't have
anything that looks internet-ish.

George

On Sat, 22 Oct 2005 12:14:28 -0500, "RWN" <[email protected]> wrote:

>Not an expert, but, FWIW;
>I have this experience and, in my case, it is related to the fact that I regularly copy
>and paste data from the internet to a workbook.
>When I do this it asks for access to the internet so I don't think it's an "infection",
>but, as I said, I'm not an expert.

Thanks for the reply. I could imagine how that might happen, that
Excel would try to update your pasted data. In my case, I never did
any internet cut/paste to this WB. It's pretty vanilla, though it
does have a few macros. Also, the sites it's requesting are not
consistent, and not anyplace I've been.

George

Many things can cause a macro not to show there, if they have arguments to
the macro, if the macro is declared as Private, or if the module is
private.

The best way to check, is to go into the VBIDE (Alt-F11), and check the code
modules in there.

--

HTH

RP
(remove nothere from the email address if mailing direct)


"George" <[email protected]> wrote in message
news:[email protected]...
> In this regard, can a macro be hidden, so it doesn't show up in <tools
> - macros>? The only (few) macros I see are all mine, and don't have
> anything that looks internet-ish.
>
> George

On Sat, 22 Oct 2005 19:30:01 +0100, "Bob Phillips"
<[email protected]> wrote:

>Many things can cause a macro not to show there, if they have arguments to
>the macro, if the macro is declared as Private, or if the module is
>private.
>
>The best way to check, is to go into the VBIDE (Alt-F11), and check the code
>modules in there.

I'd done that. The only things I see are my own macros, which are few
and short, and don't do anything related to the internet. But, you
allude to declaring things private: can this hide it from VBIDE?

George

Newer versions of excel (xl2002+, I think) can be set to go off to the MS site
for help. (I don't know what Savvis and Level Three Communications are,
though.)

Tools|Options|General Tab|Service Options Button
is where you'd toggle that setting.

This doesn't ring any bells for me:
http://www.savvis.net
http://www.level3.com


One more place to look:

Add another option to your Tools dropdown.
tools|customize|commands tab|tools category
Scroll down the commands side until you find: COM Add-ins...

Drag that to your favorite toolbar. I dragged it right under Addins under
Tools.

Then look to see if you have any COM Add-ins loaded.



George wrote:
>
> (Excel 2002, SP3; winXP, SP2)
>
> This problem just started. When I open a particular .xls, my firewall
> reports that Excel is trying to access the internet. This doesn't
> happen with other Excel files. The IP address that it tries to access
> belong to Savvis and Level Three Communications. The spreadsheet
> doesn't have any (intentional) links of this sort.
>
> From this, I have to wonder if this particular file has gotten
> infected.
>
> Is this even possible? The history of this xls file includes contact
> with someone else's PC.
>
> If a spreadsheet can be infected, is there a way to clean it? My AV
> (AVG) is apparently not detecting anything.
>
> Thanks,
> George Eccles

--

Dave Peterson

No, if you can get into the VBIDE, you can see them. Private refers to the
procedure's scope, not the VBIDE.

There could also be code in ThisWorkbook, or in sheet code modules.

--

HTH

RP
(remove nothere from the email address if mailing direct)


"George" <[email protected]> wrote in message
news:[email protected]...
> On Sat, 22 Oct 2005 19:30:01 +0100, "Bob Phillips"
> <[email protected]> wrote:
>
> >Many things can cause a macro not to show there, if they have arguments
to
> >the macro, if the macro is declared as Private, or if the module is
> >private.
> >
> >The best way to check, is to go into the VBIDE (Alt-F11), and check the
code
> >modules in there.
>
> I'd done that. The only things I see are my own macros, which are few
> and short, and don't do anything related to the internet. But, you
> allude to declaring things private: can this hide it from VBIDE?
>
> George
>

On Sat, 22 Oct 2005 16:18:11 GMT, George
<[email protected]> wrote:

>(Excel 2002, SP3; winXP, SP2)
>
>This problem just started. When I open a particular .xls, my firewall
>reports that Excel is trying to access the internet. ...

Oops: I had created a signature for my macros, and the Internet access
started with the version where I did that. So, apparently not
anything bad. (It seemed like I needed the signature, to allow my
macros to run with a 'high' security setting. But, I could just be
confused about that, too.)

George