Kill Excel VBS

[Rob]

Hi,

I have just noticed and deleted a file called Kill Excel vbs that was in my
Windows folder and in my program list. I'm guessing this is some kind of
virus but can't find anything on this subject. Any ideas as to what this
might have been?

Rob

 

[Guest]

This file could be anything; however, usually a file with extension VBS is a
VBScript file. It is a text file and can be viewed using NOTEPAD. Unlike
other text files, a VBS files can be executed by
1. double clicking on it
2. supplying the file name to WSCRIPT.EXE as an argument (Start | Run)
3. supplying the file name to CSCRIPT.EXE as as argument from the Command
Prompt.

Opening the file using a text editor does NOT execute its code; so if you
can recover it, examine it using NOTEPAD.

 

[Rob]

Thanks, I'll try and recover.

 

[Dave Peterson]

I'm gonna guess that you sometimes automate excel from different applications
(MSWord???).

And when you do this, you could start a new instance of excel and kept it
hidden.

And something bad happens in the code (or you just stop it) and it leaves that
hidden instance of excel still running.

My guess is that "kill excel.vbs" is a script that looks for and tries to kill
any running instances of excel. It can be easier that alt-ctrl-delete and
searching for that rogue instance of excel.exe.

I have a similar script that unhides excel/Word/Outlook. It looks like:

dim myXL
On Error Resume Next
Set myXL = GetObject(, "Excel.Application")
If Err.Number = 429 Then
msgbox "Excel is not running"
else
myxl.visible = true
end If
On Error GoTo 0
Set myxl = nothing

dim myWord
On Error Resume Next
Set myWord = GetObject(, "Word.Application")
If Err.Number = 429 Then
msgbox "Word is not running"
else
myWord.visible = true
end If
On Error GoTo 0
Set myWord = nothing

dim myOutlook
On Error Resume Next
Set myOutlook = GetObject(, "outlook.Application")
If Err.Number = 429 Then
msgbox "Outlook is not running"
else
myOutlook.visible = true
end If

 

[Rob]

Dave,

I often use a Word Mail Merge which has been known to have crashed a few
times, would this create the file Kill Excel or would someone have placed on
my computer?

Thanks, Rob

 

[Dave Peterson]

I don't think so.

But I wouldn't be surprised if you saw this "kill excel.vbs" somewhere and
thought that you could use it if something (including MSWord's mail merge)
crashed it.

Personally, I'd rather not kill an instance of excel. I'll make it visible and
then close it myself. Then repeat until all hidden instances are closed.