Remove infected object in XLS file

Aspose.Cells Product Family
1

Hi team, I have a XLS sample file containing infected object in Workbook stream.
{2E57847D-E835-4735-90DC-15ECD1B02450}.png (27.3 KB)

Please advise me which feature of Aspose Cells I should use to remove it. Thank you.
I’m using Aspose Cells version 24.4.0.
xls_sample.zip (5.1 KB)

2

@dunghnguyen
Would you like to describe your needs in detail? What object do you want to delete? We will check it soon.

3

I don’t know what the object is, I just know it is identified as infected. When I try to remove the highlighted part in the image above using OLE tool, the file is no infected. But I want to know what it is and remove it using Aspose Cells. Please help me check. Thank you.

4

@dunghnguyen
Sorry, we opened the sample file and did not detect any infection. Would you like to compress the infected file and the file after deleting the infected object using the OLE tool into a zip format and upload it here? We will check it soon.

5

Please help check XLS.zip file containing infected file and removed infected file.
XLS.zip (9.7 KB)

6

@dunghnguyen,

Thanks for the sample files.

Please spare us little time to evaluate both files for comparisons if we could trace culprit objects from the file. We will get back to you soon.

1 Like
7

@dunghnguyen
We found your mentioned infected object is a part of printer setting. Perhaps it’s a false alarm from antivirus software.
Please try the following codes to remove printer settings:

foreach(Worksheet sheet in workbook.Worksheets)
{
    sheet.PageSetup.PrinterSettings = null;
}
1 Like
8

@simon.zhao
Hi Simon, I tried removing printer settings according to your instructions, the result was very good. Thank you very much.

9

First of all I would like to thank you for your support, @John.He, @amjad.sahi, @simon.zhao.

I still have a XLS file that Virustotal identified as containing Macro.Virus.Sic. Can you help me find a way to remove it? Thanks.

sic_xls_file.zip (26.0 KB)

10

@dunghnguyen
Thank you for your feedback. You are welcome. We will further study the sample files you have provided, and once we have a solution, we will notify you promptly.

1 Like
11

@dunghnguyen
Would you like to provide a screenshot and highlight which binary data segment is incorrect? This will be very helpful for us to locate the issue. We will check it soon.

12

@John.He
Sorry, I haven’t found the suspicious binary data segment yet.

13

@dunghnguyen
Thank you for your feedback. We will further study the sample files. Once there is an update, we will notify you promptly.

1 Like
14

@dunghnguyen
As we are not familiar about Virus, we can not find which part is misjudgment without suspicious segment.
Sorry, we can not remove your mentioned infected object of this file.

15

Hi @simon.zhao, I found the suspicious data. Can you help me check which object that piece of data belongs to? Is it text data?
{33DE7025-6A03-4BE0-B1E0-8DC87DE99155}.png (29.9 KB)

16

@dunghnguyen
There is a hidde worksheet "XL4Poppy“ and the value of A9 is An Excel Formula Micro Virus…
If the worksheet is useless, you can remove it.

1 Like
17

Hi @simon.zhao, I appreciate your support. I have removed XL4Poppy hidden worksheet and the output file is clean. Thank you very much.

18

@dunghnguyen
Thank you for your feedback. You are welcome. I’m glad your issue has been resolved. If you have any questions, please feel free to contact us at any time.

1 Like