Description of the Excel 2000 SR-1 Macro Modification security update: April 25, 2002

Microsoft has re-released an update to Microsoft Excel 2000 SR-1. This update addresses a vulnerability that might allow malicious code to run in an Excel file without warning. Under typical circumstances, you will see a warning in Excel 2000 when you open a document that contains macros. However, it is possible for a malicious user to modify the macros in such a way that a macro can run with no warning issued. This might cause damage to data or allow unauthorized retrieval of data from your computer when you visit a Web site or open an e-mail message. After you apply this update, a warning appears before an Excel file that contains macros is opened.

For more information about this issue, see the Microsoft Security Bulletin MS01-50: Malformed Excel or PowerPoint Document Can Bypass Macro Security

This update was re-released on April 25, 2002 to correct the issue discussed in the following KB article:

This article describes how to download and install the Excel 2000 SR-1 Macro Modification Security Update.

For additional information about the latest service pack for Microsoft Office 2000, click the following article number to view the article in the Microsoft Knowledge Base:

How to Download and Install the Update

Use one of the following methods to install the update, as appropriate to your situation.

Client Update

If you installed Microsoft Office 2000 from a CD-ROM, follow these steps to download and install the client update:

1. With your Web browser, locate the following Microsoft Web site:
   http://download.microsoft.com/download/excel2000/e2kmac/1/w98nt42kme/en-us/e2kmac.exe

   (http://download.microsoft.com/download/excel2000/e2kmac/1/w98nt42kme/en-us/e2kmac.exe)
2. Click Download Now, click Save this program to disk, and then click OK.
3. Click Save to save the E2kmac.exe file to the selected folder.
4. In Windows Explorer, double-click e2kmac.exe.
5. If you are prompted to install the update, click Yes.
6. Click Yes to accept the License Agreement.
7. Insert your Office 2000 CD-ROM when you are prompted to do so, and then click OK.
8. When you receive a message that indicates the update was applied successfully, click OK.

NOTE: After you install the public update, you cannot remove it.

Administrative Update

If you installed Office 2000 from a server location, the server administrator must update the server location with the administrative public update and deploy that update to your computer.

If you are the server administrator, follow these steps to download the administrative update:

1. Locate the following Microsoft Web site:
   http://download.microsoft.com/download/excel2000/e2kmac/1/w98nt42kme/en-us/e2kmac_a.exe

   (http://download.microsoft.com/download/excel2000/e2kmac/1/w98nt42kme/en-us/e2kmac_a.exe)
2. Download the file to your desktop.
3. In Windows Explorer, double-click the e2kmac_a.exe file.
4. Click Yes to accept the License Agreement.
5. In the Please type the location where you want to place the extracted files box, type C:\e2kmac_a, and then click OK.
6. Click Yes when you are prompted to create the folder.
7. If you are familiar with the procedure for updating your administrative installation, click Start, and then click Run. Type the following command in the Open box
   msiexec /a admin path\MSI file /p C:\e2kmac_a\excel_admin.msp SHORTFILENAMES=1
   where admin path is the path to your administrative installation point for Office 2000 SR-1 (for example, C:\Office), and where MSI file is the MSI database package for the Office 2000 product (for example, Data1.msi).
8. To deploy the update to the client workstations, click Start and then click Run. Type the following command in the Open box
   msiexec /i admin path\MSI file REINSTALL=EXCELFiles REINSTALLMODE=vomus
   where admin path is the path to your administrative installation point for Office 2000 SR-1 (for example, C:\Office), and where MSI file is the MSI database package for the Office 2000 product (for example, Data1.msi).

For additional information about how to update your administrative installation and deploy to client workstations, click the article number below to view the article in the Microsoft Knowledge Base: This article contains standard instructions for installing an administrative public update. Or, you can see the following article in the Microsoft Office 2000 Resource Kit:

How to Determine Whether the Public Update Is Installed

This update makes changes to the Excel.exe file. The file properties for Excel.exe have been updated to show that the version is 9.0.0.5519. The updated Excel.exe file has a file size of 7,159,853 bytes.

To verify whether the installation of the update was successful, make sure that the last four digits of the version of the Excel.exe file on your system is equal to or later than 5519. By default, Excel.exe is in the following location on your computer: To check the last four digits, follow these steps:

1. Click Start, point to Programs, and then click Windows Explorer.
2. In Windows Explorer, right-click the file and then click Properties.
3. Click the Version tab.

NOTE: The version number that is listed in the About Microsoft Excel dialog box (available on the Help menu) does not change after the update is applied. Only the properties window for the Excel.exe file shows the updated version.

Issues Fixed by the Update

The update fixes the issues described in the following Microsoft Knowledge Base articles:

Other Issues Fixed in This Release

In addition, the following issues are also fixed:

Embedded Charts Displayed in Default Colors When Opened in HTML Format from Internet Explorer
Embedded charts on a worksheet do not retain custom colors if the workbook is saved as HTML and opened in Microsoft Internet Explorer. The same HTML file if opened in Microsoft Excel 2000 displays the custom colors as expected.

Excel Fixed Size Chart Resized When Pasted into Word
If you set a chart to a custom size in Excel, copy the chart, and then paste the chart into Microsoft Word, the chart in the Excel file changes to the size of the window.

Save Worksheet with Chart in Excel 5.0/95 Format Causes Error
Some Microsoft Excel 95 files with charts cause an invalid page fault error when saved from Excel 2000 in Excel 95 format.

JPN: VBA Macro Run-time Error
When you attempt to make a worksheet visible in Japanese Excel from within a Visual Basic for Applications macro, the method fails with run-time error '1004': Method 'Visible' of object '_Worksheet' failed.

Custom Size Chart Resized After Being Edited in Word
When you edit a custom size Excel chart in-place in Word, the chart loses the custom size.

JPN: Bad Redraw with Freeze Panes Used with Outline Group
When you outline a group in Excel, and then freeze a column in that group, the column to the left of the frozen pane may be redrawn incorrectly if you are zoomed in at less that 100%. Not all of the digits are visible.

JPN: Excel Unexpectedly Quits on Horizontal Scrolling on Print Preview Page
If you scroll horizontally with a laptop computer's touch pad while no horizontal scroll bar is visible on the print preview page, Excel may unexpectedly quit.

Excel Uses All of CPU Time While Mouse Button Is Held Down
If you hold down the mouse button in a cell on an Excel worksheet, Excel uses all of the available CPU time.

Updating Linked Sheets on IIS Server Causing Error in Web Browser
When you update a link from one Excel sheet to another Excel sheet, you receive an error message stating "Unexpected error" if the files are located on a Microsoft Internet Information Services server with Basic Authentication and the files are opened in Internet Explorer.

JPN: Inserting [Calculated Field] with a Program That Hooks Windows Messaging Causes Excel to Unexpectedly Quit
When you click the Add Field button in the Insert Calculated Field dialog box, Excel unexpectedly quits whenever a program that hooks Windows messaging is running.

Change in Binary File Can Bypass Macro Controls
An Excel workbook stream can be altered in such a way that the macros in the file run without prompting a macro warning or being stopped by macro controls.