But the criteria is, Our Tool is password protected in VBA editor due to some confidential calculations in the coding. We cannot share the password to every user instead the SOLVER add-in has to add automatically into the tool. I appreciate your valuable solution for my query.
- Recovery Toolbox for Excel v.3.0.11. Recovery Toolbox for Excel recovers damaged Microsoft Excel documents of xls, xlsx, xlt, xltx, xlam and other formats, used by any supported version of this application. It quickly opens any workbook that cannot be accessed by Microsoft Excel. File Name:RecoveryToolboxForExcelInsta ll.exe.
- Hello all, Excel 2000. I have the Add-in 'Analysis Toolpack-VBA installed, and I am trying to access 'atpvbaen.xls' in the VBA windows (per instructions.
Contents
Solver and Conventional VBA
Avoiding Solver Reference Problems
Preparing Solver for First Use
Solver Links
Solver and Conventional VBA
Solver is a powerful analysis tool, bundled with Excel and used for optimization and simulation of business and engineering models. It can be even more powerful if used in conjunction with VBA, to automate solving of multiple models which use different input parameters and constraints.
In a simple example, there are two factors in B5 and B6. The product (=B5*B6) is calculated in B8. Solver will be used to find the maximum value of the target cell (the product in B8), subject to the constraint that both factors (B5:B6) shall not exceed a value of 4. Select Solver from the Tools menu, and enter the appropriate conditions and constraints in the Solver Parameters dialog.
Click the Solve button, and another dialog indicates whether a solution is found and offers some options.
If you record a macro while you use Solver, you will get something like the following:
SolverAdd adds constraints to the Solver model. SolverOK defines the cell to optimize, how to optimize it, and what cells to change during the Solver optimization. The macro recorder wrote this line twice, so the first occurrence can be removed. To prevent parameters from a different Solver optimization interfering with the macro's optimization, Solver should be reset prior to running, using SolverReset. SolverSolve has an optional UserFinish argument; if UserFinish is False or omitted, the second dialog shown above will ask the user whether to save the optimization, but if UserFinish is True, Solver will end without the dialog. A modified Solver macro is shown below:
When you try to run this macro, you get a compile error. The command SolverReset is highlighted, and the following error message appears.
In order to use a macro based on an installed add-in, you must first make sure that the add-in is installed, then you must set a reference to the add-in in the workbook containing the code that calls the add-in's procedures.
To install an add-in, on Excel's Tools menu, choose Add-Ins. If the add-in is shown on the list, check the box in front of its name. If the add-in is not found, click Browse, navigate to the add-in file*, then when it appears on the add-in list, check its checkbox. Solver was already installed, or we would not have been able to record a macro using it.
*Depending on your Office and Windows versions, the default Excel add-ins library is 'C:Program FilesMicrosoft OfficeOFFICE15Library' or 'C:Documents and Settings{username}Application DataMicrosoftAddIns'. By default in Excel 2013, Solver is located in 'C:Program FilesMicrosoft OfficeOFFICE15LibrarySOLVER'.
To set a reference to an add-in, it must first be installed. Then on the VB Editor's Tools menu, select References. This lists all open workbooks and installed add-ins, as well as a huge list of resources installed on the host computer. Find the add-in in the list, and check the box in front of its name.
With a reference set to Solver, SolverMacro2 will run as expected. In addition, the Solver library will be accessible through the VB Editor's Object Browser (right), and you will have the benefit of Intellisense (below) while editing code that uses members of the Solver library. |
Solver Xlam Passwords
Avoiding Solver Reference Problems
The code you write to run Solver will work on your computer, and on any computer with the same versions of Excel and Solver. In fact, it should work on any computer that has later versions of Excel and Solver. If you want to distribute your workbook with VBA code written for Solver, you should write the code using the earliest expected version of Excel, so it will work on all versions that users may have installed. When the workbook is first opened on a given computer, it finds the references resources, or more recent versions if available.
This sounds easy, but sometimes it isn't. Perhaps you developed a workbook in Excel 2013 for your department to use, but you have to send it to a supplier, and the supplier hasn't upgraded past Excel 2007. Or perhaps the workbook must be shared amongst a group of users who have different versions of Excel and Solver installed. In these cases, a computer with an earlier version of Solver installed will choke on the reference to a later version of Solver.
It is possible, of course, to install add-ins and set references using VBA. This can be tricky, the user has to grant permission for VBA code to access any VB projects. Without this permission, references to installed components cannot be set.
To avoid issues with installing add-ins and setting references to various resources, your code can be modified so that it is called using Application.Run. Without a reference to the add-in, you lose IntelliSense and the Object Browser, and your code suffers from a small (probably imperceptible) performance penalty. However, you gain simpler, more reliable execution. The syntax is straightforward: Application.Run is followed by the procedure name in double quotes, followed by a comma separated list of arguments being passed to the procedure:
If Application.Run is used to return the calculated result of a function, the syntax is slightly different, with a variable set equal to Application.Run, with the procedure and arguments enclosed within parentheses:
The SolverMacro2 procedure above is easily modified to use Application.Run:
A more general version of a Solver procedure is shown below. This includes more informative comments, and it provides a notice to the user about the success of the Solver optimization. Note that before Excel 2007, the name of the solver add-in was 'Solver.xla', not 'Solver.xlam'.
The results of the SolverSolve function include:
Preparing Solver for First Use
One frequent complaint about automating Solver is that it doesn't work using VBA until it has been used at least once manually. This is because Solver installs itself in a kind of 'on demand' mode. Unlike a regularly-installed add-in, it is not opened until it is first used. And until it is first used, it hasn't run its Auto_Open procedure, which is what actually prepares it to run. Using VBA you can bypass the initial manual Solver operation with this command:
This command should be run before the first Solver optimization procedure is executed. I have developed a Solver initialization routine that first makes sure the computer even has Solver, then it installs it and runs its Auto_Open procedure. The procedure is written as a function, which returns True if Solver is available and ready to use. I usually call this procedure from the parent workbook's Workbook_Open event procedure. If CheckSolver is False, I usually have the workbook close itself after a brief warning to the user.
The function above works fine for English versions of Excel, but in other languages, the name of the add-in may not be 'Solver Add-In'. We have to be a bit more clever, and introduce a loop to check the filenames of all add-ins. The CheckSolverIntl function below calls two additional functions which perform the loops. This function still relies on Solver being named 'solver.xlam'. If this is not the case, for example, in different language versions of Excel, change the value of the constant sAddIn in this procedure, and please email me about it.
Solver Links
Frontline Systems
Frontline Systems has developed Solver add-ins for Excel and other applications. The standard Excel Solver add-in can be upgraded to a premium Solver version or to other specialized Solvers, and there are versions for use with other programming platforms. While the capabilities of Solver are very extensive, the online documentation is somewhat sparse.
Microsoft
Around the Web
Over the last few years we have received a number of emails with attached Word files that spread malware. Now it seems that it is becoming more and more popular to spread malware using malicious Excel files. Lately, Fortinet has collected a number of email samples with Excel files attached (.xls, .xlsm) that spread malware by executing malicious VBA (Visual Basic for Applications) code.
VBA is a programming language used by Microsoft Office suite. Normally, VBA is used to develop programs for Excel to perform some tasks.
I’ll use two examples to explain how Excel files can be used to spread malware.
Excel Malware Sample 1
When the infected file is opened in Excel, a message pops up asking the user to enable the macro security option by clicking the “Enable Content” button. Once the macro function is enabled, the malicious VBA code inside the sample is executed. See Figure 1.
Figure 1. An Excel message to enable macros
The file in this example is an OLE format Excel file that was collected on Feb 27, 2017. Its original file name is “payment.xls”, which was detected as virus “WM/Agent.D9E2!tr.dldr” by Fortinet because it contains malicious VBA code.
- Here is the OLE structure of this sample
Figure 2. The OLE structure of this sample
From the parsing result of the OLE file analysis tool, the malicious VBA code exists in the Module1 stream. So I extracted the VBA code from it.
- Here is the VBA code snippet
As you can see from the above VBA code, there is a function named “Auto_Open”, which is called automatically when the file is opened in Excel. Based on our analysis of other malicious VBA-based samples, the functions “ShellExecute”, “Shell”, “WScript.Shell”, and “Run” are usually called to execute DOS commands. In this sample, the “Shell” function is called at the bottom to execute the malicious command.
This VBA code is easy to understand. First, it creates some arrays with short names by calling the Array function. Second, it generates some strings by concatenating elements of the arrays by their indexes. Finally, it puts the strings together in a special order to generate the final command string.
Actually, this is a kind of code obfuscation technique used to avoid being detected and analyzed. The final string is the malicious command being executed by the “Shell” function. In this sample, the first parameter “ugsubpox” holds the command string.
- Debugging the VBA code with Microsoft Visual Basic for Applications
Figure 3. Analyzing the VBA code
- Downloading other malware
As analyzed in Figure 3, here is the string in the variable “ugsubpox”:
It looks weird because of the code obfuscation. We can see a DOS command will be executed by calling cmd.exe. There are many ‘^’ symbols in this command, but we can directly ignore them because ‘^’ in DOS shell is the escape character. So, after removing all the ‘^’ symbols and changing all the characters to lowercase because Windows commands are not case-sensitive, the string looks clearer and is easier to understand:
“cmd.exe /c” initiates running a new cmd shell, executing the command specified by the string, and terminating it. As a result, executing this command will download an .exe file into “%appdata%.exe” and execute it.
In fact, the downloaded .exe file is a downloader of Dyzap malware. Later, it will download another .exe file called “paray.txt”, the new variant of Dyzap, and run it to keep stealing credentials from infected systems. Finally, the stolen credential data is encrypted and sent to its C&C server.
For more information about Dyzap, you can read the blog from Bahare Sabouri and He Xu.
In our collection system we gathered lots of Excel samples containing similar VBA code. They are used to spread different kinds of malware, including Trojans, Ransomware, Spyware, Bots, etc.
Excel Malware Sample 2
Another Excel malware sample was first collected in our system on Feb 27, 2017. It’s also an OLE format file.
- The OLE structure of this sample
This sample contains modules and controls. Here is its structure.
Figure 4. The OLE structure of this sample
From the parsing result of the OLE file analysis tool, we can see the VBA code is stored in streams “_VBA_PROJECT_CUR/VBA/ThisWorkbook”, “_VBA_PROJECT_CUR/VBA/Module1”, and “_VBA_PROJECT_CUR/UserForm1/o”. Inside the VBA project there is a “TextBox” control. Its “Text” property contains malicious code, which is invisible by default. It can be accessed easily by VBA code. See Figure 5, below.
Figure 5. Malicious code hidden in TextBox control
Once this sample is opened in Excel, the function “Workbook_Open” inside the stream “ThisWorkbook” will be called if the Macro security option is enabled. The VBA code is designed to extract the malicious code from stream “_VBA_PROJECT_CUR/UserForm1/o” into a file called “gtls.vbs” and then execute it.
- The VBA code extracting vbs code from TextBox control into “gtls.vbs”
- Here is the code of “gtls.vbs”
When going through all the code you can easily understand its purpose. When it is executed it downloads a file from “hxxp://****anox.comxa.com/dix/disk” into “%appdata%disk.exe”. The file “disk.exe” is executed by calling “oShell.Run”. See Figure 6, below.
Figure 6. The properties of the downloaded file
Solver.xlam Password Vba
After a quick analysis we can see that this is a new variant of Strictor, which is ransomware. Fortinet has been identified it as virus “W32/Delf.EFUQ!tr”.
Conclusion
Based on our observation, we are seeing an increase in the number and kinds of malware being spread by Microsoft Office files, like what we have shown in the above Excel samples. To protect against them, users should be very careful when opening files with Microsoft Office attachments from untrusted sources.
Excel Sample SHA256s:
Solver Xlam Password Reset
0abdc28b70c032810ac5a3de80f1b40fd740ad5fc1dbe033a12103e16a66f15d
898d137e4d676ac02ff83c607abbe24a8187e1fcda895b100f157e2eb8d9dffb