Russell Kent wrote:
Paul Lamar wrote:
BTW you have probably heard about the MS Word macro virus going
around. If you get an attached MS word doc file don't
click on it or it will send the virus and one of your
text files out to the first fifty people on your email list.
snip....
The computer virus du jour is called "Melissa". She works by being an MS-Word
attachment that has an auto-run macro. Auto-run macros are small programs
(macros) that are automatically run when the file is opened. The auto-run
macro in Melissa grabs the first 50 entries in your MS-Outlook address book,
and then forwards itself (the infected MS-Word attachment) to those people.
Those people (the secondary recipients) get this email from someone they know
(you) with an appealing subject line, and so they let their guard down, open
the attachment, and infect another 50 people, ad infinitum.
Melissa seems to be limited to MS-Word 97, MS-Word 2000, and MS-Outlook. If
you don't have MS-Word (97 or 2000) or MS-Outlook on your machine, you are
probably immune from her (but see below). Also, if you do not permit the
auto-run macro to run, then you likewise are probably immune.
In other words don't click on it. Windows is set up so if you click
on a file and it is of a certain type Windows will load the type
of program associated with that file type and attempt to display
it. This is called "opening the file" in Windows.
I believe that
MS-Word pops-up a warning dialog asking whether to disable the auto-run macro,
but that dialog may be configurable to "do not ever ask me; always enable
them". See your documentation for more information.
There is a follow-on variant of Melissa (I forget the name) that is a
similarly-infected MS-Excel attachment, and it forwards itself to the first
*60* names in your MS-Outlook address book. I expect that now that this
technique has been demonstrated, there will be a rash of these kinds of virus
attacks. Do not assume that because you use another email tool (like
Netscape, as I do) you will forever be immune. These virus creators will get
to you eventually.
Only if you click on an attachment of some kind. The most likely is a
nnnn.exe file. An exe file can do almost anything to your computer
including formating your hard disk or modifying any program
including the operating system stored on the hard disk. Next time
you ran that modified program no telling what it might do.
It is next to impossible to get a virus to run by merely reading a
pure and plain ASCII text file. (Since the source code for Windows
is not available we can not be absolutely certain about this.)
The operating system should merely transfer each character to
the screen memory and the video hardware then sends the screen
memory one bit of that character at a time to the video monitor
at a rate of 64 million bits per second or faster.
The same goes for JPG and GIF files.
The problem comes when word-proccessing or spreadsheet files
are "opened" in Windows. Word-processing and spreadsheet files
can contain binary information that could be a virus program. The
word processor or spread-sheet program associated with that file type
may have a section of code that recognizes the binary data as a program
and runs or executes it. IMHO that is the case with MS Word.
The macro language in MS Word, as I understand it,
has "run program" and file manipulation capability. In effect,
it is the old QuickBASIC programing language. Any reasonably
competant BASIC programmer could probably write viruses all day long.
This is the main reason we only accept ASCII, JPG and GIF files on
this newsletter.
What is your best defense against this kind of attack? Configure your tools
(MS-Word, MS-Excel) to ask you about enabling auto-run macros. When opening
an attached document purportedly from a trusted source, open it the first time
with auto-run macros *DISABLED*. If the document really looks like something
that the sender would have sent you, then you can close the document and
re-open it with the auto-run macros enabled.
And yes, I do this for a living. :-)
Russell Kent
Thanks for the tips Russell.
Paul Lamar
The Aircraft Rotary Engine Newsletter. Powered by Linux.
http://home.earthlink.net/~rotaryeng/ http://www.linux.org