|
[Use your browser's BACK button to return to the PRIME FAQ Page or click here if you came directly to this page.]
We wrote this FAQ to answer the many questions we receive on this topic from our clients and other inquiring minds in the many electronic communities we frequent.
Word macro viruses currently on the loose attack Microsoft Word's special template Normal.dot. Since Normal.dot is always in memory and available whenever Word is running, it's an easy target for these viruses. The following list shows the current crop of macro viruses (as of this writing) enumerated on Woody Leonhard's excellent Virus Alert! Web page (see http://www.wopr.com/wopr/wwinfo/viri.htm or http://www.wopr.com/wopr/wwinfo/virframe.htm).
Dan Butler has cleverly suggested that if you absolutely don't want to get infected, and all you need to do is view or print (but not edit), you can use Word Viewer and Excel Viewer to peruse the content of Word and Excel documents. He also suggests that you can define these as helper apps inside Netscape and also set them to be the default Open operation for double-clicking inside Explorer. Find the Word and Excel Viewer at http://officeupdate.microsoft.com/Articles/viewerscvt.htm.
You can open Word documents with WordPad, which is blind to macros, then save the document in the RTF file format which doesn't include macros, then open the RTF version in Word, thereby guaranteeing the document being edited is macro-less and so, by definition, uninfected. (We commonly use this technique and recently avoided getting Wazzu from a large client this way.)
You can install one or more of several vendors' macro virus detection and removal tools. We recommend F-MACRO (from Data Fellows Ltd., the makers of F-PROT Professional) but note that if you run F-MACRO in its shareware form it is a DOS-based utility, whereas when you license F-PROT Professional you get F-MACRO's capabilities built in. You can get a copy of F-MACRO shareware at http://www.datafellows.fi/f-prot.htm. F-MACRO scans and disinfects Word 6.x and 7.x documents and Excel 6.x and 7.x documents.
It has been suggested that you hold down the Shift key every time you open any Word document or template. Not all macro viruses are defeated this way. For example, in some tests Nuclear wasn't defeated this way (see http://www.wopr.com/wwinfo/nuclear.htm). Not to mention that this technique can prove to be an extremely tiresome and irksome redundant task, and is very easily forgotten or omitted in that one case when, you guessed it, you open an infected document. Ouch!
It has also been suggested that you can write an AutoExec macro that runs the WordBasic command DisableAutoMacros. Alternately, you can start Word via the command line
winword.exe /mDisableAutoMacros
This technique (attempting to squelch Auto macro execution during a Word session) doesn't work for any virus that propagates itself without Auto macros, say, using a FilesSave, FileClose, or FileExit macro. For example, Colors isn't blocked this way. (Heck, Colors is so smart it actually overwrites Normal.dot's AutoExec macro to be an empty macro! Scary.) Squelching Auto macros session-wide like this also has the decided disadvantage of turning off benevolent Auto macros which are often the building blocks for helpful commercial and shareware Word add-ins.
Macro viruses are real and prevalent enough that it is not a matter of if you'll ever encounter one, just when. We have it on good authority that the first Word 97 specific macro virus has been verified. Be on guard.
|
Return to Top