Advertisement

Archive for Monday, May 25, 1998

PESKY MACRO VIRUSES MAY STAY WITH US FORWHILE

May 25, 1998

Advertisement

Back in the spring of 1988, when the Mac was still relatively young and few of us were using the Internet yet, a programmer at Northwestern University named John Norstad began working on a Macintosh anti-virus program. His program, named Disinfectant, was released a year later for free, and after nine years of effectively fighting Mac virus problems, Norstad recently announced that he was no longer going to support or update the popular freeware program. Why? Norstad didn't want Disinfectant users to get a false sense of security, because even Disinfectant is useless against the hundreds of Word macro viruses that have become the No. 1 Mac virus problem.

Word macro viruses have been with us since sometime in 1995, and as far back as June of last year, it was estimated that there were perhaps 1,200 of the pesky little viruses making their way from one Word document to another, and spreading like wildfire across both Mac and Windows machines. Chances are there are hundreds more today.

What is a Word macro virus? In Microsoft Word version 6.0 and later (and recent versions of Microsoft Excel), it is possible to create macros -- little procedures, written in a special language, that automate certain kinds of tasks. It didn't take long for the nitwit virus programmers to figure out how to create viruses with this language that could be replicated simply by opening an infected Word document. I had an annoying bout with a Word macro virus a year or two ago that took days to resolve, and I still find an old infected document on my hard disk every now and then. Like other viruses, some Word macro viruses are relatively harmless, except that they spread so easily. Others, particularly on Windows machines, may be capable of doing serious harm to your system, including erasing large portions of your hard disk.

With some of these macro viruses, there is no obvious evidence that you have contracted the virus, which means that by the time you realize you've been infected, you've probably already infected dozens, perhaps hundreds of files on your computer. And if you've shared Word documents with any other Word users, chances are they've been infected, too.

Word macro viruses hide in Word template files that masquerade as regular document files. If you use a Macintosh, you may notice a different file icon from what you expected. On Windows systems there may not be an easy way to tell, unless the particular macro virus you have displays an odd-looking dialogue box, or otherwise makes its presence known.

Later versions of Word, such as Word 97 and Word 7.0, have some ability to check for macro viruses in documents, but it's difficult, if not impossible, to find a single safeguard against all variants of these pests. But there are ways to protect yourself, and there are many utilities that can identify and eliminate certain macro viruses. Visit the WORDinfo WEBindex site at http://www.wordinfo.com/Links/macvirus.htm for links to other resources and ideas. Or go to Microsoft's page (http://www.microsoft.com/word/freestuff/mvtool/virusinfo.htm) and see what is provided there. Many of the more popular commercial anti-virus programs are also being updated constantly to handle macro viruses.

If you find that you do have infected documents, don't panic. The documents can nearly always be restored to normal. It may take a while to find a suitable utility program, though, and it may be a nontrivial process. In the meantime, for goodness' sake, don't swap documents with other people -- you may just start the whole thing over again.

-- Doug Heacock is director of the Kansas Research and Educational Network at Kansas University. You may address questions to him in care of the Lawrence Journal-World, 609 N.H., Lawrence 66044, or e-mail him at heacock

Commenting has been disabled for this item.