1804 lines
85 KiB
Plaintext
1804 lines
85 KiB
Plaintext
|
|
--------------------------------------------------------------
|
|
MS WORD 6.x MACRO VIRUSES FAQ V2.0
|
|
<Frequently Asked Questions>
|
|
for the ALT.COMP.VIRUS Newsgroup
|
|
|
|
--------------------------------------------------------------
|
|
|
|
Before we get to the details, here is some info regarding the terms I have
|
|
chosen to use in this FAQ.
|
|
|
|
Vx or VX refers to the Virus Writing Community at large, regardless of any
|
|
individuals virus writing experience, or popularity.
|
|
|
|
AV refers to the Anti-Virus Community, including Researchers, Hobbyists,
|
|
and Software/Hardware Developers.
|
|
|
|
GUI refers to Graphical User Interface. <ex. Windows 3.1>
|
|
|
|
MAC refers to Apple MacIntosh Computers, usually both the Current POWER PC
|
|
MAC<PPC> and the earlier models. <unless otherwise stated>
|
|
|
|
MS refers to MicroSoft Corporation, and products made by them.
|
|
|
|
PC refers to IBM Brand Computers running on the x86 <including early x88,
|
|
AT, XT models> series of processors produced by INTeL, AMD, NeXTGEN, and
|
|
CYRIX, as well as IBM Clone or Compatible computers.
|
|
|
|
OS, or Operating System, will refer to the Disk Operating Systems that
|
|
handle basic I/O, file management, etc. MS-DOS, PC-DOS, DR-DOS, DIP-DOS,
|
|
Tandy DOS, COMPAQ-DOS all fit into this category. Operating Systems with
|
|
GUI's like WINDOWS NT, OS/2 WARP, MacOS, AMIGADos, and WINDOWS '95 also fit
|
|
this category. <it could be argued that WINDOWS '95 is NOT AN OS, as an
|
|
enhanced version of the classic MS-DOS OS is loaded prior to the loading of
|
|
WINDOWS Environment.>
|
|
|
|
Operating Environments, refers to interfaces that run on top of NON-GUI
|
|
OS's such as Windows 3.0, 3.1, 3.11, Windows for Workgroups, early OS/2
|
|
versions prior to WARP.
|
|
|
|
Operating Platform, refers to the combination of Computer Architecture, OS,
|
|
and sometimes GUI. Examples of Platforms can include, but are not limited
|
|
to the following...
|
|
|
|
x86 PC's running DOS
|
|
x86 PC's running either DOS/Windows 3.0 - 3.11 <most popular>
|
|
x86 PC's running DOS/OS/2 2.x or lower
|
|
x386 PC's running DOS/Windows For WorkGroups 3.1 - 3.11
|
|
X386 PC's running Windows NT 3.5
|
|
X386 PC's running Windows '95
|
|
x86 PC's running OS/2 Warp
|
|
Apple Macs running MacOS <system x-7.5>
|
|
POWERMacs running MacOS
|
|
Alpha's running NT
|
|
|
|
When Possible, distinctions between PC and MAC centric issues will be made,
|
|
but be forewarned this document is PC heavy.
|
|
|
|
NOTE: Use of VIRII as a plural of VIRUS has been dropped from this FAQ.
|
|
The term VIRUSES will be used instead. Complaints can be forwarded to
|
|
ALT.COMP.VIRUS where someone will be glad to argue with you till they're
|
|
blue in the face! :)
|
|
|
|
--------------------------------------------------------------
|
|
|
|
WARNING: User definable virus search strings are littered thoughout this
|
|
document. They will help users with older version of Anti-Virus software.
|
|
However, we suggest that you should acquire up-dated copies of the AV
|
|
software, which will have these strings included, and save you some
|
|
trouble. Also note that using TOOL/MACRO as a way of hunting down macro
|
|
infections can be dangerous. It is preferred that you use dedicated AV
|
|
software to hunt down infection.
|
|
|
|
--------------------------------------------------------------
|
|
[[[[ NEWS ]]]]
|
|
|
|
NOTE: HIGH SPEED DEMONZ now has it's own WWW homepage. you will find
|
|
updated copies of this FAQ at...
|
|
|
|
http://learn.senecac.on.ca/~jeashe/hsdemonz.htm
|
|
|
|
as well as other sites, including many popular AV sites. Keep an eye on
|
|
the Page, as new things will shortly be added, plus an HTML version of the
|
|
FAQ is being prepared.
|
|
|
|
With any luck, things will return to normal around here. Updated copies of
|
|
the FAQ should resume it's former schedule of updates once every 2 weeks.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPICS/QUESTIONS:
|
|
|
|
Preface: INTRODUCTION
|
|
=====================
|
|
|
|
1) WHAT IS A MACRO? WHAT IS A WORD MACRO?
|
|
1.1> WHAT IS A VIRUS?
|
|
1.2> WHAT IS A MS WORD MACRO VIRUS?
|
|
2) HOW DOES INFECTION OCCUR?
|
|
3) KNOWN FEATURES AND LIMITATIONS OF THE WINWORD FAMILY OF VIRUSES
|
|
4) VIRUS EXAMPLES
|
|
- 4.1 - CONCEPT
|
|
- 4.2 - NUCLEAR
|
|
- 4.3 - COLORS
|
|
- 4.4 - DMV
|
|
- 4.5 - HOT * NEW *
|
|
- 4.6 - MS WORD 2/MS WORD 6.x MACRO TROJAN WEIDEROFFEN * NEW*
|
|
- 4.7 - AMI PRO 3.0 MACRO VIRUS GREEN STRIPE * NEW *
|
|
- 4.8 - WORDMACRO ATOM / ATOMIC * NEW *
|
|
- 4.9 - FORMATC MACRO TROJAN * NEW *
|
|
5) STRATEGY FOR CLEANING AND PREVENTING WORD MACRO INFECTIONS
|
|
6) SUGGESTED SOFTWARE:
|
|
-PRODUCTS THAT CAN DETECT/CLEAN WINWORD VIRUSES INFECTIONS
|
|
IN DOCUMENTS
|
|
7) CREDITS & THANKS
|
|
8) DISTRIBUTION INFORMATION
|
|
9) WHERE CAN I OBTAIN UPDATED COPIES OF THIS FAQ?
|
|
10) QUESTIONS THAT STILL NEED TO BE ANSWERED...
|
|
11) DISCLAIMER
|
|
|
|
--------------------------------------------------------------
|
|
|
|
INTRODUCTION:
|
|
=============
|
|
|
|
During the last year, we have witnessed the birth of a whole new type of
|
|
virus, the WORD 6.0 MACRO VIRUS. The opening statement isn't entirely
|
|
true, as the idea of MACRO viruses isn't a new one, but this is the first
|
|
time that a macro virus has spread to the point of being considered "IN THE
|
|
WILD" by the Anti-Virus Community.
|
|
|
|
It is possibly the first Virus to be truly a CROSS-PLATFORM <not including
|
|
WORMS> infector, since any systems running compatible copies of WORD 6.0,
|
|
or those systems that emulate Word 6.0's macro language can be infected.
|
|
|
|
It is also the first group of viruses that prove NON-Executables can infect
|
|
systems. It had been theorized for years by the best in the industry, as
|
|
people started to realize the power of the MACRO Languages that were
|
|
included with program like 1-2-3, Excel, and numerous Word-Processors.
|
|
|
|
It is far less important to classify these viruses as data or executable
|
|
code or both, than to acknowledge their existence, and the need for
|
|
preventive measures against them.
|
|
|
|
To better understand the issues covered in this FAQ, the WORD MACRO
|
|
VIRUSES, it's necessary to first explain what a virus and a macro is.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 1: WHAT IS A MACRO? WHAT IS A WORD MACRO?
|
|
================================================
|
|
|
|
It is best to first describe what a Macro is. A macro is a collection of
|
|
instructions to be carried out by a program or computer. These
|
|
instructions, typically handle tasks that are boring, awkward, and tedious
|
|
in nature.
|
|
|
|
Dos users have been using a macro language for years to automate the
|
|
mundane and repetitive tasks common to maintaining a computer system.
|
|
Commonly known as the BATCH Language. In DOS, Files with the .BAT
|
|
extension are interpreted <by the Command Processor COMMAND.COM> and are
|
|
executed line by line, automating tasks <the most common example of a batch
|
|
file is the AUTOEXEC.BAT file, found in the root directory on every MS DOS
|
|
based PC in the world>.
|
|
|
|
NDOS & 4DOS Users have their own enhanced version of the batch languages
|
|
<files with the extensions .BTM>, which allows the same batch files, with
|
|
additional commands, to be read by the NDOS or 4DOS command interpreters
|
|
<NDOS.COM & 4DOS.COM> as a whole file into memory for execution <which
|
|
increases the speed of the batch file>.
|
|
|
|
OS/2 Users have enjoyed an even better Macro Language, the REXX
|
|
batch/Programming language. It is much more robust, and better suited to
|
|
deal with demanding tasks.
|
|
|
|
WORD MACROS, are Macros that can carry out and follow lists of
|
|
instructions, usually saving a user keystrokes. The abilities of the WORD
|
|
MACROS are limited to the functions provided by the MS WORD WordBasic
|
|
Environment, included with the WORD 6.x level of Word Processors from
|
|
MicroSoft. NOTE: WordBasic included with WORD 1.x, 2.x have enought
|
|
similar commands in their languages to warrant consideration.
|
|
|
|
Imagine having to add your name, address, phone#, and other personal info
|
|
to dozens of documents daily, it would become tedious fast. Macros can
|
|
automate the process, saving alot of time and effort. The power of the
|
|
WordBasic Macro Environment gives the users, both home users and business
|
|
users alike the ability to automate many tasks, including file management,
|
|
from within MS WORD. Macros also include the ability to affect other
|
|
running applications, via the Word Macro language, by DDE etc. Unknown to
|
|
the author at this time, it's been theorized that OLE abiltiy may also
|
|
exist in the WORDBASIC macro Language. <BOTH DDE and OLE may be entry point
|
|
for future viruses>
|
|
|
|
MS WORD MACROS are only executable by the WORDBasic environment, which is
|
|
limited to functional copies of MS WORD 6.x /7.x and sometimes 2.0, as well
|
|
as WORDVIEW 7.1. For the sake of this FAQ, MACROS will be considered Data
|
|
files. Macros require interpretation by the WordBasic Environment, and are
|
|
not executed in the classic DOS sense. Executables will be defined as
|
|
files that follow the classic standards, including EXE, COM, NEWEXE, BAT
|
|
<yes they are interpreted, but they are also almost always DIRECTLY
|
|
executed by the user, and as such almost fall into the same GREY area that
|
|
these macro viruses fall into> as well as the programs in the boot-sector,
|
|
master boot sectors. It could be argued that WORD macro are a combination
|
|
or data and executable code. A notable exception to the batch file rule,
|
|
is the WINSTART.BAT file, which Windows 3.11 for WorkGroups looks for in
|
|
every directory in the path, and tries to execute. It'll be executed
|
|
whether the user wishes it to be or not.
|
|
|
|
NOTE: David Harley <harley@europa.lif.icnet.uk> and Joseph Stafford
|
|
(stafford@twsuvm.uc.twsu.edu) have noted that MicroSoft Word Wizards are
|
|
also WORD Macros. Wizards are simply templates with the WIZ extension,
|
|
which include an AutoNew Macro, which call a Start Wizard Macro. WIZ files
|
|
may soon fall prey to macro infections.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 1.1: WHAT IS A VIRUS?
|
|
===========================
|
|
|
|
A computer VIRUS, is a <usually compiled> computer program, that is able
|
|
to replicate in whole or part it's code, by infecting or modifying other
|
|
programs, and adding to or overwriting the code of uninfected files with
|
|
code <possibly evolved or unique forms of the infector> that will in turn
|
|
infect other programs. Viruses must be able to replicate. A Virus that is
|
|
unable to replicate isn't technically a virus. <by our definition>
|
|
|
|
NOTE: Viruses can and sometimes do infect files indirectly, without
|
|
altering the CODE of executable files. For instance, File System or
|
|
Cluster viruses ( Dir-II, BYWay ) are those which alter directory entries,
|
|
pointing a legitimate directory entry first to it's malicious code, so the
|
|
virus can be executed, and then the desired program is executed. The
|
|
program itself is not physically altered, but the directory entry is.
|
|
|
|
Viruses may, and often do have destructive bombs or payloads, which do
|
|
something other than replicate. Many payloads include destroying data,
|
|
deleting files, encrypting parts of hard drives, etc. Common targets for
|
|
Viruses include standard Executables like *.COM, *.EXE, and NEWEXE files,
|
|
as well as the programs used by the computer to boot up, including the
|
|
programs <executable code> found in Boot sectors, and Master Boot Sectors.
|
|
Other DOS executables can also be infected, such as *.DLL and *.BIN, *.DRV,
|
|
*.OV? *.OB? and *.SYS files. Not all of these executable will allow for
|
|
the proper execution of viral code, and can/may either hang the machine,
|
|
crash a session, or simply not function, producing numerous errors. Common
|
|
examples of executable files include COMMAND.COM, EMM386.EXE, Windows
|
|
Executables, MOUSE.DRV, DRVSPACE.BIN, and HIMEM.SYS. <everyone with Modern
|
|
release of MS-DOS and WINDOWS should recognize these files>
|
|
|
|
A sub-class of viruses, known as Trojan Horses, are commonly, and possibly
|
|
incorrectly considered viruses. A Trojan Horse, named after the Greek
|
|
Battle Tactic, is a program, that is stated and promoted as being able to
|
|
do something useful or interesting <like a game or utility>, but in turn
|
|
does something malicious.<like drop a virus for later infection> Trojans
|
|
typically DO NOT ACTIVELY REPLICATE. They may inadvertently get copied
|
|
around and distributed, but this has little or nothing to do with any
|
|
replication code in the TROJAN.
|
|
|
|
NOTE : It can be argued that Viruses by the above definition, are Trojans.
|
|
This argument would have Viruses listed as replicating Trojans. Defining
|
|
these two groups of programs isn't really relevant, as long as you
|
|
understand the premise behind both groups. For a more detailed definition
|
|
of VIRUSES, refer to the ALT.COMP.VIRUS VIRUS FAQ, by David HARLEY, or the
|
|
COMP.VIRUS/VIRUSL FAQ's on VIRUSES. Both are an excellent source of virus
|
|
related info. Both are reposted regularly to their respective newsgroups.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 1.2: WHAT IS A MS WORD MACRO VIRUS?
|
|
=========================================
|
|
|
|
An MS WORD MACRO Virus, is a macro <list of instructions> or template file
|
|
<usually with the .DOT extension> which masquerades as legitimate MS WORD
|
|
documents <usually with the extension *.DOC>. An infected *.DOC file,
|
|
doesn't look any different to the average PC user, as it can still contain
|
|
a normal document. The difference is that this document is really just a
|
|
template or macro file, with instructions to replicate, and possibly cause
|
|
damage. MS WORD will interpret the *.DOT macro/template file regardless of
|
|
extension, as a template file. This allows for it being passed off as a
|
|
legitimate document <*.DOC> This FAQ takes the position that a document is
|
|
meant to be DATA, and a MACRO is at least partially executable CODE. When
|
|
a document has been infected, it has been merged with executable code in a
|
|
multi-part file, part data/part executable. This tends to be hidden from
|
|
the user, who expects a document to be data that is READ, and not some
|
|
combination of DATA and executable code designed to be executed, often
|
|
against the will of the user, to wreck havok.
|
|
|
|
These viruses commonly tend to infected the global macros, which get
|
|
automatically saved at the end of each session. When the next session of
|
|
MS WORD opens, the infected Global Macros are executed, and the WORD
|
|
Environment is now infected, and will in turn be likely to infect documents
|
|
whenever they are opened, closed, and created during all future sessions.
|
|
|
|
As a Virus, the WORD MACRO VIRUSES do REPLICATE. They can spread in most
|
|
cases to any MS WINDOWS Environment or OS that runs a compatible copy of MS
|
|
WORD 6.x or 7.x, MS WORD 6.x running on OS/2, as well as WORD for MAC 6.0
|
|
for MacOS. This makes it a multi-platform/multi-OS file infector. It also
|
|
makes it one of the first non-research viruses to be successfully spread to
|
|
all of these environments and OS's
|
|
|
|
MS Word Macro Viruses reside in interpreted data that can spread to
|
|
different OS's/platforms. These viruses do not spread via modification of
|
|
executable machine code, but by modification of data in files that are
|
|
interpreted by the Microsoft Word 6.0 program and any other versions of
|
|
Word that support macros and WordBasic.
|
|
|
|
MacIntosh Word Users have an advantage over the PC world, as infected
|
|
documents appear with the template icon, rather than the usual document
|
|
icon. This means that Mac Users can visually tell before-hand whether a
|
|
Document is infected or not.
|
|
|
|
For responsible Word 6.x users, Macros can also be of great use. The Macro
|
|
Language of WORD 6.x <WORD BASIC> is a powerful tool, and can accomplish
|
|
many tasks, including altering files, copying files, and executing other
|
|
programs. What makes this macro language so powerful is also what makes it
|
|
a target for the Vx community. The idea of the Vx community exploiting
|
|
macro languages had been theorized for years, but has only recently been
|
|
developed and spread throughout the world.
|
|
|
|
WordBasic Macro Language is much simpler to learn and master than
|
|
ASSEMBLER, or other popular higher Level programming languages, and for
|
|
this reason, Vx people <both new and old alike> have taken to it as a
|
|
viable alternative to learning and coding ASM . The thought of ticking
|
|
users off on more than one platform has been around for years, and now
|
|
thanks to MS WORD, and all it's compatible versions on other popular
|
|
platforms, the Vx people have their wish. Another Bonus of this new outlet
|
|
for Vx writers, is that many virus scanners only scan Executable files,
|
|
leaving the .DOC files of WORD alone. It is important to note that many AV
|
|
producers have now included scanners/cleaners to their software, allowing
|
|
for the detection of existing MS WORD Macro Viruses.
|
|
|
|
Vx people also know that many people never exchange programs, but regularly
|
|
exchange documents <those in the corporate circles for example> which meant
|
|
that there was a whole new region of unsuspecting users to infect. On top
|
|
of the power and lower learning curve of this language, and the popular
|
|
past conception that non-executables are relatively safe from infection and
|
|
becoming themselves infectors has allowed the Word Macro Virus spread like
|
|
"Wildfire". < Editor smiles :) >
|
|
|
|
Even until just recently, members of the respected AV community
|
|
inadvertently continues these classic misconceptions that NON-executables
|
|
<DATA FILES> cannot infect systems, and that no VIRUS can infect on a
|
|
CROSS-PLATFORM basis. F-PROT V2.21 <Dec '95> continues these
|
|
misconceptions in the file VIRUS.DOC, included with their DOS command line
|
|
scanner...
|
|
|
|
"A virus cannot spread from one type of computer to another. For
|
|
example, a virus designed to infect Macintosh computers cannot
|
|
infect PCs or vice versa."
|
|
|
|
"A virus cannot infect a computer unless it is booted from an
|
|
infected diskette or an infected program is run on it. Reading
|
|
data from an infected diskette cannot cause an infection."
|
|
|
|
This isn't meant to be a knock on F-PROT... they easily have one of the
|
|
best virus scanners on the market. They're just too busy keeping us
|
|
VIRUS-FREE that they simply haven't gotten around to updating this older
|
|
file! :) <Info on obtaining a copy of F-PROT is included in the SUGGESTED
|
|
SOFTWARE area of this FAQ.>
|
|
|
|
Heck, a year ago, those two quotes were standard replies to virus related
|
|
questions regarding how viruses spread, and at the time you'd be
|
|
hard-pressed to prove these quotes wrong. Now, the new realities are
|
|
setting in. The MS WORD Macro Virus Family have changed the rules.
|
|
Infection from simply reading a document is NOW possible.
|
|
|
|
So, a WORD MACRO Virus, is a collection of instructions, known as a macro
|
|
or template which WinWord <Word 6.x> executes. The list of instructions in
|
|
the macro can copy and delete files, alter them, make whole changes to
|
|
template files, drop other viruses, and execute programs, including ones it
|
|
has dropped. These Macro Viruses <as defined in section 1> aren't directly
|
|
executable. They are actually read <and interpreted and executed> by the
|
|
MS WORD WordBasic Interpreter. This is the first time a virus infection
|
|
has occurred in the mainstream user market where a file was only read <or
|
|
at least the user thought was only going to be read> for it to be
|
|
executed.
|
|
|
|
MSN - MicroSoft Network, and other similar ON-LINE services, have also
|
|
contributed to the spread of Word Macro Viruses, via a feature included in
|
|
their terminal programs, MIME-compliant mailers (e.g., Eudora). and WWW
|
|
browsers (e.g., Mosaic and Netscape). This features, allows users to
|
|
download and view .DOC files while on-line... the terminals can run the
|
|
associated program for .DOC files, <MS WORD> and therefore immediately
|
|
infect users systems. This mechanism WILL also allow the virus to be
|
|
introduced into your system via mail or a WWW page. Use such automatic
|
|
execution with caution. Had the Macro Viruses never been created, this
|
|
feature would be of benefit.
|
|
|
|
NOTE: Reading Infected documents with anything other than a copy of MS
|
|
WORD will not activate and spread the infection. For the virus to become
|
|
active, MS WORD is required, and it must be WORD that is used to view the
|
|
document. For example, NORTON UTILITIES Norton Commander <DOS> has a
|
|
document viewer, able to view 10-12 of the most popular formats for
|
|
documents, including various versions of WORKS, WORD and WordPerfect
|
|
documents. Using the viewer to read an infected document, and telling it
|
|
to use WORD 6.x format, will allow you to view the document, but will NOT
|
|
and CAN NOT execute any macros.
|
|
|
|
At the time of this writing, it was mentioned to me that MicroSoft had
|
|
released a WORD Document Viewer, that does not execute Macros, that could
|
|
be used in place of WORD for the purpose of viewing Documents while
|
|
on-line. MSN or it's affiliated BBS services should have the file
|
|
available for download.
|
|
|
|
UPDATE: Eric Phelps noted that a newer version to the WORD Viewer is now
|
|
available from MS, called WordView 7.1. Unlike it's predecessor, it will
|
|
execute some MACROS. Users who uses the Veiwer to prevent macro infection,
|
|
should stick to the previous version. This WordView 7.1 doesn't have a
|
|
NORMAL.DOt to infect, but it still allows for an entry point into your
|
|
system. Use WordView 7.1 with caution.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 2: HOW DOES INFECTION OCCUR?
|
|
===================================
|
|
|
|
Typically, a MACRO infection occurs when an infected macro instructs the
|
|
system to overwrite or alter existing system macros with infected ones, by
|
|
adding to or altering macros in the GLOBAL MACRO list, which in turn tend
|
|
to infect all documents opened and written thereafter.
|
|
|
|
When Word opens a document <.DOC>, it first looks for all included macros
|
|
in it. This is alittle misleading... MS WORD looks at the DOC, first
|
|
thinking it is a DOC, but finds that it has TEMPLATE/MACRO code <meaning it
|
|
isn't technically a document, but a template file> If it finds the AutoOpen
|
|
Macro, or other AUTO macros, Word will automatically execute this macro.
|
|
Typically, in the case of an infected .DOC file, this macro will instruct
|
|
the system to infect important key macros and template files. Those Macros
|
|
will in turn infect any documents opened thereafter. <hence the Term
|
|
VIRUS>
|
|
|
|
Typically, the FileSaveAs Macro is replaced or overwritten, so that an
|
|
infected copy can then determine how all future documents will be saved.
|
|
This means it gains the control of what file format to save in, and what
|
|
macros to include into the document. All this is seamless, and most of the
|
|
time you may not even realize this is happening. When the user executes
|
|
the FileSaveAs command, the virus (e.g., Concept) displays the *usual*
|
|
dialog box, letting the user fill in the fields for the file name,
|
|
location, type, etc. Onl *afterwards* the virus changes the type of the
|
|
file to template - so the user doesn't see anything unusual. AutoOpen and
|
|
other Macros are then included into documents. When exchanging documents
|
|
with uninfected computers, the system becomes instantly infected as soon
|
|
you try to view and load the infected document <macro/template> with a
|
|
compatible copy of MS WORD!
|
|
|
|
At the end of a WORD session, MS Word automatically saves all Global Macros
|
|
into the Global Macro File, typically the Normal.DOT file. Now all future
|
|
sessions of Word will infect documents it opens until you replace
|
|
NORMAL.DOT with an uninfected copy. <or delete the infected macros>
|
|
Otherwise, MS Word Loads, and will load infected GLOBAL MACROS before you
|
|
do a single thing. NOTE: Some macros will save to the Global macros on
|
|
their own!
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 3: KNOWN FEATURES AND LIMITATIONS OF THE WINWORD FAMILY OF VIRUSES
|
|
========================================================================
|
|
|
|
Common features of this family of viruses include the inability to save an
|
|
infected document in any format other than Word Template Format, the
|
|
documents are converted into Template format <used internally in Word, and
|
|
by the user>, and tends to disallow saving of file/document in any other
|
|
directory using the SAVE AS command<You can save the infected document
|
|
anywhere you want - when it is first infected. Only if you *load* an
|
|
*already infected* document, and *then* try to use the FileSaveAs command
|
|
on it, will Word try to force you to save it in the template directory -
|
|
because it is now a template; not a simple document.>. Most WORD MACRO
|
|
VIRUSES and TROJANS to DATE only affect ENGLISH ONLY Copies. Some
|
|
exceptions apply. In Nationalized copies of WORD, the macro language
|
|
commands have been translated to the national language, therefore macros
|
|
created with the English version of Word will not work. <makes perfect
|
|
sense to me... anyone know how AutoOpen is spelled in French? :) >
|
|
|
|
[ according to Vesselin Bontchev <bontchev@complex.is> The auto macros are
|
|
always spelled in one and the same way in al nationalized versions. It is
|
|
things like FileSaveAs that are translated ].
|
|
|
|
NOTE: PC Users will likely not notice the difference between a TEMPLATE
|
|
infected file masquerading around as a document file, as word will
|
|
recognize Macro Templates in a file regardless of the extension used by the
|
|
Template <Default *.DOT>. <Send Complaints to BILL GATES, C/O MICROSOFT
|
|
CORP.> MacIntosh Users can visually tell whether a Document is infected or
|
|
by, since infected documents appear with the template/macro icon, instead
|
|
of the normal document icon. A file that is indicated by a template icon
|
|
may simply be a harmless template, that the user has made, containing
|
|
legitimate macros. This MAC advantage will depend on how the document is
|
|
opened. Opening with the File / Open command will not help a MAC user make
|
|
the distinction. Viewing parameters for a folder will also determine
|
|
whether a MAC user will notice the template file. Viewing by size, name,
|
|
or date will not help, as the icon isn't displayed properly.
|
|
|
|
A Feature common to most viruses of this type is the ability to spread to
|
|
other platforms, making this family of viruses unique, and dangerous. They
|
|
can and will spread to almost any platform operating with a compatible copy
|
|
of MS Word 6.x+. <some exceptions apply>
|
|
|
|
Although other word processors like WordPerfect and Ami Pro do support
|
|
reading MS Word documents, they can not be infected by these viruses. These
|
|
program have the ability to read documents, but not to execute the macro
|
|
language command that may be imbedded.
|
|
|
|
It's worth noting that macro viruses whose payloads have no effect on a Mac
|
|
(PC emulators excepted) will nevertheless replicate on the Mac unless they
|
|
use one of the relatively few WordBasic functions specific to Windows in
|
|
the infection/replication routine.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 4: VIRUS EXAMPLES
|
|
=======================
|
|
|
|
There are a number of Word Macro viruses in the wild, the first and
|
|
foremost being the CONCEPT Virus. <although DMV was created first, CONCEPT
|
|
is what pushed this new breed of viruses into the wild FIRST. It was the
|
|
first to be widely recognized as a nuisance.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.1: Concept Virus :
|
|
====================
|
|
|
|
Also known by the Aliases of WW6Macro, WinWord.Concept, Word Basic Macro
|
|
Virus (WBMV), Word Macro 9508 <MAC> and Prank Macro <MicroSoft named it
|
|
Prank, to downplay the seriousness of the situation>. This was the first
|
|
MS Macro Virus to be detected by the Anti-Virus community, and the first
|
|
Macro Virus to be considered in the wild, with infections spreading to the
|
|
US, UK, France, Germany, Bulgaria, Canada, the Netherlands, Turkey, and
|
|
Finland, and other Countries.
|
|
|
|
The proliferation of this virus is widespread, mainly due to 2 companies
|
|
ACCIDENTLY shipping this virus in infected documents found on their
|
|
CD-ROMS. The first CD-ROM was...
|
|
|
|
MicroSoft Windows '95 Software Compatibility Test
|
|
|
|
which was shipped to thousands of OEM companies in mid 1995. In
|
|
August/September Microsoft distributed the Concept virus on a CD-ROM in the
|
|
UK called...
|
|
|
|
"The Microsoft Office 95 and Windows 95 Business Guide"
|
|
|
|
The infected file is \Office95\Evidence\Helpdesk.DOC, dated August 17th,
|
|
1995, <121,856 bytes> The third CD was...
|
|
|
|
Snap-On Tools for Windows NT
|
|
|
|
which was distributed by ServerWare, who immediately withdrew it, warned
|
|
recipients, and re-mastered it. MicroSoft Corp. is to be commended for
|
|
acknowledging their part in the spreading of this new virus, <calling it a
|
|
PRANK> and their effort in controlling the spread of it. They were quick to
|
|
respond to this new Virus threat with a Macro Scanner/Cleaner which is
|
|
available freely for download from MSN and associated services. <Note: it's
|
|
buggy>
|
|
|
|
This commendation should be taken with a grain of salt, as MicroSoft waited
|
|
up to two months before admitting there was a problem, down playing the
|
|
seriousness of the situation, and calling it a PRANK Macro, not befitting
|
|
an acknowledgment as a REAL virus in their view. MS in turn requested help
|
|
from AV insiders, and subsequently released their own flawed FIX. AV
|
|
people wanted info regarding internal information of the WORDBASIC Macro
|
|
Template Format.
|
|
|
|
Such help wasn't forthcoming, at least not until months later. During the
|
|
whole time that the bulk of the AV people waited for help, MS cited their
|
|
FIX as being the only thing that CAN deal with this new virus, and that
|
|
Current AV Products were useless. <not the first time MS has thrown rocks
|
|
at competitors...> The statement from MicroSoft is only partially true, as
|
|
a number of AV companies figured out the Macro format on their own, and
|
|
released their own fixes. Those of us who are used to dealing with
|
|
MicroSoft would agree that 5 months of waiting, being told you're wrong,
|
|
then finally getting the help you asked for was "a quick response". :)
|
|
|
|
A CONCEPT Infection is easy to notice, on the first execution of the virus
|
|
infected document (on the first opening of the infected file) the
|
|
MessageBox appears with digit "1" inside, and "Ok" button. Also, simply
|
|
checking the TOOLS/MACROS option to check loaded macros, the presence of
|
|
concept is apparent by the appearance of these 5 macros :
|
|
|
|
AAAZFS *
|
|
AAAZAO *
|
|
AutoOpen
|
|
PayLoad *
|
|
FileSaveAs
|
|
|
|
NOTE: Using the Tools/Macro option to view in memory macros can be
|
|
misleading, and dangerous, as some viruses will intercept this call. The
|
|
Tools/Macro option should be used with caution with all viruses, and
|
|
shouldn't be considered as a genera way to look for macro viruses. The
|
|
Colors virus for example intercepts this comman and activates if it is
|
|
used.
|
|
|
|
You may be currently using legitimate macros that go by the names of
|
|
AutoOpen and FileSaveAs, so these two may not be out of place. However, it
|
|
is unlikely that you use legitimate macros with names like Payload, AAAZFS,
|
|
and AAAZAO. These 3 are the clearest signs of an infection.
|
|
|
|
Note: As has been noted in some press releases, the virus code is simple
|
|
for a novice to modify, so variants may also be present or appear soon.
|
|
The Macros are UNEnencrypted, and are easily viewable.
|
|
|
|
The following Text strings are in the infected documents...
|
|
|
|
see if we're already installed
|
|
iWW6IInstance
|
|
AAAZFS
|
|
AAAZAO
|
|
That's enough to prove my point
|
|
|
|
Also, the line...
|
|
|
|
WW6I=1
|
|
|
|
is added to WINWORD6.INI on infected systems.
|
|
|
|
The Concept Virus is able to run on compatible systems running Microsoft
|
|
Word for Windows 6.x and 7.x, Word for Macintosh 6.x, as well as in Windows
|
|
95 and Windows NT environments. In Macintosh Word, infected documents
|
|
appear with the template icon, rather than the usual document icon.
|
|
|
|
NOTE TO WINDOWS '95/WORD '95 USERS: Those of you who are running Windows
|
|
95 and Word 95, and have Word set up to act as your Exchange mail program;
|
|
<WordMail.> are protected from the spreading abilities of CONCEPT, as
|
|
WORDMAIL disables the capability that lets Concept spread, so you cannot
|
|
get infected by reading mail with WordMail. However, if an incoming message
|
|
has an attached infected Word document, and you double-click on that
|
|
document to open it in Word, you will get infected.
|
|
|
|
F-Prot has made an Anti-Viral FIX for this ONE virus, known as WVFIX. It
|
|
detects a Concept Infection, and can make modifications to WORD settings on
|
|
PC's to prevent further re-infection by this one virus. Available now
|
|
from...
|
|
|
|
Data Fellows FTP URL
|
|
ftp://ftp.datafellows.fi/pub/f-prot/wvfix.zip
|
|
|
|
and...
|
|
|
|
Command Software System's FTP site
|
|
ftp://ftp.commandcom.com/pub/fix/wvfix.zip.
|
|
|
|
and is included on F-PROT for DOS Diskettes. If you don't have F-PROT
|
|
Professional which detects this virus, you can detect it manually with
|
|
older F-PROT versions, by placing the following 2 lines into your F-PROT
|
|
USER.DEF file, found in your F-PROT for DOS Directory...
|
|
|
|
CE WordMacro/Concept
|
|
646F02690D6957573649496E7374616E63650C67
|
|
|
|
then turn on the USER-DEFINED section of the Targets menu, and add *.DO? as
|
|
an extension to scan for, or scan for ALL FILES. If F-PROT finds an
|
|
infected document with this method, use WVFIX to do an additional scan of
|
|
to confirm infection, as legitimate documents may get flagged using the
|
|
above search string.
|
|
|
|
SOPHOS SWEEP users can add detection of this virus to their older scanners
|
|
by executing Sweep in full Mode with the following <meant as one line, but
|
|
displayed below as 2...> command...
|
|
|
|
SWEEP C:\*.* -F -REC
|
|
-PAT=575736496e666563746f720606646f026904734d65240c67
|
|
|
|
Sweeps SWEEP.PAT file can also hold this pattern for you, so that you do
|
|
not need to type it out every time you wish to scan. Add the following to
|
|
the SWEEP.PAT file using an ASCII Text Editor...
|
|
|
|
Concept 5757 3649 6e66 6563 746f 7206 0664 6f02 6904 734d 6524 0c67
|
|
|
|
Users of IBM's Anti-Virus can add protection to their system for this Virus
|
|
Manually, or can acquire updated copies of AntiVirus from IBM. To Manually
|
|
add detection of CONCEPT to IBM AntiVirus add the following three lines to
|
|
an ADDENDA.LST file in the same directory as VIRSIG.LST
|
|
|
|
07734D6163726F24126A0D476C6F62616C3A4141415A414F
|
|
%s the WordMacro.Concept %s
|
|
DOC and DOT (COM format) files. Mismatches=0. No fragments.
|
|
|
|
Then use the "Check System" dialog to add "*.DOT" to the list of patterns
|
|
to check, or simply instruct IBM Anti-Virus to scan ALL FILES.
|
|
|
|
PC Users can also acquire the Macro Virus Protection Tool. (On CompuServe
|
|
or AOL, GO MS; on Microsoft Network, GO MACROVIRUSTOOL.) Follow the
|
|
instructions to run the file. It will look for macro viruses, both among
|
|
your macros, and any documents you specify. It will also install special
|
|
macros that will help prevent any further infection.
|
|
|
|
If you use SCAN.DOC, make sure that your copy of the "cleanall" macro is
|
|
not one of the early releases which contained a typo! Look for the line
|
|
Dlg.Pat$ = "*.doc;*.dot" used to set up the ".Name" argument for FileFind.
|
|
There should be NO space between the semicolon and the second asterisk. A
|
|
space here (found in early releases) prevents looking for ".DOT" files.
|
|
|
|
Microsoft has also made software available to counter this virus <on MACS>,
|
|
obtainable via the WWW from...
|
|
|
|
<http://www.microsoft.com/kb/softlib/mslfiles/mw1222.hqx>
|
|
|
|
and via ftp from...
|
|
|
|
<ftp://ftp.microsoft.com/softlib/mslfiles/mw1222.hqx>.
|
|
|
|
This FIX from Microsoft only renames the virus rather than removing it.
|
|
Also note that the file system scan function supplied ("Scan.doc") may not
|
|
actually find every occurrence of infected files on a Macintosh. A few
|
|
others vendors of major Macintosh anti-virus software are planning minor
|
|
releases of their products to cope with this virus or help identify its
|
|
presence.
|
|
|
|
If you need additional information, call Microsoft Product Support Services
|
|
at...
|
|
|
|
206-462-9673 for Word for Windows
|
|
206-635-7200 for Word for the Macintosh
|
|
|
|
or send an Internet e-mail message to...
|
|
|
|
wordinfo@microsoft.com
|
|
|
|
Further info on CONCEPT Virus <albeit with an emphasis on the DOS, OS/2 and
|
|
Windows environments> is available from IBM's WWW server:
|
|
|
|
<http://www.research.ibm.com/xw-D953-wconc>.
|
|
|
|
Note: A Personal Solution for this Virus is possible. Simply make 2 dummy
|
|
macros <they don't need to do anything>, one as Payload, the other as
|
|
FileSaveAs. This virus checks for the presence of these macros, and if
|
|
found, DOES NOT infect your system<The virus checks for the presence of
|
|
*either* of these macros, so usin just one (any) of them is sufficient>.
|
|
This is a CONCEPT virus solution only, and will likely become useless with
|
|
any future variants of Concept.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.2: Nuclear :
|
|
==============
|
|
|
|
Known widely as Winword.Nuclear, Wordmacro-Nuclear and Wordmacro-Alert.
|
|
This virus was the first WordMacro virus to infect <or at least to attempt
|
|
to infect> both data/documents <Word Documents .DOT and .DOC> as well as
|
|
executables <.COM/.EXE/NEWEXE>
|
|
|
|
In truth, it is 2 viruses, a macro virus which alters the Operating
|
|
Environment of WORD, and an executable file infector <as well as a system
|
|
file deleter>. This makes NUCLEAR the first Macro Virus to also
|
|
incorporate, or at least try to incorporate a classic File Infector Virus.
|
|
This virus is actually quite ineffective in the destructive sense, detailed
|
|
later in this document. The infected documents contains the following nine
|
|
Macros...
|
|
|
|
AutoExec
|
|
AutoOpen
|
|
FileSaveAs
|
|
FilePrint
|
|
FilePrintDefault
|
|
InsertPayload *
|
|
Payload *
|
|
DropSuriv *
|
|
FileExit
|
|
|
|
which get copied into the GLOBAL Macro List.
|
|
|
|
General detection of NUCLEAR is easy, simply view the macros listed under
|
|
the Macros command under the Tools Menu. If Macros "InsertPayload",
|
|
"Payload", and "DropSuriv" are listed, then you'll likely have a NUCLEAR
|
|
infection. <unless you named legitimate macros with the same names... :) >
|
|
NUCLEAR hides itself from detection, by disabling the "PROMPT FOR CHANGES
|
|
TO NORMAL.DOT" option. Changes are made, and the user doesn't notice
|
|
anything.
|
|
|
|
NOTE: Use of the TOOL/MACRO command can be dangerous. Some viruses subvert
|
|
this command. Use with caution. Use AV software to find and delete
|
|
infected macros.
|
|
|
|
The "InsertPayload" Macro will cause the following text to be added to the
|
|
end of printouts when printing documents. Every 12th printout will have the
|
|
following text added...
|
|
|
|
And finally I would like to say:
|
|
STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC!
|
|
|
|
which is appended to the file after the command to print is issued but
|
|
prior to the actual printing. FAX's sent via a FAX Print Driver will also
|
|
be affected, this much I know first hand. From testing, I came to the
|
|
realization that some Vx putz will start messing with my outgoing faxes
|
|
behind our backs.
|
|
|
|
Another included Macro, is "Payload" which tries to delete IO.SYS,
|
|
MSDOS.SYS and COMMAND.COM on April 5th. It is ineffective, as WordBasic
|
|
can't reset the attributes of a file which has the System attribute set.
|
|
It has been noted that a variant that does work is being circulated.
|
|
|
|
The Second part of the Nuclear Virus is the executable infector. The
|
|
DropSuriv Macro checks system time, and will attempt to drop the file
|
|
infector between 17:00/18:00. However, the routine is flawed, and
|
|
shouldn't work on any system. <fails due to a syntax error - not closed IF
|
|
statement, which makes this payload never executed> If DropSuriv DID work
|
|
properly, it would search for the standard DOS util DEBUG.EXE, if found,
|
|
the macro drops PH33r.SCR & EXEC_PH.BAT. The Bat File is executed, and
|
|
then the hex dump file PH33r.SCR is converted from a DEBUG script into an
|
|
executable, and is in turn executed. Later, the .SCR and the .BAT files
|
|
are deleted to cover its tracks. The File infector then hooks INT 21h and
|
|
writes itself at the end of COM/EXE/NewEXE files. <however, the memory is
|
|
released once this DOS task is completed, includes the memory resident
|
|
virus Ph33r> Unconfirmed reports state that a NUCLEAR infected Macro with a
|
|
fully operational DropSuriv Macro exist.
|
|
|
|
The following text strings are in the executable infector...
|
|
|
|
=Ph33r=
|
|
Qark/VLAD
|
|
|
|
SOPHOS SWEEP users can use a user-defined search string to find NUCLEAR,
|
|
simple by executing the following command <the following 2 lines are
|
|
actually ONE log one> using Sophos' SWEEP in full mode...
|
|
|
|
SWEEP C: -F -ALL
|
|
-PAT=63e6e5e5ee8fe6e3e48fefe3fd87b1c98aeaad8ca7918c93
|
|
|
|
Discovered on the internet, the discovered infected file ironically was
|
|
supposed to provide info on a previous Macro Virus, Concept. Mac Users
|
|
will notice an infected document, since infected documents appear with the
|
|
template icon, instead of the usual document icon.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.3: Colors:
|
|
=============
|
|
|
|
Colors, is the first WINWORD Macro Virus that could be called cute <IMHO>.
|
|
This Virus has the noticeable ability to alter the Windows colors settings.
|
|
Mac Word is immune to the payload <the system colors attack> but is still
|
|
susceptable to the infection mechanism, which will attack documents.
|
|
Detection of infections is easy, as infected documents appear with the
|
|
template icon, rather than the usual document icon.
|
|
|
|
Commonly known as Rainbow or WordMacro.Colors, this virus was freely posted
|
|
to usenet newsgroups on October 14th, 1995. The Colors Virus will infect
|
|
the global template <usually NORMAL.DOT> upon opening of an infected
|
|
document. An infected document contains the following macros:
|
|
|
|
AutoOpen
|
|
AutoClose
|
|
AutoExec
|
|
FileNew
|
|
FileExit
|
|
FileSave
|
|
FileSaveAs
|
|
ToolsMacro, and other macros.
|
|
|
|
All Macros included in COLORS are Execute-Only, and cannot be viewed or
|
|
edited by MicroSoft Word. If normal "clean" macros with the same names
|
|
existed prior to infection, they will be overwritten by COLORS.
|
|
|
|
The AutoExec Macro of COLORS is an EMPTY Macro, possibly designed to defeat
|
|
any ANTI-MACRO-VIRUS schemes developed by the AV community. It
|
|
accomplishes this by overwriting a "CLEANING/SCANNER" AutoExec Macro with
|
|
COLORS empty one, effectively making the AV Scanner/Cleaner useless. The
|
|
Cleaner Provided by Microsoft would fall victim to this attack, and
|
|
subsequently be rendered useless.
|
|
|
|
COLORS will also enable AutoMacros in case you were smart and disabled
|
|
them! It will also disable the MS Word's Prompt to save changes to
|
|
NORMAL.DOT.
|
|
|
|
COLORS is crafty, as it can spread without the use of AUTO macros... thus
|
|
defeating the DISABLE AUTOMACROS Feature. It does so via the Macros:
|
|
|
|
File/New
|
|
File/Save
|
|
File/SaveAs
|
|
File/Exit
|
|
Tools/Macro
|
|
|
|
COLORS will infect NORMAL.DOT whenever a user chooses any of the above
|
|
functions. It also has limited stealth ability, earning it the title of
|
|
being the first WINWORD STEALTH MACRO VIRUS. It accomplishes it's stealth
|
|
actions, by hiding itself from the active listing, since attempting to view
|
|
active macros would run the COLORS infected Tools/Macro, thus hiding it's
|
|
own presence while simultaneously infecting your system. However, deleting
|
|
these macros is easy, simply use the File/Templates/Organizer/Macros to
|
|
view the names of virus' macros and delete them.
|
|
|
|
The COLORS virus will keep track of infections via a counter, named
|
|
"countersu", which can be found under the [Windows] section of the WIN.INI
|
|
file. Whenever an infected macro is executed, the counter is incremented
|
|
by a count of one. It quickly adds up, when you consider how much you
|
|
OPEN, CREATE, SAVE, EXIT, and CLOSE documents. When the increment counter
|
|
reaches 299, and every 300th execution thereafter, COLORS will be
|
|
triggered. COLORS will then make changes to the system colors setup,
|
|
including text, background, borders, buttons, etc., using randomly
|
|
determined colors. The new color scheme becomes apparent to the user
|
|
during the next session of Windows.
|
|
|
|
NOTE: MicroSoft Word for Macintosh is immune to this effect. In Macintosh
|
|
Word, infected documents appear with the template icon, rather than the
|
|
usual document icon, which alerts the user to this infection. Only Copies
|
|
of WORD running on a Windows OS or Windows Operating Environments will
|
|
suffer these effects. PPC Macs running emulation software that allows
|
|
Windows and Windows WORD 6.x to run could be hit by this payload. <Does
|
|
current PPC MAC allow for Windows and Word to be run on it??? >
|
|
|
|
Colors ability to spread without the use of AutoExecute Macros, and its use
|
|
of Advanced Stealth techniques signals a new level of MACRO virus
|
|
technology. <Hiding itself from view when you actively look for it defines
|
|
STEALTH in my book, since it evades detection> It also adds fuel to the VxD
|
|
argument, as an on access scanner could prevent infection by this type of
|
|
stealthy virus. NOTE: Check SUGGESTED SOFTWARE section for AV developers
|
|
with VxD scanners
|
|
|
|
F-Prot Users should note that F-PROT Professional 2.20 is not able to
|
|
detect the Colors macro virus, but you can detect it manually by following
|
|
the same method used in the CONCEPT section of this FAQ for Scanning with
|
|
F-PROT and it's user Defined Strings. In this Case, use the following 2
|
|
lines, which are to be added to your USER.DEF file.
|
|
|
|
CE WordMacro/Colors
|
|
0100066D6163726F730100084175746F45786563
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.4: DMV:
|
|
=========
|
|
|
|
Commonly known as WordMacro.DMV, DMV is an unremarkable TEST Virus,
|
|
possibly the first to be created using the WORDBasic Language. Joel
|
|
McNamera wrote it in the fall of 1994, as a real time TEST for some MACRO
|
|
Virus Theories. The Virus was kept under wraps, and a detailed paper was
|
|
published. This TEST virus was only released, as an educational aid, after
|
|
the CONCEPT virus was discovered. DMV isn't a threat to anyone, as it
|
|
announce itself upon infecting the system.
|
|
|
|
MAC Word Users can visually detect DMV, since infected documents will
|
|
appear with the template icon, instead of the usual document icon.
|
|
|
|
The Writer of DMV is rumored to be playing with some EXCEL Viruses, based
|
|
on details he published about a virus that would infect MicroSoft EXCEL
|
|
Spreadsheet Files. <anyone get the feeling 6 months from now I'll be
|
|
writing an EXCEL MACRO Virus FAQ ??? :) >
|
|
|
|
[ DOES ANYONE HAVE THE PUBLISHED PAPER? ]
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.5: HOT:
|
|
=========
|
|
|
|
Also known as WORDMACRO HOT, WinWord.Hot.
|
|
|
|
Not the most ingenious of the Macro Virus Family, it's biggest kick, is the
|
|
ability to wait or sleep for awhile <up to 14 days> and then delete a file.
|
|
WordMacro/Hot appears to be the first Word macro virus written in Russia.
|
|
It was found in the wild in Russia in January 1996.
|
|
|
|
Infected documents contain four execute-only macros:
|
|
|
|
AutoOpen
|
|
DrawBringInFrOut
|
|
InsertPBreak
|
|
ToolsRepaginat.
|
|
|
|
MacIntosh Word Users will notice HOT, by examining the icon of the file...
|
|
infected documents appear with the template icon, normal documents appear
|
|
with the normal document icon.
|
|
|
|
NOTE: WordMacro/Hot appears to be the first macro virus to use external
|
|
functions, allowing Word macros to call any standard Windows API call.
|
|
This makes the spreading function Windows 3.x specific, preventing Word for
|
|
MAC and Word 7 for Win '95 from spreading the Virus. An error dialog will
|
|
be displayed under Microsoft Word 7.0.
|
|
|
|
Unable to load specified library
|
|
|
|
HOT activates automatically via it's AutoOpen Macro <assuming no attempt to
|
|
disable AutoMacros has been made> adding a line LIKE...
|
|
|
|
QLHot=34512
|
|
|
|
to Ms Word for Windows 6's WinWord6.INI file, which acts as a counter
|
|
recorder system, setting a date 14 days in the future for payload
|
|
activation.
|
|
|
|
HOT then copies the included macros to the Global Template, NORMAL.DOT
|
|
usually, revising their names...
|
|
|
|
AutoOpen ==> StartOfDoc
|
|
DrawBringInFrOut ==> AutoOpen
|
|
InsertPBreak ==> InsertPageBreak
|
|
ToolsRepaginat ==> FileSave
|
|
|
|
A listing of the currently loaded macros in this infected environment will
|
|
reveal the names in the right list. Loading another infected document
|
|
<actually a template> will add the left list to the macro list plus the
|
|
right list. NOTE: Macros have been saved with the 'execute-only'
|
|
feature, which means that a user can't view or edit them.
|
|
|
|
A clean <AutoMacros disabled> WORD environment will produce the left list
|
|
when viewing an infected document.
|
|
|
|
HOT's FileSave macro cause the virus to randomly decide within 1-6 days
|
|
from the infection date to activate whenever an effort to open files is
|
|
made. Upon activation, a document will have it's contents deleted, by
|
|
opening it, slecting the entire contents, delting them, and closing the
|
|
document, saving it in it's now empty state.
|
|
|
|
Users with c:\DOS\EGA5.CPI should be protected from this macro, as the
|
|
author included a check for this file as a protective measure, noted in the
|
|
source code as follows:
|
|
|
|
'---------------------------------------------------------------
|
|
'- Main danger section: if TodayNo=(QLHotDateNo + RndDateNo) ---
|
|
'- and if File C:DOSega5.cpi not exist (not for OUR friends) ---
|
|
'---------------------------------------------------------------
|
|
|
|
HOT's InsertPBreak Macro inserts a page-break in current documents, which
|
|
is used as a sign of a document already being infection by HOT.
|
|
|
|
NOTE: WordMacro/Hot relies on the existence of KERNEL.EXE
|
|
|
|
To clean existing in memory infected macros, use the TOOLS/MACROS/DELETE
|
|
function to delete all infected macros. Do the same for Document you find
|
|
that are infected, by doing so from a session of word with AutoMacros
|
|
Disabled, and using the Tools/Macros/Delete function.
|
|
|
|
NOTE: Use of the TOOL/MACRO command can be dangerous. Some viruses subvert
|
|
this command. Use with caution. Use AV software to find and delete
|
|
infected macros.
|
|
|
|
SOPHOS SWEEP Users can add detection NOW to their scanner with the line...
|
|
|
|
Winword/Hot a186 9dad 889d 8ca7 86cd e58e 0369 ec8e ee69 ec8e
|
|
e868 ecef
|
|
|
|
<the above 2 lines are to be entered as one line> by adding the line to
|
|
SWEEP.PAT, then scanning in FULL MODE <-f>
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.6: MS WORD 2/MS WORD 6.x MACRO TROJAN WEIDEROFFEN:
|
|
====================================================
|
|
|
|
This is a new MACRO Trojan, <that's been around for 2 years> that goes by
|
|
the alias WinWord.Weideroffnen. It is technically a WinWord 2 infected
|
|
document, that works eqwually well under MS WORD 6.x. It intercepts
|
|
AutoClose, and attempts to play tricks with boot-up file AUTOEXEC.BAT. It
|
|
is rumored to exist in Germany, known locally in Germany as "Weideroffen
|
|
Macro Virus" No other information is available at this time, other than the
|
|
post by Graham Cluley, which states...
|
|
|
|
"Dr Solomon's FindVirus has been detecting this virus for a while (I
|
|
think we call it WinWord.Weideroffnen). Our WinGuard VxD can also
|
|
intercept documents infected with it thus stopping an outbreak dead
|
|
in its tracks"
|
|
|
|
Since it basically goes after AUTOEXEC.BAT, Mac users have nothing to fear
|
|
from this trojan macro. PC users on the otherhand... :)
|
|
|
|
Please have mercy on us Graham <Graham.Cluley@uk.drsolomon.com>, and
|
|
provide some more info... :)
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.7: AMI PRO 3.0 MACRO VIRUS GREEN STRIPE
|
|
=========================================
|
|
|
|
NOTE: THIS IS NOT AN MS WORD MACRO VIRUS! IT IS INCLUDED IN THIS FAQ FOR
|
|
THE PURPOSE OF HELPING THE PUBLIC. THIS FAQ IS PRIMARILY WORD MACRO BASED,
|
|
BUT MAY BE ALTERED IN THE FUTURE, IF MACRO VIRUSES APPEAR IN INCREASING
|
|
NUMBERS FOR OTHER MAJOR PROGRAMS, LIKE EXCEL, AMIPRO, ETC.
|
|
|
|
Also known as AMIMACRO GREENSTRIPE. The name of this virus comes from it's
|
|
main macro procedure, called Green_Stripe_virus.
|
|
|
|
Quite possibly the first Macro Virus to hit the AMI PRO 3.0 Word Processor,
|
|
GREEN STRIPE, was first reported to Computer Weekly, by those who first
|
|
detected it Reflex Magnetics. <reported to A.C.V by David Phillips
|
|
(D.Phillips@open.ac.uk) > Reflex Magnetics is reported to has a program
|
|
able to detect this virus available on their WEB sites by the time you read
|
|
this.
|
|
|
|
Ami Pro Macros are somewhat different than their WORD equivalents, as an
|
|
AMI PRO MACRO is a totally separate file, whereas WORD Macro viruses turn
|
|
documents into combination files, part data, part macro. The Ami Pro
|
|
macros are stored in a separate file, with the SMM extension. This makes
|
|
it difficult to spread an AMI PRO virus, as it is likely to not get copied
|
|
with the normal document, effectively disabling the virus.
|
|
|
|
Ami Pro's File/Save and File/Save As commands are intercepted by Green
|
|
Stripe, and used to infect all documents in comes in contact with. You
|
|
could say that GREEN STRIP is the first COMPANION MACRO VIRUS, as it
|
|
doesn't even touch the original document.
|
|
|
|
NOTE: Using File/Save As and saving an infected document to a network drive
|
|
or a floppy is the only likely way this virus will spread from a machine to
|
|
another.
|
|
|
|
When an infected document is loaded, it has a link to an AMI PRO auto-macro
|
|
file of the same name <as the document> but different extension. This
|
|
macro is then executed, and attempts to open ALL other documents in the
|
|
same directory <to infect them> This is apparent to the user, as they can
|
|
see this happening on the screen! It is reported to do a Search and
|
|
Replace on SAVE, searching and replacing all occurances of "Its" with "
|
|
It's". Reportedly, this fails to work properly.
|
|
|
|
GREEN STRIPE was first Published in Mark Ludwigs virus writing newsletter,
|
|
this virus makes itself obvious to the user, since it attempts to infect
|
|
all files found in AMI PRO 3.0 Document Directory, during the initial
|
|
infection process which takes a long time, and the user is likely to
|
|
notice that something is going on,.
|
|
|
|
NOTE: Removal of AMI PRO 3.0 infected macros is simple, just delete the
|
|
macro from the directory. To see if a Macro has been attached to a
|
|
document, simply open the Tools/Macros/Edit menu and check whether the
|
|
document has a .SMM macro file assigned to be executed on open. If you
|
|
find one, delete it <unless YOU created a legitimate macro>
|
|
|
|
Documents and Macros in AMI PRO are ASCII files, making viewing and
|
|
detection of infected macros easy using any other program other than AMI
|
|
PRO. This virus is difficult to spread, as the path to the Macro is
|
|
hard-coded, preventing the macro from spreading if programs other than AMI
|
|
PRO are used to move it about.
|
|
|
|
Thanks to Vesselin Bontchev <bontchev@complex.is> and Dr David Aubrey-Jones
|
|
<davidj@reflexd.demon.co.uk> for detailing this virus.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.8 WORDMACRO ATOM / ATOMIC
|
|
=============================
|
|
|
|
This is a new Macro Virus, found in February 1996, which works along the
|
|
same general ideas as the original Concept virus. The WordMacro/Atom virus
|
|
is not known to be in the wild.
|
|
|
|
The differences, when compared to the Concept Virus, follows:
|
|
|
|
- All the macros in this virus have been marked EXECUTE ONLY,
|
|
making them encrypted
|
|
- Replication occures both during file openings, and file saves.
|
|
- Atom comes with 2 destructive payloads
|
|
|
|
On December 13th, it's first point of activation occures. It will attempt
|
|
to delete all files in the current file directory.
|
|
|
|
The second activation, password protects documents, restricting the users
|
|
access to their own documents. This happens when the system clock seconds
|
|
counter equals 13, and a File/Save As command is issued. The passowrd
|
|
assigned to the documents is ATOM#1.
|
|
|
|
If the user disables AUTOMACROS, Atom will be unable to execute and spread
|
|
to other documents. Enabling the Prompt To Save NORMAL.DOT will prevent
|
|
Atom from attacking and infecting the NORMAL.DOT file.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
4.9 FORMATC MACRO TROJAN
|
|
==========================
|
|
|
|
Also known as WORDMACRO.FORMATC, and FORMAT.C.Macro.Trojan
|
|
|
|
The FORMATC Macro Virus, isn't ieven a virus, as it DOES NOT SPREAD. This
|
|
makes it another MACRO TROJAN. This Trojan contains only one macro,
|
|
AutoOpen, which will be executed automatically when a document is opened.
|
|
The Macro AutoOpen, is READ ONLY, making it encrypted, and unreadable and
|
|
editable. It is visiable in the Macro List.
|
|
|
|
When FORMATC is executed, "triggered", it will run a dos session, in a
|
|
minimized DOS box. It will run an Unconditional Format of the C drive.
|
|
|
|
NOTE: Get your hands on some up to date scanners, and pre-screen all
|
|
documents. Also acquire some AV VxD's, as they should prevent the Trojan
|
|
from wiping your drive clean.
|
|
|
|
Thanks to Symantec for providng the info on this trojan.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 5: STRATEGY FOR CLEANING AND PREVENTING WORD MACRO INFECTIONS:
|
|
=====================================================================
|
|
|
|
The best Strategy for dealing with this new VIRUS Menace, is to acquire at
|
|
least one, maybe even a couple decent Anti-Virus products. This is a good
|
|
idea whether you are dealing with classic viruses, or this new MS WORD
|
|
MACRO family of viruses. If you have some of the popular virus scanners,
|
|
you can add macro virus signature definitions to them from the previous
|
|
sections of this FAQ, or acquire updated copies of your favorite AV
|
|
programs, which should have them built in.
|
|
|
|
Some products are now including Windows Mode VxD Virtual On-access
|
|
Scanners, that run co-operatively with Windows. <insert bad joke about
|
|
windows reliability here :) > These VxD's tend to have the same
|
|
capabilities as the classic scanners. Others that don't yet include VxD's
|
|
are also worth acquiring, as the command-line scanners are some of the best
|
|
in the industry. Most of the Virus Scanners Listed in the SUGGESTED
|
|
SOFTWARE area of this FAQ will in the worst case detect known MACRO
|
|
Viruses, and at best, clean existing infections, and prevent future
|
|
infections by MACRO viruses.
|
|
|
|
The Following AV products now include an option to Scan for Word Macro
|
|
viruses, Including F-PROT, TBAV, AVP, AVTK, SOPHOS SWEEP, McAFEE, and
|
|
others. Fans of ChekMate will be glad to hear about CkekMate.DOC, part of
|
|
the CHECKMATE 2.00 Generic Anti-Vitus Package, which will detect and
|
|
prevent Macro infections.
|
|
|
|
Learning to scan documents as well as program files will now be necessary
|
|
to maintain a clean system environment. So, keeping these new viruses out
|
|
of your system isn't really any harder than keeping standard viruses out.
|
|
Most of these products are listed in the SUGGESTED SOFTWARE area of this
|
|
FAQ.
|
|
|
|
A file, SCAN831.zip, common on various AV FTP Sites on the internet, can
|
|
deal with the WORD.Concept <Prank> virus. Unzipping it into the Winword
|
|
directory, and opening the included document SCAN831.DOC, will check your
|
|
documents for the presence of Concept. NOTE: This is only a solution for
|
|
preventing/removing Concept Infections. Also, Windows '95 users will need
|
|
to dump the contents of their Start Menu document menu, and remove desktop
|
|
shortcuts before using this solution. NOTE: This `fix' distributed by
|
|
Microsoft isn't complete - there are ways to open documents (like from the
|
|
recently used files list) that don't trigger the protection macros.
|
|
|
|
Fans of Symantec can download a free copy of REPAIR.ZIP, which contains
|
|
virus definition files for the macro viruses. You can use REPAIR.ZIP with
|
|
either NAV 95 or NAV 3.0. NOTE: To detect the MS Word macro viruses, scan
|
|
your hard drive from DOS only; either version of NAV will not detect them
|
|
from within Windows.
|
|
|
|
Disinfectant For the MAC, although a great AV product, doesn't generally
|
|
address macro viruses or hypercard infectors. <At least it didn't the last
|
|
time I played with a MAC :) > Disinfectant does not deal with non-machine
|
|
code viruses, so no update is needed. Mac users will want to contact some
|
|
of the AV producers listed below, as many of them are now offering MAC AV
|
|
solutions which DO deal with MS WORD MACRO VIRUSES. Some of the Word macro
|
|
viruses will work at least in part on a MAC, Dr Solomon's Anti-Virus
|
|
Toolkit for Macintosh will detect such infections, and will detect PC Boot
|
|
Sector Viruses. Mac Users will have one advantage fighting and finding
|
|
WORD MACRO VIRUSES, since MAC displays the icon of the data files, users
|
|
will notice that infected documents appear with the template icon, rather
|
|
than the usual document icon.
|
|
|
|
A Good Back-Up routine is also a sensible addition to any AV strategy. No
|
|
AV product is perfect, especially against new and unknown Viruses <unless
|
|
you are ZVI NETIZ, his AV products catch 100% of all viruses, including the
|
|
cold viruses you've suffered with this winter! Unfortunately ZVI's product
|
|
will delete all copies of your SOFIA files :) >
|
|
|
|
It is often preferable to replace infected files with clean uninfected
|
|
copies, regardless of format, than to execute a "cleansed" file, that may
|
|
be corrupt, or at least unstable. This is good advice for standard
|
|
executables.. but MS WORD docs can be cleaned most of the time simply by
|
|
removing the infected macros, and saving the file as a NORMAL Document!
|
|
|
|
Personal MACRO VIRUSES PREVENTION...
|
|
|
|
For those of you who would rather deal with the MACRO problem yourself,
|
|
without using one of the recommended products, there are a few things you
|
|
can do to add an extra measure of security <although it is really a false
|
|
sense of security...>
|
|
|
|
Disabling of AutoOpen Macros is possible by invoking the Word system Macro
|
|
DisableAutoMacros. An once of prevention equals a pound of cure. :) NOTE:
|
|
this can be disabled by some Macro viruses. :(
|
|
|
|
The Manual for WORD for Windows says you can also do this from the command
|
|
line, by executing WORD with the following command...
|
|
|
|
WINWORD.EXE /mDisableAutoMacros
|
|
|
|
However, due to a Flaw, Feature, or Bug <Gotta Love MS> this doesn't appear
|
|
to work! Thanks MS! :(
|
|
|
|
The Manual also states that holding <SHIFT> while opening documents will
|
|
prevent any AutoExecute type macros from running, but this suggestion also
|
|
doesn't appear to work! Thanks Again MS! :(
|
|
|
|
Or better yet, you could create your own AutoExec Macro, it isn't hard,
|
|
simply select the TOOLS Menu, hit the MACRO command, and create a new macro
|
|
call "AutoExec". Alter line 3 as you see fit...
|
|
|
|
Sub Main
|
|
DisableAutoMacros
|
|
MsgBox "MS WORD AutoMacros Disabled.", "Some Protection!", 64
|
|
End Sub
|
|
|
|
or...
|
|
|
|
Sub Main
|
|
DisableAutoMacros
|
|
MsgBox "MS WORD AutoMacros Disabled!", 0
|
|
End Sub
|
|
|
|
The second macro should display the message in the status line. <I hope>
|
|
:)
|
|
|
|
NOTE: Use of the TOOL/MACRO command can be dangerous. Some viruses subvert
|
|
this command. Use with caution. Use AV software to find and delete
|
|
infected macros.
|
|
|
|
This method will effectively prevent CONCEPT, HOT, DMV, and NUCLEAR word
|
|
macro viruses from infecting the WORD environment, by fooling these 3
|
|
viruses into thinking they've already infected your system. It also
|
|
Disables AutoMacros, which will help with some Macro infectors. This is a
|
|
temporary fix, as WORD gives priority to macros in documents over system
|
|
macros. <MS will need to ship an update to WORD for all platforms that
|
|
will give control back to the users. Can you all say WORD '99? >
|
|
|
|
All legitimate owners of copies of MS WORD should CALL MICROSOFT Support
|
|
staff, and let them know you want an updated copy WORD. Let them know you
|
|
want the BUGS FIXED. It's your right! Call Microsoft Product Support
|
|
Services at 206-462-9673 for Word for Windows, or send an Internet e-mail
|
|
message to wordinfo@microsoft.com <wonder if we could cause a class action
|
|
suit....>
|
|
|
|
Another option is to check the TOOLS/OPTION Menu and set it to prompt
|
|
before saving NORMAL.DOT. Setting the File Attributes of the file to
|
|
read-only may help, but anyone going to the effort of writing a Macro Virus
|
|
can easily disable that attribute. <and if you've read this FAQ, you also
|
|
know that some macro viruses can enable AutoMacros even if you specifically
|
|
disable them! :( >
|
|
|
|
NOTE: Use of the TOOL/MACRO command can be dangerous. Some viruses subvert
|
|
this command. Use with caution. Use AV software to find and delete
|
|
infected macros.
|
|
|
|
AMI PRO 3.0 Users, who want to clean their system of infected AMI PRO 3.0
|
|
GREEN STRIPE MACROS, need only look in their document directory, and delete
|
|
and infected macros <which will have the same names as documents> Note:
|
|
detection of GREEN STRIPE infection is easy, view all macros with a NON-AMI
|
|
PRO viewer, like DOS edit. Find infected macros, and delete them. that's
|
|
it!.
|
|
|
|
SOFTWARE ALTERNATIVES TO USING WINWORD.EXE...
|
|
|
|
At the time of this writing, it was mentioned to me that MicroSoft had
|
|
released a WORD Document Viewer, that does not execute Macros, that could
|
|
be used in place of WORD for the purpose of viewing Documents while
|
|
on-line. MSN or it's affiliated BBS services should have the file
|
|
available for download. Also, a number of Shareware and Freeware shells
|
|
can directly view WORD documents, without executing macros. Eric Phelps
|
|
has noted that an updated version of the WordViewer is now available. The
|
|
new WordView 7.1 free viewing utility from Microsoft now runs some Word
|
|
macros!! If you want to view documents without the abiltiy to run macros,
|
|
then stick to versions of WordView previous to version 7.1
|
|
|
|
Users of NETSCAPE 2 who fear virus infection by macro viruses while onl the
|
|
WWW, can now acquire Inso's new Word Plug-In Viewer (Inso wrote the Quick
|
|
View utility in Win95). Inso's URL is:
|
|
|
|
http://www.inso.com/
|
|
|
|
and there is a link to download the Word Plug-In Viewer on the opening
|
|
page.
|
|
|
|
If you need additional information, call Microsoft Product Support Services
|
|
at 206-462-9673 for Word for Windows, or 206-635-7200 for Word for the
|
|
Macintosh, or send an Internet e-mail message to wordinfo@microsoft.com
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 6: SUGGESTED SOFTWARE:
|
|
============================
|
|
|
|
PRODUCTS THAT CAN DETECT/CLEAN WINWORD VIRUSES INFECTIONS IN DOCUMENTS
|
|
|
|
MICROSOFT
|
|
Available on MicroSoft Download Services...
|
|
WD1215.EXE 51078 10-10-95 WD1215.EXE Macro Virus
|
|
Protection Tool
|
|
MW1222.HQX 83729 11-09-95 MW1222.HQX Macro Virus
|
|
Protection Tool for
|
|
Mac Word 6.0
|
|
SCANPROT.EXE 29996 01-02-96 SCANPROT.EXE Word pour
|
|
Windows, "Prank Macro"
|
|
Protection Template (for
|
|
french Word)
|
|
|
|
Available at WWW.MICROSOFT.COM or WWW.MSN.COM...
|
|
A self-extracting archive, MVTOOL10.EXE, being distributed by
|
|
Microsoft. It is an way to protect yourself against the Concept
|
|
virus, as well as to warn you against document files that contain
|
|
macros without your knowledge. It will create these files:
|
|
README.DOC 36864 10-02-95 1:08p
|
|
SCANPROT.DOT 49152 10-02-95 3:44p
|
|
Enter Word and read the README.DOC to see if this package is
|
|
suitable for your environment.
|
|
|
|
============================
|
|
|
|
DR SOLOMON'S ANTI-VIRUS TOOLKIT
|
|
-FindVirus can Detect & Clean Macro Viruses, scanning recursively
|
|
inside compressed and archived files (ZIP, LZH, ARJ, ARC, etc)
|
|
without writing to the hard disk. WinGuard VxD on-access
|
|
scanner can prevent future infections. (available for DOS, Win 3.x,
|
|
Win 95, Win NT, OS/2, Novell NetWare, Unix, and soon Apple Mac)
|
|
Web: http://www.drsolomon.com
|
|
USA Tel: +1 617-273-7400
|
|
CompuServe: GO DRSOLOMON
|
|
UK Support: support@uk.drsolomon.com
|
|
UK Tel: +44 (0)1296 318700
|
|
US Support: support@us.drsolomon.com
|
|
USA Tel: +1 617-273-7400
|
|
|
|
Canadian Representative:
|
|
SSS-Sensible Security Solutions Inc.
|
|
Tel. 613-623-6966
|
|
Fax. 613-623-3992
|
|
e-mail: secure-1@magi.com
|
|
* Editors of 'Virus News' and on-line Security Alerts
|
|
|
|
============================
|
|
|
|
AVP & AVPLITE
|
|
-Detects & Cleans Macro Viruses Infections.
|
|
USA: Central Command Inc. <AVP>
|
|
P.O. Box 856 Brunswick, Ohio 44212
|
|
Phone: 216-273-2820
|
|
FAX : 216-273-2820
|
|
Support: support@command-hq.com
|
|
Sales: sales@command-hq.com
|
|
FTP: ftp.command-hq.com /pub/command/avp
|
|
WWW: http://www.command-hq.com/command
|
|
[not operational yet]
|
|
Compuserve: GO AVPRO
|
|
|
|
============================
|
|
|
|
F-PROT
|
|
-Currently Only Detects Known WINWORD Macro Viruses, Cannot
|
|
clean in Macro infections. Macro Virus Clean will be added
|
|
shortly.
|
|
Frisk Software International
|
|
Postholf 7180
|
|
IS-127 Reykjavik
|
|
Iceland
|
|
Fax: +354-5617274
|
|
Email: sales@complex.is
|
|
|
|
[North America, South America, Australia and New Zealand]
|
|
Command Software Systems Inc.
|
|
Tel: +1-407-575 3200
|
|
Fax: +1-407-575 3026
|
|
|
|
[Canada]
|
|
DOLFIN Developments
|
|
Tel: +1-905-829-4344
|
|
Fax: +1-905-829-4380
|
|
|
|
[Most of Europe, Africa, Middle and Far East:]
|
|
Data Fellows Ltd
|
|
Paivantaite 8
|
|
FIN-02210 ESPOO
|
|
FINLAND
|
|
Tel: +358-0-478 444
|
|
Fax: +358-0-478 44 599
|
|
E-mail: F-PROT@DataFellows.com
|
|
WWW: http://www.DataFellows.com/
|
|
|
|
============================
|
|
|
|
VIRUSCAN
|
|
-Currently Only Detects Macro Viruses, but will soon add it's
|
|
own internal Cleaners to the software. In the meantime, McAfee
|
|
included MicroSoft's MVTOOL10.EXE WinWord.Concept Cleaner with
|
|
their product.
|
|
McAfee
|
|
2710 Walsh Avenue
|
|
Santa Clara, California
|
|
95051-0963 USA
|
|
For questions, orders and problems call
|
|
(M-F, 6:00AM - 5:00PM PST): (408) 988-3832 Business
|
|
For Faxes (24 hour, Group III FAX): (408) 970-9727 FAX
|
|
Bulletin Board System
|
|
(24 hour US Robotics HST DS): (408) 988-4004
|
|
Internet Email: support@mcafee.com
|
|
Internet FTP: ftp.mcafee.com
|
|
WWW: http://www.mcafee.com
|
|
America On-line: MCAFEE
|
|
CompuServe: GO MCAFEE
|
|
The Microsoft Network: GO MCAFEE
|
|
|
|
============================
|
|
|
|
THUNDERBYTE
|
|
-Detects Currently Existing Word Macro Viruses
|
|
ThunderBYTE International Affiliates
|
|
ESaSS B.V.-ThunderBYTE International
|
|
P.O. Box 1380
|
|
6501 BJ Nijmegen
|
|
The Netherlands
|
|
Phone: +31 (0)8894 - 22282
|
|
Fax: +31 (0)8894 - 50899
|
|
|
|
TCT-ThunderBYTE Corporation
|
|
49 Main St., Suite 300
|
|
Massena, N.Y. 13662
|
|
USA
|
|
Toll-Free: 1-800-667-8228
|
|
Phone: (315) 764 1616
|
|
Fax: (613) 936 8429
|
|
|
|
|
|
TCT-ThunderBYTE Inc.
|
|
3304 Second St. E., P.O. Box 672
|
|
Cornwall, Ont. K6H 5T5
|
|
Canada
|
|
Toll-Free: 1-800-667-TBAV
|
|
Phone: (613) - 930 4444
|
|
Fax: (613) - 936 8429
|
|
|
|
============================
|
|
|
|
INTEGRITY MASTER
|
|
-Detection of Macro Viruses + Integrity Checking in one package
|
|
Stiller Research
|
|
2625 Ridgeway St.
|
|
Tallahassee, FL. 32310-5169
|
|
U.S.A.
|
|
Email: 72571.3352@compuserve.com
|
|
PHSH44A on Prodigy.
|
|
Stiller on GEnie
|
|
|
|
============================
|
|
|
|
CHEKMATE (2.0)
|
|
-Generic Virus Detection Utility + ChekResQ utility that can remove
|
|
boot sector and partition table viruses both from memory and your
|
|
hard disk. ChekMate, using Generic Techniques avoids the major
|
|
problem of false alarms. <MS or PC-DOS 3.3 or later, Windows 3.0,
|
|
3.1. 3.11. Workgroups, Windows '95, and Windows NT, as well as OS/2
|
|
2.0, 2.1 and Warp> NOTE: Requires DEBUG.EXE. Package Includes
|
|
CHEKWORD.DOC, Macros in the GLOBAL template (normally NORMAL.DOT)
|
|
are checked and the user is informed of the number(s), name(s) and
|
|
desriptions of macros in this template. For your protection, the
|
|
AutoExec and AutoOpen macros are also disabled
|
|
automatically. Chekword.Doc also scans documents you open.
|
|
Martin Overton (ChekWARE),
|
|
8 Owl Beech Place,
|
|
Horsham,
|
|
West Sussex, RH13 6PQ,
|
|
ENGLAND.
|
|
FTP at:
|
|
ftp.coast.net/SimTel/msdos/virus/cm200.zip
|
|
ftp.demon.co.uk/pub/simtel/msdos/virus/cm200.zip
|
|
ftp.demon.co.uk/antivirus/ibmpc/av-progs/cm200.zip
|
|
ftp.gate.net/pub/users/ris1/cm200.zip
|
|
|
|
At the World-Wide Web site:
|
|
http://www.valleynet.com/~joe/avdos.html
|
|
Email: chekmate@salig.demon.co.uk
|
|
|
|
|
|
============================
|
|
|
|
Simtel, the Software Depository, is a great source for Anti-Virus software!
|
|
Many AV producers posts updated versions of their software regularly to
|
|
SIMTEL. SIMTEL is a free service, which you can access via Internet.
|
|
|
|
The following list will allow anyone with Internet access to freely access
|
|
and obtain Most AV shareware/freeware. For those of you who cannot FTP to
|
|
a Simtel site, do a search for "SIMTEL" with a decent search engine like
|
|
YAHOO or WEB CRAWLER, and you'll see SIMTEL listed.
|
|
|
|
SimTel's primary mirror site is ftp.Coast.NET (205.137.48.28) located in
|
|
Detroit, Michigan, and there the programs may be found in the directory
|
|
/SimTel/msdos/virus.
|
|
|
|
Secondary SimTel mirror sites in the US include:
|
|
|
|
Concord, CA ftp.cdrom.com 192.216.191.11
|
|
Urbana, IL uiarchive.cso.uiuc.edu 128.174.5.14
|
|
Rochester, MI OAK.Oakland.Edu 141.210.10.117
|
|
St. Louis, MO wuarchive.wustl.edu 128.252.135.4
|
|
Norman, OK ftp.uoknor.edu 129.15.2.20
|
|
Corvallis, OR ftp.orst.edu 128.193.4.2
|
|
Salt Lake City, UT ftp.pht.com 198.60.59.5
|
|
|
|
Users outside the US should in general select the "closest" mirror site
|
|
from the list below:
|
|
|
|
Australia archie.au 139.130.23.2
|
|
Brazil ftp.unicamp.br 143.106.10.54
|
|
China ftp.pku.edu.cn 162.105.129.30
|
|
Czech Republic pub.vse.cz 146.102.16.9
|
|
England micros.hensa.ac.uk 194.80.32.51
|
|
src.doc.ic.ac.uk 155.198.1.40
|
|
ftp.demon.co.uk 158.152.1.44
|
|
France ftp.ibp.fr 132.227.60.2
|
|
Germany ftp.ruhr-uni-bochum.de 134.147.32.42
|
|
ftp.tu-chemnitz.de 134.109.2.13
|
|
ftp.uni-mainz.de 134.93.8.129
|
|
ftp.uni-paderborn.de 131.234.10.42
|
|
ftp.uni-tuebingen.de 134.2.2.60
|
|
Hong Kong ftp.cs.cuhk.hk 137.189.4.110
|
|
hkstar.com 202.82.0.48
|
|
Israel ftp.technion.ac.il 132.68.7.8
|
|
Italy cnuce-arch.cnr.it 131.114.1.10
|
|
Japan ftp.saitama-u.ac.jp 133.38.200.1
|
|
ftp.riken.go.jp 134.160.41.2
|
|
Korea ftp.kornet.nm.kr 168.126.63.7
|
|
ftp.nuri.net 203.255.112.4
|
|
Netherlands ftp.nic.surfnet.nl 192.87.46.3
|
|
New Zealand ftp.vuw.ac.nz 130.195.2.193
|
|
Poland ftp.cyf-kr.edu.pl 149.156.1.8
|
|
ftp.icm.edu.pl 148.81.209.3
|
|
Portugal ftp.ua.pt 193.136.80.6
|
|
South Africa ftp.sun.ac.za 146.232.212.21
|
|
Slovak Republic ftp.uakom.sk 192.108.131.12
|
|
Slovenia ftp.arnes.si 193.2.1.72
|
|
Sweden ftp.sunet.se 130.238.127.3
|
|
Switzerland ftp.switch.ch 130.59.1.40
|
|
Taiwan nctuccca.edu.tw 140.111.1.10
|
|
Thailand ftp.nectec.or.th 192.150.251.33
|
|
Turkey ftp.metu.edu.tr 144.122.1.101
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 7: CREDITS & THANKS:
|
|
==========================
|
|
|
|
I would like to extend my appreciation and thanks to all those who provided
|
|
info to me on this matter. Most of the Anti-Virus producers were extremely
|
|
helpful in the production of this much needed FAQ for ALT.COMP.VIRUS.
|
|
Special Thanks goes to Bruce Burrell <bpb@us.itd.umich.edu> for reminding
|
|
me to DOT my "i"'s and cross my "t"'s.
|
|
|
|
ACKNOWLEDGMENTS
|
|
|
|
I would like to thank the following individuals who have helped and
|
|
contributed to this document:
|
|
|
|
Graham Cluley <gcluley@uk.drsolomon.com>, Senior Technology Consultant, Dr
|
|
Solomon's Anti-Virus Toolkit.
|
|
|
|
Dr Alan Solomon <drsolly@ibmpcug.co.uk, drsolly@chartridge.win-uk.net>,
|
|
Chief Designer of Dr Solomon's Anti Virus Toolkit, S&S International.
|
|
|
|
Vesselin Vladimirov Bontchev <bontchev@complex.is>, FRISK Software
|
|
International.
|
|
|
|
Wolfgang Stiller <72571.3352@compuserve.com>, Stiller Research
|
|
|
|
Keith A. Peer <keith@command-hq.com>, Central Command Inc. <AVP>
|
|
|
|
Sarah Gordon, <sgordon@commandcom.com>, Command Software System's F-PROT
|
|
Professional Support.
|
|
|
|
Paul Kerrigan, <pkerrign@iol.ie>
|
|
|
|
Paul Ducklin <duck@sophos.com>, and SOPHOS <www@sophos.com> for providing
|
|
early info and the detection string for this new macro virus.
|
|
|
|
David Harley <harley@icrf.icnet.uk>
|
|
|
|
David Phillips (D.Phillips@open.ac.uk)
|
|
|
|
Dr David Aubrey-Jones <davidj@reflexd.demon.co.uk> of REFLEX MAGNETICS
|
|
|
|
Martin Overton <chekmate@salig.demon.co.uk> and Ed Fenton
|
|
<ris@transit.nyser.net>
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 8: FAQ DISTRIBUTION INFORMATION:
|
|
======================================
|
|
|
|
Any distribution of this FAQ is subject to the following restrictions:
|
|
|
|
This FAQ may be posted to any USENET newsgroup, on-line service, or BBS as
|
|
long as it is posted in its entirety and includes this copyright statement.
|
|
This FAQ may not be distributed for financial gain. This FAQ may be made
|
|
freely available and posted on FTP, WWW, and BBS sites, Newsgroups and
|
|
Networks, as well as included within software packages and AV products, and
|
|
on CD-ROMs containing other FAQ's/shareware/freeware programs, such as the
|
|
SIMTEL and GARBO collection CD-ROMs, as long as this FAQ is always
|
|
distributed complete and without modifications, and proper credits are
|
|
given to the author.
|
|
|
|
Mass distribution of this FAQ in magazines, newspapers or books requires
|
|
approval from the author, Richard John Martin.
|
|
|
|
Email Bd326@Torfree.Net for FREE APPROVAL.
|
|
|
|
NOTE: I, the AUTHOR, will re-post copies of this FAQ to ALT.COMP.VIRUS
|
|
every one-two weeks. <or more frequently when the need arises>
|
|
|
|
Anyone with additional info, critiques, suggestions, etc. to add to this
|
|
FAQ, please send it to Bd326@Torfree.Net
|
|
|
|
Copyright (c) 1995-1996 by Richard John Martin, all rights reserved.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 9: WHERE CAN I OBTAIN UPDATED COPIES OF THIS FAQ?
|
|
=======================================================
|
|
|
|
ChekMate <ChekWare Software> will usually have the most up-to-date copy of
|
|
this faq on their Internet Site. <Thanks Guys> You can find it at...
|
|
|
|
ftp.gate.net/pub/users/ris1/word.faq
|
|
|
|
or try our own HIGH SPEED DEMONZ WWW homepage. You will find updated
|
|
copies of this FAQ at...
|
|
|
|
http://learn.senecac.on.ca/~jeashe/hsdemonz.htm
|
|
|
|
as well as other many popular AV sites. Keep an eye on the Page, as new
|
|
things will shortly be added, plus an HTML version of the FAQ is being
|
|
prepared.
|
|
|
|
With any luck, things will return to normal around here. Updated copies of
|
|
the FAQ should resume it's former schedule of updates once every 2 weeks.
|
|
|
|
An Updated copy of this FAQ can also be obtained by sending Email to
|
|
Bd326@TorFree.Net, with a SUBJECT header of "PLEASE SEND FAQ", which will
|
|
result in a return email message that will include an updated copy of this
|
|
FAQ. To be added to an experimental MAILING LIST for updates of this faq,
|
|
send EMAIL with the SUBJECT header "ADD TO MAIL LIST". The MAILING LIST
|
|
may be cancelled at anytime.
|
|
|
|
You can also remove yourself from the list, by sending an email with the
|
|
SUBJECT header: "REMOVE FROM FAQ MAIL LIST"
|
|
|
|
For those of you who live in Toronto, Ontario, Canada, or don't mind a
|
|
call up here to the Great White North, set your modem to 8n1, and call:
|
|
|
|
VIRUS WATCH BBS (416)654-3814
|
|
|
|
Simply do a search on the BBS for MACRO and you see updated copies of
|
|
the FAQ listed. The file will be an ASCII text file, with the name format
|
|
of
|
|
WORDMACR.xxx
|
|
|
|
The xxx will refer to the month. This particular edition is WORDMACR.MAR
|
|
|
|
I'm still looking for BBS's to ARCHIVE this FAQ, so if anyone would like to
|
|
ARCHIVE it on their BBS, please let me know.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 10: QUESTIONS THAT STILL NEED TO BE ANSWERED...
|
|
======================================================
|
|
|
|
Any help with the following questions would be appreciated.
|
|
|
|
1: [ HOW MANY DIFFERENT VERSIONS OF MS WORD HAVE BEEN RELEASED ON
|
|
POPULAR PLATFORMS? ]
|
|
|
|
2: [ HOW MANY DIFFERENT NATIONALIZED VERSIONS OF MS WORD HAVE BEEN
|
|
RELEASED? WHICH LANGUAGES? ]
|
|
|
|
2.1: [ HOW MANY DIFFERENT NATIONALIZED VERSIONS OF MS WORD FOR MAC
|
|
HAVE BEEN RELEASED? WHICH LANGUAGES? ]
|
|
|
|
|
|
3: [ WHAT ARE THE NAMES OF MACROS EQUIVALENT TO AUTOOPEN, AUTOCLOSE,
|
|
FILESAVEAS, etc. IN THE NATIONALIZED VERSIONS OF MS WORD? ]
|
|
|
|
4: [ DOES MS WORD FOR DOS EXIST? IF SO, WHICH VERSIONS HAVE BEEN
|
|
RELEASED? ]
|
|
|
|
4.1: [ DOES IT HAVE A COMPATIBLE MACRO LANGUAGE? ]
|
|
|
|
5: [ GENERAL INFO ON MAC WORD INTERFACE, MENUS, MACRO, ETC.??? ]
|
|
|
|
6: [ ANY NEW INFO TO ADD? ]
|
|
|
|
7: [ LIST ANY PROGRAMS YOU KNOW THAT CAN VIEW WORD 6.x or 7.x
|
|
DOCUMENTS??? ]
|
|
|
|
8: [ HOW TO DISABLE AUTOMACROS OR MACROS IN GENERAL UNDER WORD FOR
|
|
MAC? ]
|
|
|
|
9: [ IS THE ATARI ST CAPABLE OF RUNNING DOS, WINDOWS, and WORD FOR
|
|
WINDOWS? ]
|
|
|
|
10: [ DOS THE AMIGA HAVE A NATIVE MS WORD? ]
|
|
|
|
11: [ DOES WINDOWS OLE and DDE ALLOW FOR THE POSSIBILITIES OF
|
|
INFECTING OTHER FILE FORMATS? ]
|
|
|
|
12: [ DOES ANYONE HAVE INFO ON THE "HOT" & "WEIDEROFFEN" VIRUSES? ]
|
|
|
|
Anyone with additional info, critiques, suggestions, etc. to add to this
|
|
FAQ, please send it to Bd326@Torfree.Net
|
|
|
|
--------------------------------------------------------------
|
|
|
|
TOPIC 11: DISCLAIMER
|
|
====================
|
|
|
|
This article is provided as is without any express or implied warranties.
|
|
While every effort has been taken to ensure the accuracy of the information
|
|
contained in this article, the author assume(s) no responsibility for
|
|
errors or omissions, or for damages resulting from the use of the
|
|
information contained herein.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
This FAQ is Copyright (c) 1996 Richard John Martin, HIGH SPEED
|
|
DEMONZ Anti-Virus Research Labs, Canada. All rights reserved.
|
|
|
|
MicroSoft (tm), MicroSoft Windows, MicroSoft Word, MicroSoft EXCEL
|
|
are Copyright (c) 1995-96 MicroSoft Corp. All rights reserved.
|
|
|
|
--------------------------------------------------------------
|
|
|
|
|
|
--
|