Klarinet Archive - Posting 000523.txt from 1998/01

From: "Benjamin A. Maas" <bmaas@-----.net>
Subj: Word Attachments--Watch out for Macro Viruses!!!!!!
Date: Sat, 10 Jan 1998 17:52:34 -0500

Watch out when sending word files around on this list. I just discovered a
word macro-virus on my machine. It is brand-new and none of my virus
checkers discovered it (and I keep them on the highest level of security).

I think I got it off of a internet news-group, but I don't know. I STRONGLY
urge everybody to check out their computers to make sure these word
documents aren't infected. I have not sent any word files, so I know I have
not spread it to the list.

Here is the scoop:

Look at the properties of the file. Mine had this as the entries:

Author: VicodinES
Subject: Macro Virus Infection by Narkotic Network
harm.

Under tools-Macro-Macros, Word shuts down with the message: You Killed
Kenny You Bastard! and the file is replaced with this:
www.yahoo.com/News_and_Media/Television/Shows/Cartoons/South_Park

Unless you have a backup that is clean, that file is hosed.

To clean up the problem if you are infected (no virus checker has the
signature in it....)

Find the Normal.dot file in the Microsoft Office directory. It will
probably be a 42K file. It should be 27K (at least in Office 97). Replace
it with a clean copy off of your original disks. Make it a read-only file
so it is not re-infected. I can't seem to clean the infected files, but all
new ones should be clean. As for the old ones: just hope you have a clean
back-up otherwise you are probably SOL.

If you are not infected with this virus, be glad.

Benjamin Maas
Clarinetist and Digital Recording Engineer
Student, University of Southern California
Executive Director, Digital Renaissance Consort
bmaas@-----.net
bmaas@-----.edu