ISSUE 493: The high-tech office- April
6 1999
ALAN ZISMAN
Computer viruses can be a serious problem,
but using protection can save your system
As I write this column, the news is full of
stories about an e-mail virus, pleasantly named "Melissa," which over
the weekend had spread rapidly, bringing the e-mail systems of at least
60 major corporations, including Microsoft and Intel,
to a halt. Melissa has been characterized as the fastest spreading
virus ever.
Latest news suggests that the FBI is
investigating, and that there may be a lead (an America Online
address associated with the earliest incidences) that might lead to an
arrest. By the time you read this, all that may prove old news or
wrong.
But here's the facts:
* Reading your e-mail does not, on its own, infect
your computer.
* Files attached to your e-mail, such as Melissa,
however, can infect your computer -- but only if you open them or read
them.
* New, more sophisticated viruses (or Trojan
infections hidden in other, seemingly harmless programs), again
including Melissa, can hijack your computer's e-mail, sending infected
attachments along with any messages you send, or even automatically
sending messages to people in your e-mail software's address book
without your knowledge.
* Most of the recent virus attacks have involved
so-called "macro-viruses" -- viruses that are written into macros that
are part of document files, most often document files created using
Microsoft Office programs such as Word or Excel. These viruses can
affect any computer running Office -- PCs and Macs alike. Melissa,
written in Visual Basic for Applications, is specific to Office
97/98/2000, and can't infect computers running earlier versions.
However, other viruses, written in the earlier WordBasic, can infect
Word 6 or Word 95 (as well as newer versions). And remember: you don't
have to read e-mail to get the virus. Reading an infected document off
a floppy diskette or across the office network will get you just as
easily.
* While macro viruses such as Melissa start with a
single infected document -- in Melissa's case, a list of pornographic
Web sites named List.doc -- once your system is infected, any document
you create contains the infection and can spread it if read on other
systems.
* The latest versions of Office (Office 97 and 2000
for PCs and Office 98 for Macs) offers a simple defence. In Word 97/98,
for example, go to the Tools menu, then Options (preferences on the
Mac), then General, and check the Macro Virus protection box.
* Melissa is most dangerous when it spreads to
computers that use Microsoft Outlook (a component of Office) as their
e-mail software. In that case, it takes over the Outlook address book
and automatically sends itself to the first 50 addresses. It does not
do this with other e-mail programs, including Microsoft's Outlook
Express. On such systems, Melissa can still spread -- but more slowly.
* Because it has hijacked your computer, Melissa sends
mail under your name to people you know. They are more likely to open
the attachment, thinking it's from you, than if it came attached to
junk mail from a stranger. (The message will have a subject line: "An
Important Message >From [someone you know]," followed by the words
"Here is the document you asked for -- don't show anyone else.")
* Corporate e-mail systems that were shut down were
not infected. Instead, they were overloaded by a sort of chain-letter
effect, only on Internet time, as each Word + Outlook system sent 50
messages out, and each time they hit another Word + Outlook system,
another 50 were sent out. With some enterprises having standardized on
that software combination, a large enough number of messages were
generated quickly enough (within a matter of minutes) to bring down the
mail system.
* By the Monday following the attacks, all the major
virus-protection vendors had updated their software to protect against
Melissa. But that will only help you if you make the effort to download
the newest versions from their Web sites. Programs such as Norton
Anti-Virus and McAfee Viruscan make this process relatively
easy. Do it now -- and continue to update regularly.
Within days of the discovery of Melissa, "copycat"
viruses began to appear, such as the Excel macro-virus, code-named
"Papa." Users can't let their vigilance down.
Ironically, the same weekend that Melissa broke out, I
discovered that my home computer was infected with a different e-mail
attachment virus, Happy99, and that I, unwittingly, might have spread
it to as many as 59 others. Happy99 arrives as an attached program
called Happy99.exe which, if run (PCs only this time), shows fireworks
on screen. If that sounds familiar, your computer is probably infected.
Once infected, it also hijacks your e-mail and Use-
net programs, sending itself along with all messages you send. It
nicely keeps a list of who it sent itself to, in order to send the
infection only one time to any given address. You can clean off an
infection of this virus by deleting the files Ska.exe and Ska.dll from
your Windows/System folder. Open the file Liste.ska to read who you
sent the infection to -- and notify them so they can clean up their
systems! *
|