news that works for you


ISSUE 493: The high-tech office- April 6 1999


Computer viruses can be a serious problem,
but using protection can save your system

As I write this column, the news is full of stories about an e-mail virus, pleasantly named "Melissa," which over the weekend had spread rapidly, bringing the e-mail systems of at least 60 major corporations, including Microsoft and Intel, to a halt. Melissa has been characterized as the fastest spreading virus ever.

Latest news suggests that the FBI is investigating, and that there may be a lead (an America Online address associated with the earliest incidences) that might lead to an arrest. By the time you read this, all that may prove old news or wrong.

But here's the facts:

* Reading your e-mail does not, on its own, infect your computer.

* Files attached to your e-mail, such as Melissa, however, can infect your computer -- but only if you open them or read them.

* New, more sophisticated viruses (or Trojan infections hidden in other, seemingly harmless programs), again including Melissa, can hijack your computer's e-mail, sending infected attachments along with any messages you send, or even automatically sending messages to people in your e-mail software's address book without your knowledge.

* Most of the recent virus attacks have involved so-called "macro-viruses" -- viruses that are written into macros that are part of document files, most often document files created using Microsoft Office programs such as Word or Excel. These viruses can affect any computer running Office -- PCs and Macs alike. Melissa, written in Visual Basic for Applications, is specific to Office 97/98/2000, and can't infect computers running earlier versions. However, other viruses, written in the earlier WordBasic, can infect Word 6 or Word 95 (as well as newer versions). And remember: you don't have to read e-mail to get the virus. Reading an infected document off a floppy diskette or across the office network will get you just as easily.

* While macro viruses such as Melissa start with a single infected document -- in Melissa's case, a list of pornographic Web sites named List.doc -- once your system is infected, any document you create contains the infection and can spread it if read on other systems.

* The latest versions of Office (Office 97 and 2000 for PCs and Office 98 for Macs) offers a simple defence. In Word 97/98, for example, go to the Tools menu, then Options (preferences on the Mac), then General, and check the Macro Virus protection box.

* Melissa is most dangerous when it spreads to computers that use Microsoft Outlook (a component of Office) as their e-mail software. In that case, it takes over the Outlook address book and automatically sends itself to the first 50 addresses. It does not do this with other e-mail programs, including Microsoft's Outlook Express. On such systems, Melissa can still spread -- but more slowly.

* Because it has hijacked your computer, Melissa sends mail under your name to people you know. They are more likely to open the attachment, thinking it's from you, than if it came attached to junk mail from a stranger. (The message will have a subject line: "An Important Message >From [someone you know]," followed by the words "Here is the document you asked for -- don't show anyone else.")

* Corporate e-mail systems that were shut down were not infected. Instead, they were overloaded by a sort of chain-letter effect, only on Internet time, as each Word + Outlook system sent 50 messages out, and each time they hit another Word + Outlook system, another 50 were sent out. With some enterprises having standardized on that software combination, a large enough number of messages were generated quickly enough (within a matter of minutes) to bring down the mail system.

* By the Monday following the attacks, all the major virus-protection vendors had updated their software to protect against Melissa. But that will only help you if you make the effort to download the newest versions from their Web sites. Programs such as Norton Anti-Virus and McAfee Viruscan make this process relatively easy. Do it now -- and continue to update regularly.

Within days of the discovery of Melissa, "copycat" viruses began to appear, such as the Excel macro-virus, code-named "Papa." Users can't let their vigilance down.

Ironically, the same weekend that Melissa broke out, I discovered that my home computer was infected with a different e-mail attachment virus, Happy99, and that I, unwittingly, might have spread it to as many as 59 others. Happy99 arrives as an attached program called Happy99.exe which, if run (PCs only this time), shows fireworks on screen. If that sounds familiar, your computer is probably infected.

Once infected, it also hijacks your e-mail and Use-
net programs, sending itself along with all messages you send. It nicely keeps a list of who it sent itself to, in order to send the infection only one time to any given address. You can clean off an infection of this virus by deleting the files Ska.exe and Ska.dll from your Windows/System folder. Open the file Liste.ska to read who you sent the infection to -- and notify them so they can clean up their systems! *

Search WWW Search

Alan Zisman is a Vancouver educator, writer, and computer specialist. He can be reached at E-mail Alan