Macro Virus Warning

Introduction
Macro Viruses are one of the biggest threats to corporate entities today. Any business using Microsoft Word 95/97 faces the risk of an extremely powerful macro being sent to them encoded in a word document, which can then cause havoc. Recently there has been a large amount of publicity about a macro virus named “Melissa”, this is exactly the kind of danger any Word user faces. Therefore, please take the time to read this document.

Originally, macros were a feature that allowed a user to, for example, press a certain key combination and their address would appear on the page. With the evolution of software, and the consequent overlap between programming tools, word processors, and desktop publishers, macros now have an enormous number of commands: as many, in fact, as the application itself. Nearly all of Microsoft Word’s commands can be executed by a macro. This means that files can be opened, modified, and then saved by the macro. This is not limited to Word files, but includes important system files vital for the function of your computer. Any programmer with knowledge of Visual Basic can easily write a macro, one that can seriously harm your computer.

About this Document
This document is designed to alert you to the possibilities and capabilities of macro viruses: embedded in it is a macro that opens one of your start-up files (that is, one of the files your computer runs every time it starts), and copies it. It then closes it and creates a new text file, pastes the contents of the start-up file into it, and also inserts a new line into it. (The macro is deliberately designed so as not to modify your actual start-up file, as this would have a disastrous effect: instead it makes the copy and modifies that instead). The new line added would be executed the next time you restarted your computer, and would then render it unusable, as it deletes a file without which your computer cannot start. Your only solution would be to find another version of that file, or format (wipe) your hard disk completely and reinstall all your programmes, something which would mean you lost all your data and would cost you an inordinate amount of time. The file output by the example macro in this document has been saved on the root of your hard disk under the name of “MacroVautoexec.txt”, which you can open from within any word processor. It is quite safe to delete this file.

Macro Virus Prevention
When users exchange information, they spread viruses: this is how viruses propagate. For example, if you send any e-mail with an attached file, or copy a file onto a floppy disk and give it to someone you could potentially be spreading a virus. Macro viruses are easier than most to detect, due to the fact that when you open a document with an embedded macro, Word asks you whether you would like to enable macros. If you have even the faintest suspicion that the document might contain a harmful macro, simply disable macros. Make sure that the “Always ask before opening documents with macros or customisations” is ticked, as this is your only real protection against macro viruses.
An up to date virus checker is advisable, as these can detect some macro viruses, (although not all, as more are being written all the time). These are available from various companies: I recommend Network Associates (owners or Dr. Solomon’s, McAfee and so on). Their web address is http://www.mcafee.com/ (McAfee).

Further details about viruses
-	A virus is a programme designed by someone who thinks it's a real laugh to mess up people's computers and waste others’ time. Viruses can range from annoying messages on the screen on a certain date to hard drive formatting (i.e. the disk gets wiped clean). They can obviously be very dangerous. 
-	Viruses are normally transmitted by infected documents (for example word processor files), or executable files (such as screensavers). A user must actually "use" the file (i.e. copy, open, execute...), before the virus can infect the user's computer. 
-	Viruses cannot be carried in normal e-mails. The only possible way of introducing a "virus" into an electronic message's text is by using a language called JavaScript. This is a web programming language that allows designers to, for example, bring up a dialogue box in a browser to ask the user a question. A programmer can design a JavaScript that persistently brings up a new e-mail message window until your system crashes, when you open the e-mail. You just restart the computer, and delete the e-mail. A JavaScript cannot do anything worse than that, unless you say yes to a plethora of dialogue boxes that your e-mail programme will bring up when the script requests the system's permission to access, for example, the hard disk. Quite honestly, anyone who is stupid enough to allow a script in an e-mail from an unknown source access their hard disk either wants to scrap all their data or is mad. 
-	Any e-mail programme that supports the usage of JavaScript in e-mails has the option of disabling it. I would recommend that everyone did so, especially if they have no experience in web programming. All users of Internet Explorer 4.x or Netscape Navigator 4.x are affected by JavaScript enabled e-mail. Other e-mail clients do not support it. 
-	The only way that a real virus can infect your computer is by a file being attached to the e-mail. If you get ANY attached files from unknown sources, don't open them. You can open the e-mail and read it, that won't hurt, but under no circumstances open/save the attached file. Delete the e-mail when you have finished with it. Remember that many viruses are distributed in screensavers that will actually work, but at the same time as protecting your screen format your hard disk. Overall, treat attached files on e-mails as you would a letter bomb by post. 
-	Any e-mail with the subject "RETURNED OR UNABLE TO DELIVER." (or similar), you should open, because this will be from your ISP (Internet Service Provider), telling you that one of your e-mails couldn't be delivered, probably because you typed the address wrong. 
-	IBM, Microsoft, Compaq, AOL, AT&T, CompuServe, and the rest of the computer industry giants have never, and I would say will never, announce virus warnings. If ever you see them associated with this kind of thing, it's a hoax. If it were McAfee or Symantec, it might be more believable, as these are two big virus checker companies, but no one else. 
-	E-mails that say things like "The virus will attach itself to your computer chips and destroy them in a puff of smoke" (or something somewhat less obvious), are complete rubbish. Viruses may sometimes be able to indirectly physically damage your hard disk, but nothing else. Your computer will not go up in smoke, nor will your chips short circuit. 
-	When an e-mail says, "not many people know about this", it's true! The only person who knows about this completely fictional virus at first is the idiot who writes the e-mail in the first place. On behalf of all the I.T. professionals out there, if ever this e-mail gets back to that person, we'd love to ring your neck. 
-	Finally, virus e-mails that have a sender's address mentioned in them can easily be disproved much of the time by sending e-mail to the "address". Most of the time you'll get an error e-mail from your ISP saying that they couldn't deliver the message because the address doesn't exist.

Notes
-	The code for the macro embedded in this document has been pass-worded to prevent unscrupulous persons from viewing it and easily learning how to manufacture malicious viruses.
-	If you have any queries about viruses, please e-mail me at davidc@deskmail.com and I will attempt (!) to answer them.
-	If this document has been useful to you, please pass it on to others so that they can also be warned.

Disclaimer
By reading this document, you indicate that you agree entirely with the following terms of use:

This document is provided “as is”, without warranty of any kind, including but not limited to, express or implied warranties of accuracy, merchantability, fitness for a particular purpose, or non-infringement. All of these are disclaimed, except to the extent that these disclaimers are held to be legally invalid.

Limitation of liability: To the extent not prohibited by law, neither David C. nor any of his associates shall in any event be liable for any loss of revenue, profit or data, or for special, indirect, consequential, incidental or punitive damages, however caused, regardless of the theory of liability, arising out of, or related to, the use of the information and/or code contained in this file. This applies even if David C. has been advised of the possibility of such damages.

(In simple language: I am not responsible for anything to do with how you or anyone associated with you uses this information and I do not guarantee its accuracy. If you get any problems due to using this file, it’s your problem. If you create a macro virus as a result of reading this, I’m not responsible for the consequences).

Copyright © 1999 David C. All Rights Reserved.
04/04/99, dcmacroVirusDocument.doc.