Macro Viruses: Is Your Computer Protected?
Brian Carr
Writer’s comment: This article was written as an assignment in Business Reports and Technical Communication (English 104A). The target publication for this particular piece was Smart Computing (formerly PC Novice), a magazine which often capitalizes on the fears of the technologically feeble. Not that these fears are unfounded — everyone has been through a computer crash. However, many don’t realize that something malicious may have caused such a crash. This article focuses on the newest threat to PCs: macro viruses. Computer articles can be difficult to understand, so I have tried to make the text as accessible and clear as possible.
- Brian Carr
Instructor’s comment: Brian’s motto seems to be, “never let them see you sweat.” Like an accomplished athlete or artist, he makes his work look easy. And yet, Brian’s finely crafted pieces are the result of much planning and revision. His prose is clear, well organized and always geared toward his target audience. In this brief outline he puts aside a wealth of technical knowledge about computer viruses to present only what his reader needs to know. The result is upbeat but informative, and feels like it came straight from the pages of his target publication.
- Amy Clarke, English Department
Imagine starting up your computer only to see the image on the screen melt while eerie music plays. The hard drive crunches away. What is it doing in there? Before you turn off the machine, most of your files have been deleted. Your computer is the victim of a computer virus. But where did the virus come from? It may have been that game you borrowed or, more likely, it came from an electronic document.
Most viruses infect programs, but newer viruses can infect documents as well. This is the case with macro viruses that infect Microsoft Word files. In fact, the number of these viruses has increased from 40 in 1996 to over 1,300 in 1998. Anyone who reads Word files created by others can be at risk. Infected documents spread easily and quickly, especially in environments where documents are shared.
What is a macro virus?
A macro virus is a program that infects documents and spreads by copying itself. When a document containing a macro virus is opened on your computer, the virus copies itself into something called the global template, which is used to save Word settings. Once this template is infected, all documents you save will contain the virus. If you distribute an infected document, the virus will spread even further.
Besides making copies of themselves, viruses can have other harmful effects. They can delete or change document contents, change Word settings, set passwords on your documents so that you can’t read them, or delete all of your files the next time you start your computer.
How can I tell if my computer has a macro virus?
Many viruses are so good at covering their tracks that you may not even realize they are there. What is more, the number of different viruses makes it difficult to provide simple identification rules.
The best way to detect viruses is to have the computer do it for you with a program called a virus scanner. A scanner looks through all of your files to find known viruses. Scanners are effective at finding viruses, but you must always use the most current version to catch recently discovered viruses. Two of the most popular virus scanners are VirusScan, made by McAfee, and Norton Anti-Virus, made by Symantec.
One common macro virus, the Concept virus, is easy to identify. It causes Word to save all of your documents as templates. If you notice that you are asked to save all documents in the templates folder, you may have the Concept virus.
How can I get rid of a macro virus?
Scanners can both detect and remove viruses. A scanner will ask you if you want to remove any viruses found. Before you remove a virus, be sure to write down its name — you may need it later.
Once a virus is removed, you may find that your documents are protected by passwords. If Word asks you to type in a password for a file (and you have never had to do this before), you will have to find the exact password the virus used.
With the name of the virus in hand, use your web browser to go to the Virus Info Library at http://www.mcafee.com/support/techdocs/vinfo. Click on “Virus by Name” to find a description of the virus. The password you need will be listed there.
How can I prevent MVs?
• Scan all documents before you open them. For information on how to do this, see the documentation that came with your virus scanning software.
• Use Word 95A or Word 97. These products will ask you if you want to disable all macros found in a document. Unless you need to use the macros in a document, you should disable them.
• Make the normal.dot file read-only. This file is where viruses reside in an infected system. A virus can’t copy itself into this file if it is read-only. Here is how to do this in Windows 95:
- First click the Start button, then click Find, and then click Files or Folders.
- Type “normal.dot” into the Named box and then click Find Now.
- At the bottom of the window should be the normal.dot file with an icon next to it. Click on this file with the right mouse button and then click Properties.
- Check the Read-only box and click OK.
Preventing macro viruses is easy compared to the amount of time and frustration involved in removing them. For more information on macro virus prevention, read the Macro Virus FAQ at http://www.look.com/mfaq.html.