TechWhirl (TECHWR-L) is a resource for technical writing and technical communications professionals of all experience levels and in all industries to share their experiences and acquire information.
For two decades, technical communicators have turned to TechWhirl to ask and answer questions about the always-changing world of technical communications, such as tools, skills, career paths, methodologies, and emerging industries. The TechWhirl Archives and magazine, created for, by and about technical writers, offer a wealth of knowledge to everyone with an interest in any aspect of technical communications.
Subject:MS Word Concept Virus From:Gillian Mcgarvey <Gillian_McGarvey -at- OVID -dot- COM> Date:Mon, 9 Dec 1996 10:40:58 -0400
To: techwr-l @ listserv.okstate.edu
cc:
Subject: MS Word Concept Virus
Some of you Word users might be interested in the existence of this
virus. Just something to watch out for...
---------------------- Forwarded by Gillian McGarvey/New York/Ovid
Technologies Inc. on 12/09/96 10:34 AM ---------------------------
(Embedded image moved to file: PIC21732.PCX) Charles Cunningham
12/06/96 07:31 PM
To: Gillian McGarvey/New York/Ovid Technologies Inc.
cc:
Subject: More about the Concept Virus
---------------------- Forwarded by Charles Cunningham/Utah/Ovid
Technologies Inc. on 12/06/96 05:26 PM ---------------------------
From: John Littlewood on 12/06/96 04:31 PM
To: Larry Hanks/Utah/Ovid Technologies Inc., Ken Isaacson/Utah/Ovid
Technologies Inc., Charles Cunningham/Utah/Ovid Technologies Inc.
cc:
Subject: Concept virus
Concept is a small, yet sophisticated program that attaches itself to Word
documents.
Concept is a macro virus. It is not particularly destructive, but can be
annoying. The
Concept virus creates a change with the "Save As" function. The user will not
be able to
choose the drive or the type of file when saving documents. The "TEMPLATES"
radio
button will be grayed. The macro will cause the document to behave as a
template file.
Upon infection, the virus searches for the macros, "Payload" and "FileSaveAs"
among
NORMAL.DOT templates. If either of these macros exist, Concept assumes that
the
system is already infected, and aborts. If neither of these files exist, it
begins its infection
process by copying its viral macros to the template and displaying a dialog
box, which
contains the number "1".
Once a Macro virus is running, it can copy itself to other documents, delete
files, and
create general problems in a system. These things occur without the user
explicitly
running the macro. Once Concept is active on a system, it adds the following
macros:
AAAZAO, AAAZFS, and Payload. Two additional macros appear called "AutoOpen"
and
"FileSaveAs". If these macros existed previously, the contents will be
changed. These
macros can be viewed in the TOOLS, MACRO menu.
Macro viruses spread by having one or more macros in a document. Opening or
closing
the document or any activity which invokes the viral macros, activates the
virus. When
the macro is activated, it copies itself and any other macros it needs,
sometimes to the
global macro file NORMAL.DOT. If they are stored in NORMAL.DOT they are
available
in all open documents.
At this point, the macro viruses try to spread themselves to other documents.
Macro
viruses spread easily through e-mail packages. The ability of these packages
to send and
quickly launch documents can infect hundreds of users at a time. Documents are
much
more mobile than executable files, passing from machine to machine as
different people,
write, edit or access them. Macro viruses can therefore spread very quickly
through
business offices and corporations.
