<div id="popup_box_thanks" style="display:none" onClick="close_popup_thanks('popup_box_thanks', 'ts')"><br>Thanks for submitting your tip! All submissions are moderated by an editor before appearing online. We've reset the form so you can enter another tip. Or you can close the tip submission box. <div class="x_close" id="thanks_upper_right"><a href="javascript:void(0)" onmousedown="close_popup_thanks('popup_box_thanks', 'ts'); return true;">Close</a></div></div>
<div class="tbf_row"><div class="tbf_wide_extra_top not_bold">Please submit only technical tips that will help other TidBITS readers better use their Macs, iPhones, and related software and hardware. All product announcements should be sent to <a href="mailto:releases@tidbits.com">releases@tidbits.com</a>.</div></div>
<div class="tbf_left">URL</div><div class="tbf_right"><input type="text" value="" name="tip_link_url" tabindex="3"><span class="tip_description"><br>Enter the URL to a Web page that supports your tip.</span></div>
</div>
<div class="spacer"></div>
<div class="tbf_row">
<div class="tbf_left">Linked text</div><div class="tbf_right"><input type="text" value="" name="tip_link_label" tabindex="4"><span class="tip_description"><br>Enter the name of the page linked above.</span></div>
<div class="tbf_wide"><input type="submit" value="Preview Your Tip" name="preview_tip" onClick="fill_preview('tipbits_enclosure_preview', 'ts', this.form); return false;" tabindex="7"> <input type="submit" value="Send Us Your Tip!" name="submit_this_tip" onClick="handle_tip_submission('ts', '', this.form, 'tip'); return false;" tabindex="8"></div>
</div>
<div class="spacer"></div>
<div class="tbf_row">
<div class="tbf_wide"><span class="fine_print">When you submit a tip, you give us permission to use it. Read <a href="javascript:void(0)" onClick="generic_show_hide('tip_terms')">our terms</a> for more details. All submissions are reviewed before publication.</span></div>
<div class="tbf_wide"><span class="fine_print">Our terms: By submitting a tip, you agree to assign TidBITS Publishing Inc., a non-exclusive, worldwide, perpetual license to reproduce, publish, and distribute your tip in connection with the TidBITS Web site and associated products in any media. You agree that you created the content you submitted, and that you have the right to assign us this license. You give us permission to use your name, but your email address won't be publicly displayed or shared. We review all submissions before publication, and reserve the right to select which submissions we feel are appropriate for our readers and to edit those we publish.</span></div>
<div id="comment_thanks" style="display:none" onClick="close_popup_thanks('comment_thanks', 'comm')"><br>Thanks for submitting a comment! Please check your email for a link that, when clicked, will verify that you're a real person and cause your comment to appear immediately. <div class="x_close" id="comment_upper_right"><a href="javascript:void(0)" onmousedown="close_popup_thanks('comment_thanks', 'comm'); return true;">Close</a></div></div>
<div class="tbf_wide"><span class="fine_print">Our terms: We reserve the right to edit or delete any comment, so please post thoughtfully. We use your email address <i>only</i> to send you a one-time verification message confirming that you posted this comment. We also store your address to allow you to verify using other Web browsers in the future. For more info, see our <a href="http://db.tidbits.com/privacy.html">privacy policy</a>.</span></div>
<li><a href="/feeds/tidbits.rss" title="Subscribe via RSS" class="gettb">RSS <img src="/images/feed-icon-12x12.gif" width="12" height="12" border="0" class="nav_img" alt="Subscribe via RSS"></a></li>
<li><a href="http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=276986548" title="Subscribe to the podcast" class="gettb">Podcast <img src="/images/feed-icon-12x12_podcast.gif" width="12" height="12" border="0" class="nav_img" alt="Subscribe to the postcast"></a></li>
<li><a href="http://www.twitter.com/TidBITS" title="Get Article Updates via Twitter" class="gettb">Twitter <img src="/images/feed_icon_12x12_twitter.png" width="12" height="12" border="0" class="nav_img" alt="Get Article Updates via Twitter"></a></li>
<li><a href="http://www.facebook.com/pages/TidBITS/195314925519" title="Go to the TidBITS Page at Facebook" class="gettb">Facebook <img src="/images/feed_icon_12x12_facebook.gif" width="12" height="12" border="0" class="nav_img" alt="Go to the TidBITS Page at Facebook"></a></li>
<li><a href="javascript:void(0)" title="Sections" class="tabhead" onClick="return showhide('articleslist')">Sections <span id="articleslist_triangle"><img src="/images/nav_triangle_open.gif" width="9" height="9" border="0" class="navtriangle" id="articleslist_tri_image" alt="Click to show or hide the contents of this section."></span></a></li>
<li><a href="javascript:void(0)" onClick="return showhide('stafflist')" title="Staff" class="tabhead">Staff <span id="stafflist_triangle"><img src="/images/nav_triangle_closed.gif" width="9" height="9" border="0" class="navtriangle" id="stafflist_tri_image" alt="Click to show or hide the contents of this section."></span></a></li>
<li><a href="javascript:void(0)" title="Issues" class="tabhead" onClick="return showhide('issuelist')">Weekly Issues <span id="issuelist_triangle"><img src="/images/nav_triangle_closed.gif" width="9" height="9" border="0" class="navtriangle" id="issuelist_tri_image" alt="Click to show or hide the contents of this section."></span></a></li>
<li><a href="javascript:void(0)" onClick="return showhide('abouttidbits')" title="About TidBITS" class="tabhead">About TidBITS <span id="abouttidbits_triangle"><img src="/images/nav_triangle_closed.gif" width="9" height="9" border="0" class="navtriangle" id="abouttidbits_tri_image" alt="Click to show or hide the contents of this section."></span></a></li>
<div class="center_top">Thoughtful, detailed coverage of the Mac, iPhone, and iPad, plus the best-selling <a href="http://www.takecontrolbooks.com/?pt=TB-TAGLINE" style="color:yellow">Take Control</a> ebooks.</div>
<!-- begin centercolumn -->
<div id="centercolumn">
<!-- begin rightcolumn_container -->
<div id="rightcolumn_container">
<!-- begin rightcolumn -->
<!-- rightcolumn is embedded within centercolumn so featured text wraps around it -->
</div><!-- end tearoffbox_wide_container for watchlist items -->
<!-- begin tearoff box wide -->
<div class="tearoffbox_wide_container">
<div class="tearoffbox_wide_tips">
<div class="tip_display">
<div class="tips_sponsor_logo">
</div>
<h6>Is it a Unicode Font?</h6>
<p><p>To determine if your font is Unicode-compliant, with all its characters coded and mapped correctly, choose the Font in any program (or in Font Book, set the preview area to Custom (Preview > Custom), and type Option-Shift-2. </p><p>If you get a euro character (a sort of uppercase C with two horizontal lines through its midsection), it's 99.9 percent certain the font is Unicode-compliant. If you get a graphic character that's gray rounded-rectangle frame with a euro character inside it, the font is definitely not Unicode-compliant. (The fact that the image has a euro sign in it is only coincidental: it's the image used for any missing currency sign.)</p><p>This assumes that you're using U.S. input keyboard, which is a little ironic when the euro symbol is the test. With the British keyboard, for instance, Option-2 produces the euro symbol if it's part of the font.</p></p>
<p>Visit <a href="http://www.takecontrolbooks.com/leopard-fonts.html?14@@!pt=TBTIPS">Take Control of Fonts in Leopard</a></p>
</div>
<div class="tearoffbox_wide_bottom_tips">
<div style="padding-bottom:35px"><div class="tip_display" style="float:left"><p><br><a href="/tipbits/85">Link to this tip</a></p></div><div class="tip_display" style="float:right; width:150px">
<p class="pagesubtitle">How to fight annoying, fast- spreading macro viruses. </p>
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_all_articles('2405,2392,2216,2919,2928,2971')"><span id="showhide_arts_top">Show the full text of all articles</span></a>
<div class="tbf_wide_80" id="hc_rc_2405">To help us avoid automated posts and misuse of our site, please enter the words below.</div><div class="x_close_row" id="hc_upper_right2_2405"><a href="javascript:void(0)" onmousedown="HidePopupContent('hc_2405', 'hc', '2405'); return true;">Close</a></div>
<div class="featured_meta"><div class="meta_article">12 Feb 1996 | <a href="/article/1132?print_version=1">Print <span class="shift_up"><img src="/images/printer_icon.gif" alt="Printer-Friendly Version of This Article" border="0" width="9" height="10"></span></a></div></div>
<H2><a href="/article/1132">More Word Macro Viruses</a></H2>
<div id="article_blurb_2405"><p>More Word Macro Viruses -- According to a recent CIAC bulletin, new Microsoft Word macro viruses have been discovered, and at least two of the new varieties are damaging<span class="readmore_series"><a href="javascript:void(0)" onClick="return showhide_article('2405')">Show full article</a></span></p></div>
<div id="article_text_2405" style="display:none"><p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2405')">Hide full article</a></p><p><STRONG>More Word Macro Viruses</STRONG> -- According to a recent CIAC bulletin, new Microsoft Word macro viruses have been discovered, and at least two of the new varieties are damaging. (See <A HREF="http://www.tidbits.com/tb-issues/TidBITS-312.html">TidBITS-312</A> for a related story.)</p><p><A HREF="http://ciac.llnl.gov/ciac/bulletins/g-10a.shtml">http://ciac.llnl.gov/ciac/bulletins/g-10a.shtml</A></p><p>Although the worst effects are still reserved for Windows users (apparently the virus engineers aren't up-to-date on cross-platform concerns), users of Microsoft Word 6.0 or 6.0.1 on the Macintosh should be concerned. Microsoft has released new tools to combat these viruses, and many commercial anti-virus products are being updated to detect them as well.</p><p><A HREF="http://www.microsoft.com/msoffice/freestuf/msword/download/mvtool/mvtool2.htm">http://www.microsoft.com/msoffice/freestuf/ msword/download/mvtool/mvtool2.htm</A></p><p>I haven't examined or tested Microsoft's new virus protection tools, and though Microsoft claims these tools work on a Macintosh, they're posted in a self-extracting ZIP format for DOS/Windows machines. StuffIt Expander with Expander Enhancer will decompress the file; so will Thomas Brown's popular Mac shareware utility ZipIt. As with Microsoft's earlier anti-virus tool, Microsoft's new utility only scans files opened by choosing Open from the File menu; documents which are double-clicked in the Finder or chosen from the recent documents list are not scanned. [GD]</p><blockquote>Microsoft -- 206/635-7200 -- <<A HREF="mailto:wordinfo@microsoft.com">wordinfo@microsoft.com</A>> </blockquote><p><A HREF="ftp://mirror.aol.com/pub/info-mac/cmp/stuffit-expander-352.bin">ftp://mirror.aol.com/pub/info-mac/cmp/stuffit- expander-352.bin</A><BR><A HREF="ftp://mirror.aol.com/pub/info-mac/cmp/drop-stuff-with-ee-352.hqx">ftp://mirror.aol.com/pub/info-mac/cmp/drop- stuff-with-ee-352.hqx</A><BR><A HREF="ftp://mirror.aol.com/pub/info-mac/cmp/zip-it-135.hqx">ftp://mirror.aol.com/pub/info-mac/cmp/zip-it- 135.hqx</A></p><!-- More Word Macro Viruses Geoff Duncan --></div>
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2405')">Hide full article</a></p><div class="sponsorbox">
<div class="sponsortext"><A HREF="http://www.webcrossing.com/"><IMG SRC="http://db.tidbits.com/images/badges/web-crossing.gif" ALT="" HEIGHT="50" WIDTH="50" BORDER="0" ALIGN="left"></A>WebCrossing Neighbors Creates Private Social Networks<br />Create a complete social network with your company or group's<br />own look. Scalable, extensible and extremely customizable.<br />Take a guided tour today <<a href="http://www.webcrossing.com/tour">http://www.webcrossing.com/tour</a>></div>
<div class="tbf_wide_80" id="hc_rc_2392">To help us avoid automated posts and misuse of our site, please enter the words below.</div><div class="x_close_row" id="hc_upper_right2_2392"><a href="javascript:void(0)" onmousedown="HidePopupContent('hc_2392', 'hc', '2392'); return true;">Close</a></div>
<div class="featured_meta"><div class="meta_article">29 Jan 1996 | <a href="/article/1158?print_version=1">Print <span class="shift_up"><img src="/images/printer_icon.gif" alt="Printer-Friendly Version of This Article" border="0" width="9" height="10"></span></a></div></div>
<H2><a href="/article/1158">Word Macro Viruses Still Out There</a></H2>
<div id="article_blurb_2392"><p>In TidBITS-292, we reported on a cross-platform virus written in WordBasic that affected some users of Microsoft Word 6.0, mostly on non-Macintosh platforms<span class="readmore_series"><a href="javascript:void(0)" onClick="return showhide_article('2392')">Show full article</a></span></p></div>
<div id="article_text_2392" style="display:none"><p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2392')">Hide full article</a></p><p>In <A HREF="http://www.tidbits.com/tb-issues/TidBITS-292.html">TidBITS-292</A>, we reported on a cross-platform virus written in WordBasic that affected some users of Microsoft Word 6.0, mostly on non-Macintosh platforms. Since then, an additional WordBasic virus has appeared; although the WordBasic viruses discovered so far are not particularly destructive, they present a support headache for Macintosh managers, and - according to reports - the viruses are becoming more common on the Mac.</p><p>I've found a good deal of information about the viruses online, and Microsoft has released a set of anti-virus tools to combat the problem.</p><p><A HREF="http://www.research.ibm.com/xw-D953-wconc/">http://www.research.ibm.com/xw-D953-wconc/</A><BR><A HREF="http://ciac.llnl.gov/ciac/notes/Notes12.shtml#WINWORD">http://ciac.llnl.gov/ciac/notes/ Notes12.shtml#WINWORD</A><BR><A HREF="ftp://ftp.microsoft.com/softlib/mslfiles/mw1222.hqx">ftp://ftp.microsoft.com/softlib/mslfiles/ mw1222.hqx</A></p><p>For the record, the viruses spread as WordBasic macros included in Word 6 documents, and - because WordBasic works across platforms - the viruses can infect any machine running Word 6, regardless of platform. On the Macintosh, the virus <STRONG>only</STRONG> affects Microsoft Word 6.0 and 6.0.1; earlier versions of Word do not include WordBasic and cannot be infected, even when using infected Word 6 documents from another system. Commercial anti-virus utilities like Virex and SAM can detect the viruses, but the freeware Disinfectant does not, since it's designed only to pursue viruses in machine code form. If you use a commercial anti-virus package, contact your vendor if you have questions about detecting WordBasic viruses.</p><p>Quick checks with some large corporate and educational Macintosh sites using Word 6 didn't reveal widespread concern, although incidence varied widely. One source at a large site estimated that 80 to 90 percent of Macs in the company were infected; conversely, several sites reported they'd never seen the viruses on a Mac. An educational site reported detecting and removing the viruses "a few times a week," and a support manager at a large corporation noted the WordBasic viruses appear frequently on Macs in heavily cross-platform departments. Several sources noted that Mac users think the virus can't spread to the Mac, and thus take no preventative measures.</p><p>I've seen no reports of significant damage caused by the viruses; the main cost seems to be the time support personnel spend dealing with it or purchasing and installing anti-virus software, a task apparently sometimes dictated by (in the words of one source) "overly paranoid" management. One site reported the virus had spread in an infected template file to nearly every employee via email. "No one got hurt, but we spent well over a week chasing it down, explaining everything, and re-assuring everybody. That certainly wasn't cheap." Interestingly, <STRONG>all</STRONG> these sources spoke to me only on the condition they remain anonymous.</p><p>If you use or support Word 6 in an environment where documents are regularly exchanged with others (particularly outside your organization), it might be worth investigating how to detect the viruses and manage the situation, rather than waiting for a larger problem to develop. Microsoft's detection tool takes a while to scan a hard disk (especially on a Mac), but you only need to do it once. Better safe than sorry.</p><BLOCKQUOTE><p> Microsoft -- 206/635-7200</p></BLOCKQUOTE><!-- Word Macro Viruses Still Out There Geoff Duncan --></div>
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2392')">Hide full article</a></p><div class="sponsorbox">
<div class="sponsortext"><A HREF="http://markspace.com/bits?source=tidbits"><IMG SRC="http://db.tidbits.com/images/badges/mark-space.gif" ALT="" HEIGHT="50" WIDTH="50" BORDER="0" ALIGN="left"></A>SYNC YOUR PHONE with The Missing Sync: Sync your calendar,<br />address book, music, photos and much more between your phone<br />and Mac. Supports ANDROID, BLACKBERRY, PALM PRE and many<br />other phones. <<a href="http://markspace.com/bits?source=tidbits">http://www.markspace.com/bits</a>></div>
<div class="tbf_wide_80" id="hc_rc_2216">To help us avoid automated posts and misuse of our site, please enter the words below.</div><div class="x_close_row" id="hc_upper_right2_2216"><a href="javascript:void(0)" onmousedown="HidePopupContent('hc_2216', 'hc', '2216'); return true;">Close</a></div>
<div class="featured_meta"><div class="meta_article">28 Aug 1995 | <a href="/article/1350?print_version=1">Print <span class="shift_up"><img src="/images/printer_icon.gif" alt="Printer-Friendly Version of This Article" border="0" width="9" height="10"></span></a></div></div>
<H2><a href="/article/1350">Cross-Platform Virus Strikes Word Users</a></H2>
<div id="article_blurb_2216"><p>Though the possibility of a cross-platform virus moving as interpreted commands in data documents has been considered by computer experts, none had been seen in the user community until this month's discovery that a new virus was spreading within document macros interpreted by Microsoft's WordBasic macro language<span class="readmore_series"><a href="javascript:void(0)" onClick="return showhide_article('2216')">Show full article</a></span></p></div>
<div id="article_text_2216" style="display:none"><p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2216')">Hide full article</a></p><p>Though the possibility of a cross-platform virus moving as interpreted commands in data documents has been considered by computer experts, none had been seen in the user community until this month's discovery that a new virus was spreading within document macros interpreted by Microsoft's WordBasic macro language. The virus, dubbed "Word-Macro-9508" by the Macintosh antivirus community, can spread on any computer system using a version of Microsoft Word 6.0.</p><p>So far the virus has been seen mostly on DOS, Windows, and OS/2 computers running Word 6, in various locations in North America and Europe. It has been referred to as "WinWord.Concept", "WW6", and "WW6Macro" in the Windows community, though it is by no means restricted to the Windows version of Word 6. Microsoft's name for the virus is "Prank Macro". The code can be spread merely by opening an infected Word document - even one that has been transferred from a different operating system - since Word's macros are stored as data and are automatically recognized by any current version of the application.</p><p>The virus adds several new macros to Word's global macro pool, named "AAAZA0", "AAAZFS", "Payload", and "FileSaveAs". This last activates the virus in an infected file when the user chooses Save As from the File menu. The altered macros are then saved with the file. If the virus has infected your Word documents, you may see an alert window with the digit "1" in it when the virus is triggered, or you may notice that infected Word files are saved as templates rather than normal documents.</p><p>IBM has gathered a fair amount of information on the virus and how to combat it, and published it at:</p><p><A HREF="http://www.research.ibm.com/xw-D953-wconc/">http://www.research.ibm.com/xw-D953-wconc/</A></p><p>Microsoft has released tools to combat the virus, obtainable on the Internet. As of this writing, Microsoft's fix renames the virus rather than removing it, and there have been reports that a supplied file system scan function may not find all infected files on a Macintosh.</p><p><A HREF="http://www.microsoft.com/kb/softlib/mslfiles/mw1222.hqx">http://www.microsoft.com/kb/softlib/mslfiles/ mw1222.hqx</A><BR><A HREF="ftp://ftp.microsoft.com/softlib/mslfiles/mw1222.hqx">ftp://ftp.microsoft.com/softlib/mslfiles/ mw1222.hqx</A></p><p>[Note that Microsoft still isn't posting BinHex files correctly and this file must be downloaded in binary mode. Try using Netscape, which downloads most everything in binary, or Fetch, which has a Binary button that forces a binary download. Otherwise, configure your FTP client to treat the file suffix ".hqx" as a binary file, and be sure to change the setting back when you're done. -Geoff]</p><p>Datawatch Corporation has released an update (version 5.6.1) of its commercial Virex utility for Macintosh, available on commercial online services and at:</p><p><A HREF="ftp://gateway.datawatch.com/pub/">ftp://gateway.datawatch.com/pub/</A></p><p>No updates are currently planned for the other Macintosh antiviral utilities; most do not attempt to address viruses that don't take a machine-code form.</p><p>Since Mac versions of Microsoft Word prior to 6.0 don't incorporate WordBasic, and since even on newer versions these macros are easily spotted and removed, users need not panic about this virus.</p><BLOCKQUOTE><p> Information from:<BR> Gene Spafford<BR> IBM</p></BLOCKQUOTE><!-- Cross-Platform Virus Strikes Word Users Mark H. Anbinder --></div>
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2216')">Hide full article</a></p><div class="sponsorbox">
<div class="sponsortext"><A HREF="http://markspace.com/bits?source=tidbits"><IMG SRC="http://db.tidbits.com/images/badges/mark-space.gif" ALT="" HEIGHT="50" WIDTH="50" BORDER="0" ALIGN="left"></A>SYNC YOUR PHONE with The Missing Sync: Sync your calendar,<br />address book, music, photos and much more between your phone<br />and Mac. Supports ANDROID, BLACKBERRY, PALM PRE and many<br />other phones. <<a href="http://markspace.com/bits?source=tidbits">http://www.markspace.com/bits</a>></div>
<div class="tbf_wide_80" id="hc_rc_2919">To help us avoid automated posts and misuse of our site, please enter the words below.</div><div class="x_close_row" id="hc_upper_right2_2919"><a href="javascript:void(0)" onmousedown="HidePopupContent('hc_2919', 'hc', '2919'); return true;">Close</a></div>
<div class="featured_meta"><div class="meta_article">09 Jun 1997 | <a href="/article/2189?print_version=1">Print <span class="shift_up"><img src="/images/printer_icon.gif" alt="Printer-Friendly Version of This Article" border="0" width="9" height="10"></span></a></div></div>
<div id="article_blurb_2919"><p>Last week in TidBITS-382, I wrote a short piece warning people not to become complacent about viruses on the Macintosh. I received a number of notes, including one thanking me for the article (the reader ran Disinfectant, which promptly found virus infestations on his hard disk)<span class="readmore_series"><a href="javascript:void(0)" onClick="return showhide_article('2919')">Show full article</a></span></p></div>
<div id="article_text_2919" style="display:none"><p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2919')">Hide full article</a></p><P>Last week in <A HREF="http://www.tidbits.com/tb-issues/TidBITS-382.html">TidBITS-382</A>, I wrote a short piece warning people not to become complacent about viruses on the Macintosh. I received a number of notes, including one thanking me for the article (the reader ran Disinfectant, which promptly found virus infestations on his hard disk). Most, however, talked about what has become a more serious issue since I was last seriously involved in the anti-virus world - macro viruses, and especially those lurking in Microsoft Word 6.0 documents. Although we covered this topic in <A HREF="http://www.tidbits.com/tb-issues/TidBITS-312.html">TidBITS-312</A> and <A HREF="http://www.tidbits.com/tb-issues/TidBITS-314.html">TidBITS-314</A>, the subject needs more attention.</P><P><STRONG>Viruses and Macro Viruses</STRONG> -- On the Macintosh, viruses are usually small bits of code embedded in other files that can replicate themselves between files and between machines. Viruses may or may not cause damage; some are deliberately destructive, but some are just annoying. When I wrote about viruses last week, I was thinking about the traditional sort, which infect Macintosh files, mostly applications and the System file. The free program Disinfectant finds these viruses by scanning files for the specific code resources used by the viruses. Most Macintosh viruses are in fact named for their code resource signatures, such as nVIR and MBDF.</P><<A HREF="ftp://ftp.acns.nwu.edu/pub/disinfectant/disinfectant36.sea.hqx">ftp://ftp.acns.nwu.edu/pub/disinfectant/ disinfectant36.sea.hqx</A>><P>Macro viruses aren't larger versions of viruses. They share the basic virus definition - small bits of code with replication capabilities that are embedded in other files - but instead of being Macintosh code resources, they're written in application macro languages, such as HyperTalk, Word Basic, or - conceivably - even AppleScript or Frontier's UserTalk. Unfortunately, since high-level application macro languages are generally easier than C, assembly, or other low-level programming languages, neophyte scum find it easier to write (or shamelessly copy and modify) macro viruses than more traditional viruses. Since Disinfectant only scans code resources, it doesn't identify macro viruses, and cannot protect you from them.</P>Disinfectant also doesn't attempt to detect another class of malicious programs, called Trojan Horses. These programs often pose as a utility, game, or other useful program, but perform anything from a prank to severe disk damage when they run. Trojan Horses are rare on the Macintosh, and commercial anti-virus utilities should detect known examples.<P>The first macro viruses I know of were written in HyperTalk. They infected HyperCard stacks, and some still exist today, although few are destructive. HyperCard is alive and well, but it doesn't have the wide distribution and use it did when Apple bundled it for free with every Mac. As a result, HyperCard viruses aren't as much of a problem as they might be. For more information about HyperCard viruses and tools for eliminating them, check out HyperActive Software's HyperCard Viruses page.</P><P><<A HREF="http://www.hyperactivesw.com/Virus1.html">http://www.hyperactivesw.com/Virus1.html</A>></P><P><STRONG>Word Macro Viruses</STRONG> -- Of far more concern today are Word (and to a lesser extent, Excel) macro viruses. These viruses, written in Microsoft's Word Basic macro language (available only in Microsoft Word 6.0 and later), are embedded in Word documents. When an infected document is open, the macro viruses can copy themselves into your global template file, and from there into other Word documents.</P><P>To judge from the listings maintained by the Virus Test Center at the University of Hamburg, many Word macro viruses (over 1,100) exist, and new ones appear constantly. The problem is simple - since the Microsoft Office applications, including Word and Excel, are cross-platform, macro viruses written by PC users in Word Basic are often virulent even on the Macintosh as long as you run Word 6.0 or later. Of course, those macro viruses that try to do things like issue FORMAT C: commands can't hurt a Mac, but they can replicate themselves. Mike Groh, Software Development Manager at Virex manufacturer Datawatch, noted, "Macro viruses are quickly becoming a larger problem than Mac system viruses ever were at their peak. Improved cross-platform support for the Macintosh has brought with it one of the headaches of the PC world."</P><P><<A HREF="http://agn-www.informatik.uni-hamburg.de/vtc/eng.htm">http://agn-www.informatik.uni-hamburg.de/vtc/ eng.htm</A>><BR><<A HREF="ftp://agn-www.informatik.uni-hamburg.de/pub/texts/macro/">ftp://agn-www.informatik.uni-hamburg.de/pub/ texts/macro/</A>></P><P>A number of readers commented that these macro viruses are commonplace in corporations because people trade Word documents around all the time, and corporations are more likely than individuals to have upgraded to, and standardized on, Word 6.0. Even worse, it's easy for these infected files to find their way into backup tapes and onto CD-ROMs, which makes it easier for them to spread and re-infect cleaned systems.</P><P><STRONG>Eliminating Macro Viruses</STRONG> -- Since you can't use Disinfectant to find or remove Word macro viruses or any other sort of macro virus, you must rely on other tools. The two commercial anti-virus applications I mentioned last week, Virex and SAM, can both identify and eliminate many of these macro viruses, although reports from readers indicate that the viruses change frequently enough that even keeping up with Datawatch's and Symantec's updated virus listings isn't always enough. With over 200 new macro viruses appearing each month, that's not surprising, although Datawatch reportedly tries to do next-business-day turnaround when a customer sends in a new virus.</P><P><<A HREF="http://www.datawatch.com/virex.shtml">http://www.datawatch.com/virex.shtml</A>><BR><<A HREF="http://www.symantec.com/sam/index.html">http://www.symantec.com/sam/index.html</A>></P><P>Microsoft also provides information about macro viruses and tools to help identify them. Notes from readers haven't been particularly positive about the performance and usefulness of the main utility, called MVTOOL, and the Microsoft Web site comments: "MVTOOL is able to scan for and disinfect files that contain the Concept virus. However, it is not able to detect or remove any of the other known macro viruses and is prone to crashing when processing a large number of files." MVTOOL works by notifying you when documents that you open contain macros, and lets you open the documents without the macros, which is useful, but not nearly as hands-off as anti-virus tools should be. Users simply can't be expected to know what is and what is not a macro virus.</P><P><<A HREF="http://www.microsoft.com/word/freestuff/mvtool/virusinfo.htm">http://www.microsoft.com/word/freestuff/mvtool/ virusinfo.htm</A>></P><P>Since I mainly use Word 5.1 when I use Word at all, I've never run into a Word macro virus and can't offer advice from personal experience. However, my feeling is that if you use and rely heavily on Word 6.0 or later, particularly if you frequently trade files with other users, it's worth getting and installing not only Microsoft's MVTOOL, but another commercial anti-virus tool such as Virex or SAM. Of course, if you don't need Word 6.0's features, Word 5.1 doesn't suffer from macro viruses at all, and can safely open infected Word 6 files. Ideally, a future version of Microsoft Office would have a feature that would prevent macro viruses.</P>In the end, be careful out there. A major reason that the Macintosh world is plagued by relatively few traditional viruses is that the anti-virus tools are updated so quickly and utilized by such a large number of Macintosh users (and many of the programmers worked together on identifying and eliminating each new virus) that the viruses never had a chance to spread far. Vigilance is the only defense. If you own a commercial anti-virus program that fails to catch a macro virus that infects your documents, be sure to send the infected document (clearly labeled, of course) to the program's manufacturer immediately, so they can add it to their list of viruses to eradicate. Only then can we hope to get the upper hand in the fight against the macro viruses.<STRONG><P></STRONG><!-- Beware Macro Viruses Adam C. Engst --></div>
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2919')">Hide full article</a></p><div class="sponsorbox">
<div class="sponsortext"><A HREF="http://www.smilesoftware.com/"><IMG SRC="http://db.tidbits.com/images/badges/SmileLogo2010-50x50.gif" ALT="" HEIGHT="50" WIDTH="50" BORDER="0" ALIGN="left"></A>Get more productive with software from Smile: PDFpen for<br />editing PDFs; TextExpander for saving time and keystrokes while you<br />type; DiscLabel for designing CD/DVD labels and inserts. Free demos,
<br />fast and friendly customer support. <<a href="http://www.smilesoftware.com/">http://www.smilesoftware.com/</a>></div>
<div class="tbf_wide_80" id="hc_rc_2928">To help us avoid automated posts and misuse of our site, please enter the words below.</div><div class="x_close_row" id="hc_upper_right2_2928"><a href="javascript:void(0)" onmousedown="HidePopupContent('hc_2928', 'hc', '2928'); return true;">Close</a></div>
<div class="featured_meta"><div class="meta_article">23 Jun 1997 | <a href="/article/2203?print_version=1">Print <span class="shift_up"><img src="/images/printer_icon.gif" alt="Printer-Friendly Version of This Article" border="0" width="9" height="10"></span></a></div></div>
<H2><a href="/article/2203">More on Macro Viruses</a></H2>
<div id="article_blurb_2928"><p>The point of many viruses, macro or otherwise, is to annoy people, waste time, and generally eat bandwidth of various sorts. That's ironic, given the amount of space the topic consumes whenever it appears in the press (see TidBITS-383)<span class="readmore_series"><a href="javascript:void(0)" onClick="return showhide_article('2928')">Show full article</a></span></p></div>
<div id="article_text_2928" style="display:none"><p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2928')">Hide full article</a></p><P>The point of many viruses, macro or otherwise, is to annoy people, waste time, and generally eat bandwidth of various sorts. That's ironic, given the amount of space the topic consumes whenever it appears in the press (see <A HREF="http://www.tidbits.com/tb-issues/TidBITS-383.html">TidBITS-383</A>). But, since numerous readers made useful comments and suggestions, we wanted to pass along the information to help everyone understand more about the macro virus problem. This will be it for virus coverage in TidBITS for a while, but you can find a great deal more information about viruses on the Macintosh (including macro viruses) on David Harley's Viruses and the Macintosh FAQ at:</P><P><<A HREF="http://webworlds.co.uk/dharley/anti-virus/macvir.faq">http://webworlds.co.uk/dharley/anti-virus/ macvir.faq</A>></P><P><STRONG>If it hurts...</STRONG> Of all the responses I received, the simplest (and often presented with tongue firmly planted in cheek) solution offered to the Word macro virus problem was simply to avoid using Microsoft Word 6 or other programs that suffer from macro viruses. That of course won't work universally, because people don't always have much choice about the programs they use.</P><P><STRONG>Auto-running Macros</STRONG> -- Others suggested turning off auto-running macros in Word 6, which prevents some macro viruses from replicating or performing other anti-social acts. Unfortunately, many macro viruses use alternate methods of activation, including deceptive names, co-opted common command key shortcuts, and captured menu items. So, although turning off auto-running macros in Word 6 might help slightly, it's not a reliable solution.</P><P><STRONG>Locked Normal Template</STRONG> -- One intriguing solution for preventing the spread of Word macro viruses, from Tyler Stewart <<A HREF="mailto:stewart@utkux.utk.edu">stewart@utkux.utk.edu</A>>, was to lock the Normal template file, which lives in the Templates folder in the Word folder. Select it in the Finder and choose Get Info from the File menu, then click the Locked checkbox. Locking the Normal template prevents any macro virus from infecting it, but macro viruses could also transfer themselves to other open documents or run without replicating. More problematic is the fact that Word 6 seems to cache the Normal template in RAM, so the RAM copy can be infected (and thus pass on the infection during that session) even with the Normal template locked. In other words, this solution won't always work and might prove irritating if you need to change the Normal template.</P><P><STRONG>File Conversions</STRONG> -- A number of readers suggested variants on file conversion techniques. Microsoft Word 5 can't run macros of any sort, so it's safe from Word 6 macro viruses. Some people thought that macros could be carried in a file that Word 5 had converted, opened, saved, and which was then re-opened in Word 6. Datawatch's Mike Groh reported that they've had no reports of macros surviving the conversion process, either via Word 5 or via translators such as DataViz's MacLinkPlus. In both our and Datawatch's testing, conversions stripped the macros.</P><P><<A HREF="http://www.dataviz.com/Products/MLP/MLP_Home.html">http://www.dataviz.com/Products/MLP/MLP_ Home.html</A>></P><P><STRONG>Eliminating Macros Entirely</STRONG> -- Some folks suggested techniques that might work for eliminating all macros in Word documents. But, macros are not inherently evil, and anything that blindly removes all macros could easily destroy useful or even necessary macros. Tools like Microsoft's MVTOOL aren't so destructive, since they offer the choice of opening documents without macros on a per-file basis. However, don't trust MVTOOL's protection (accomplished via a macro called SCANPROT, which confused some readers), because it works only if you use the Open command in Word's File menu to open the files. If you double-click a Word file in the Finder or use other methods of opening files from outside Word (like the Recent Files hierarchical menu, or Now Super Boomerang), MVTOOL won't work. Read the documentation with MVTOOL carefully before relying on it.</P><P><<A HREF="http://www.microsoft.com/word/freestuff/mvtool/virusinfo.htm">http://www.microsoft.com/word/freestuff/mvtool/ virusinfo.htm</A>></P><P><STRONG>Other Anti-virus Utilities</STRONG> -- Just to be complete, Datawatch's Virex and Symantec's SAM aren't the only commercial anti-virus programs available for the Mac that can detect and eliminate macro viruses. Also available are McAfee's VirusScan and Dr. Solomon's FindVirus, and others may exist as well. I have no recommendations here other than to note that Datawatch's Mike Groh was voluntarily helpful in checking and commenting on these articles. Viruses affect everyone, so I'd lean toward companies who participate in the communities their software protects.</P><P><<A HREF="http://www.datawatch.com/virex.shtml">http://www.datawatch.com/virex.shtml</A>><BR><<A HREF="http://www.symantec.com/sam/index.html">http://www.symantec.com/sam/index.html</A>><BR><<A HREF="http://www.mcafee.com/prod/av/vsmac.html">http://www.mcafee.com/prod/av/vsmac.html</A>><BR><<A HREF="http://www.drsolomon.com/products/avtk/ps_mac.html">http://www.drsolomon.com/products/avtk/ps_ mac.html</A>></P><P><STRONG>Eternal Vigilance</STRONG> -- This entire topic came up because of my warning in <A HREF="http://www.tidbits.com/tb-issues/TidBITS-381.html">TidBITS-381</A> that the Macintosh community was becoming complacent about viruses. Several readers alerted me to infected CD-ROMs that have recently been distributed to numerous people, including Apple's Official May 1997 Marketing ToolKit, which goes to dealers and the media. There are two lessons to be learned. First, don't trust even seemingly innocuous sources, because even CD-ROMs and disks from reputable companies can become infected. Second, if you're in charge of mastering CDs or creating master disks, check the disks with anti-virus software! It's simply unacceptable for any widely distributed CD-ROM or floppy to carry infected files.</P><P><STRONG>Design a Sandbox</STRONG> -- I believe that the eventual solution to these macro viruses is for the companies producing software with macro capabilities to take the responsibility of designing their programs in such a way to eliminate macro viruses. Although Sun's Java language undoubtedly isn't perfect, it was designed to prevent malicious uses. Even if someone finds a way around that design, it won't be as easy as it is with macro languages. I won't pretend to know if it's even possible to create a macro language that doesn't suffer from macro viruses, but with the number of macro viruses that appear every day, it's clear that the problem is very real.</P><!-- More on Macro Viruses Adam C. Engst --></div>
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2928')">Hide full article</a></p><div class="sponsorbox">
<div class="sponsortext"><A HREF="http://www.smilesoftware.com/"><IMG SRC="http://db.tidbits.com/images/badges/SmileLogo2010-50x50.gif" ALT="" HEIGHT="50" WIDTH="50" BORDER="0" ALIGN="left"></A>Get more productive with software from Smile: PDFpen for<br />editing PDFs; TextExpander for saving time and keystrokes while you<br />type; DiscLabel for designing CD/DVD labels and inserts. Free demos,
<br />fast and friendly customer support. <<a href="http://www.smilesoftware.com/">http://www.smilesoftware.com/</a>></div>
<div class="tbf_wide_80" id="hc_rc_2971">To help us avoid automated posts and misuse of our site, please enter the words below.</div><div class="x_close_row" id="hc_upper_right2_2971"><a href="javascript:void(0)" onmousedown="HidePopupContent('hc_2971', 'hc', '2971'); return true;">Close</a></div>
<div class="featured_meta"><div class="meta_article">18 Aug 1997 | <a href="/article/4095?print_version=1">Print <span class="shift_up"><img src="/images/printer_icon.gif" alt="Printer-Friendly Version of This Article" border="0" width="9" height="10"></span></a></div></div>
<div id="article_blurb_2971"><p>I know I said I wouldn't write more about macro viruses a number of issues ago, but I couldn't resist passing on these useful pieces of information.Michael Gibbs comments:An ironic aspect of your warning regarding virus-infected disks from "official" sources is that most application installers recommend that you disable extensions, in many cases disabling your Mac's immune system<span class="readmore_series"><a href="javascript:void(0)" onClick="return showhide_article('2971')">Show full article</a></span></p></div>
<div id="article_text_2971" style="display:none"><p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2971')">Hide full article</a></p><P>I know I said I wouldn't write more about macro viruses a number of issues ago, but I couldn't resist passing on these useful pieces of information.</P><STRONG>Michael Gibbs</STRONG> <<A HREF="mailto:michael.gibbs@cas.honeywell.com">michael.gibbs@cas.honeywell.com</A>> comments:<BR><P><BLOCKQUOTE>An ironic aspect of your warning regarding virus-infected disks from "official" sources is that most application installers recommend that you disable extensions, in many cases disabling your Mac's immune system. I am in the habit of allowing SAM to check all the installation disks before restarting without extensions.</BLOCKQUOTE></P><P>Michael has an excellent point: checking original disks before installing is a good idea. However, since many application installers store their files in compressed archives which can prevent an anti-virus check from detecting infection, cautious sorts might also want to run a check immediately after installing a new program.</P><STRONG>A not-necessarily official Microsoft representative</STRONG> wrote:<BR><P><BLOCKQUOTE>The next version of Word for the Macintosh will contain the same level of improved protection as Word 97 for Windows. Word will warn the user when opening any document containing macros and allow the user to open the document without macros enabled. This option is enabled by default. Word will also allow the user to lock and password protect the Normal template at the VBA project level, which prevents any macros from being added to Normal, but does not prevent other customizations, such as styles or toolbar changes. All of this is implemented within Word itself, so does not suffer from the limitations currently in SCANPROT.</BLOCKQUOTE></P><P><BLOCKQUOTE>Your comment on macros not surviving conversion is absolutely correct. Currently, any and all conversions to or from Word pass through RTF as the interchange format. There has never been (and most likely never will be) a way for macros to be represented in RTF, so therefore any conversions will strip existing macros out of the document. This is actually a simple way for users to disinfect documents - simply save the document out as RTF [also known as Interchange Format in some Save As dialogs -Tonya] and then read it back into Word. The contents of the document itself will be unchanged, but macros, menu customizations, keyboard mappings, and so on will all be stripped out.</BLOCKQUOTE></P><STRONG>Kendall Bullen</STRONG> <<A HREF="mailto:kendall@his.com">kendall@his.com</A>> offers this tip:<BR><P><BLOCKQUOTE>Instead of opening a file that could have a macro, create a new Word document, choose File from the Insert menu, and insert the suspect file into the new document. Word will insert the formatted text just fine, but won't auto-run any macros that might have executed if you had opened the file normally (you also lose other template information). We've used this to "clean" several documents in Word 6, and it's worked fine for us.</BLOCKQUOTE></P><P><STRONG>Jonathan Rynd</STRONG> <<A HREF="mailto:jrr7@cornell.edu">jrr7@cornell.edu</A>> noted that Padgett Peterson has written a freeware macro scanner for Microsoft Word called MacroList that has worked well in his experience.</P><P><<A HREF="http://www2.gdi.net/~padgett/av.htm">http://www2.gdi.net/~padgett/av.htm</A>></P><!-- Macro Viruses (Slight Return) Adam C. Engst --></div>
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_article('2971')">Hide full article</a></p><div class="sponsorbox">
<div class="sponsortext"><A HREF="http://www.smithmicro.com/tidbits"><IMG SRC="http://db.tidbits.com/images/badges/StuffItDeluxe2010.gif" ALT="" HEIGHT="50" WIDTH="50" BORDER="0" ALIGN="left"></A>StuffIt Deluxe 2011 has everything you need to backup, encrypt,<br />share, and compress all of your photos, audio and documents.<br />Compress it. Secure it. Send it. Try StuffIt Deluxe 2011 today!<br />Click here for a free 30-day trial: <<a href="http://stuffIt.com/tidbits/">http://stuffIt.com/tidbits/</a>></div>
</div>
<div class="sponsorbox_bottom"> </div>
</div>
<!-- end article text -->
</div><!-- end show article -->
<p class="showhide_all_series"><a href="javascript:void(0)" onClick="return showhide_all_articles('2405,2392,2216,2919,2928,2971')"><span id="showhide_arts_bottom">Show the full text of all articles</span></a>
