SECURITY

What are Macroviruses?

These viruses targeted Microsoft Office applications but appeared to be beaten. Do you need to prepare for a comeback?
Advertisement

A few years ago, macro viruses were one of the most common categories of computer predators. Instead of targeting programs, they infected documents and templates, most notably programs such as Microsoft's Word or Excel. The most notorious macro virus was the Melissa, a combination virus and worm, unleashed in 1999 by a New Jersey man who named the virus after a lap dancer and wound up confessing in court later that he caused $80 million in damage to U.S. businesses. The virus traveled via e-mail, targeting Microsoft Outlook users, and eventually forced such companies such as Microsoft, Intel, and Lockheed Martin to shut down their e-mail gateways for a spell.

At one time, macro viruses comprised an estimated 75 percent of the viruses in circulation according to Webopedia. Then they dropped from the headlines as software makers improved anti-virus programs and other computer threats became more prevalent. But anti-virus software vendor Kaspersky Lab in May revealed the discovery of a new macro virus that targets open-source applications, such as OpenOffice and StarOffice. (OpenOffice.org, the group that released the open source office program, disputes applying the label "virus" to Stardust, the exploit discovered by Kaspersky Labs.)

Assuming that macros may make a comeback, here is what you should know to protect your business:

What are macro viruses

Macro viruses are written in the internal macro language of an application. A "macro" is a sequence of commands that allows users to customize certain tasks with a single click. Among other things, users can use macros to format text, log in, and check mail accounts, copy data between applications. and generate reports. Macro viruses infect computers by replacing the normal macros that handle these tasks with a virus. That’s why Microsoft Office products -- such as Word, Excel and PowerPoint -- were their most frequent targets in the past.

Method of infection

Macro viruses spread through e-mail attachments, CD-ROMS, networks, modems, and the Internet. When you open a file containing a macro virus, it can infect your entire system, embedding itself in other documents and templates already stored on your machine, as well future ones. If you share an infected file with someone else, it will invade their system as well if they don't have anti-virus software installed. By this method, it can quickly spread and overwhelm a network.

Signs your computer is infected

While your system may function at normal levels even with a macro virus present, there are ways to detect its presence so that you can stop it before it gets too far. Consider these:

  • Unexplainable behavior. You may be prompted for a password on a file that is not password-protected, or a document may unexpectedly be saved as a template.
  • Strange error messages. Past examples include "Just to prove another point" or "ROBERTA, TI AMO!" or "STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC!"
  • Unexpected text appears in a document. The Melissa virus, for example, inserted quotes from the animated television series "The Simpsons" into Word documents.

Macro viruses will run on any operating system that uses susceptible applications. If you are familiar with the macros on your machine, glance through them periodically to check for any you don't recognize. Some examples of past macro names include AutoOpen, PayLoad, and AAAZAO.

How to protect yourself

Microsoft Office can be set to display a warning message whenever a document is opened that contains macros. To make sure this option is enabled, open the application's preferences file. Under the security tab, check the "warn before opening a file that contains macros" box. Always choose "disable macros" when asked, unless you are sure of the function of the macro. You'll still be able to open the file and read its contents.

Microsoft Office won't scan your hard disk, removable media such as CDs, or network to find and remove macro viruses. For that level of protection, you need to buy anti-virus software. Once it's installed, check frequently for new virus definitions and scan your system on a regular basis.

Microsoft Office won't scan your hard disk, removable media such as CDs, or network to find and remove macro viruses. For that level of protection, you need to buy anti-virus software. Once it's installed, check frequently for new virus definitions and scan your system on a regular basis.

Last updated: Sep 1, 2006




Register on Inc.com today to get full access to:
All articles  |  Magazine archives | Livestream events | Comments
EMAIL
PASSWORD
EMAIL
FIRST NAME
LAST NAME
EMAIL
PASSWORD

Or sign up using: