Absolute PC Security and Privacy.pdf

DrawBringInFrOut, InsertPBreak, and ToolsRepaginat. However, after Word is infected,
these macros are copied to the Normal template and renamed to StartOfDoc, AutoOpen,
InsertPageBreak, and FileSave.
Melissa Perhaps the most widespread macro virus, Melissa was destructive enough to bring
down several large international corporations for several days in March of 1999. Melissa is
coded into a Microsoft Word document; when the document is opened, Melissa opens
Microsoft Outlook and sends e-mail copies of itself to the first fifty names it finds in the
user’s Address Book. The subject of the e-mail is typically Important Message From ,
with the user’s name inserted—although some variants of this virus send messages with blank
subject lines. The text of the message is as follows:
Here is that document you asked for … don’t show anyone else :-)
An infected DOC file is attached to the e-mail; the initial file was named list.doc, but
variations to this have appeared over time. Melissa infects the user’s normal.dot file, and if
the minute of the hour matches the day of the month (for example, 3:31 on March 31st),
inserts the following message into the current Word document:
Twenty-two points, plus triple-word-score, plus fifty points for using
all my letters. Game’s over. I’m outta here.
Melissa’s destructive power was not in its payload, however, but rather in the huge amount of
e-mail traffic it generated—enough to equate to a denial of service attack on some servers. In
this aspect, Melissa was a very effective worm.
Note A worm is a very specific type of malicious file. Learn more about worms in Chapter 6,
“Trojan Horses and Worms.”
Nuclear Also known as Winword.Nuclear, Wordmacro-Nuclear, and Wordmacro-Alert, this
virus infects both DOC and DOT files, as well as certain COM and EXE files. This is because
Nuclear is both a macro virus and a file infector virus. It loads the following macros, which
can be viewed in Word’s Macros dialog box: InsertPayload, Payload, DropSurviv, AutoOpen,
AutoExec, FileExit, FilePrint, FilePrintDefault, and FileSaveAs. Fortunately, Nuclear is a
relatively innocuous virus; its primary payload is to insert the following line at the end of
every twelfth printed document:
And finally I would like to say: STOP ALL FRENCH NUCLEAR TESTING IN THE
PACIFIC!
The virus also attempts to delete key system files on April 5th of each year, but does so
ineffectively.
PPoint.Attach Also known as PowerPoint.Attach, this virus attacks PPT-format PowerPoint
presentation files. It’s a nondestructive virus, whose main goal appears to be simply to infect
other PPT files.
Current Risk