The Training Book, the handbook for trainers


 
ITrain - International Association of Information Technology Trainers Microsoft Mail-Transmitted Virus
McAfee detects first email-transmitted Word virus
Sidebar image map First Word Virus
by Dave Murphy
ISSN 1535-3613

Dave Murphy, DGL President & ITrain founder The Good Times email virus may have been a hoax, but McAfee Associates Inc. this week uncovered the first real Word macro virus to spread via Microsoft Mail.

The virus, ShareFun.A, infects documents in versions 6 & 7 of Microsoft Word. The latest version, Word 97, which is in the Office 97 suite, can automatically block the virus from activating.

Once activated, there is a 1-in-4 chance the virus will launch MS Mail and attach infected documents to messages sent to three people. The virus selects the three recipients randomly from the user's address book.

The subject line of the infected email will read, "You have GOT to read this!" echoing previous hoax viruses such as Good Times.

The Good Times virus hoax, however, suggested that a user could be infected with the virus simply by reading the email. ShareFun.A requires a user to actually open an infected document.

If a user opens the infected mail attachment with Word, his or her Word template will become infected and the macro virus will continue to replicate.

"It replicates as a Word macro virus like any other, but it adds in that [Microsoft] Mail component to help make distributing the virus easier," said Jimmy Kuo, senior virus researcher for McAfee. Microsoft officials acknowledged that this was another unique way of spreading a macro virus.

A free beta version of VirusScan that detects ShareFun.A is available from McAfee.

McAfee can be reached at http://www.mcafee.com/ or 408.988.3832.

Subscribe to ITINFO.
Receive computing and Internet news & tips
by subscribing to the ITINFO information service.
Type your Internet email address in the form, and click "Subscribe."
Email Address:

Damar Group, Ltd. helps business use technology.

ITINFO is again accepting sponsors. Sponsor messages are included in ITINFO's email newsletter and are permanently posted to DGL's website and online reference areas.

ITINFO is an electronic publication of Damar Group, Ltd., publisher of Training Express computer learning guides. Comments and submissions to info@dgl.com.

Previous issues are on our website at dgl.com/dglinfo.

updated February 23, 1997
http://dgl.com/dglinfo/1997/dg970223.html

Damar GroupReturn to DGL homepage
Copyright © 1997, Damar Group, Ltd., All Rights Reserved