Word Macro Viruses Still Out There

In TidBITS-292, we reported on a cross-platform virus written in WordBasic that affected some users of Microsoft Word 6.0, mostly on non-Macintosh platforms. Since then, an additional WordBasic virus has appeared; although the WordBasic viruses discovered so far are not particularly destructive, they present a support headache for Macintosh managers, and – according to reports – the viruses are becoming more common on the Mac.

I’ve found a good deal of information about the viruses online, and Microsoft has released a set of anti-virus tools to combat the problem.

http://www.research.ibm.com/xw-D953-wconc/
http://ciac.llnl.gov/ciac/notes/ Notes12.shtml#WINWORD
ftp://ftp.microsoft.com/softlib/mslfiles/ mw1222.hqx

For the record, the viruses spread as WordBasic macros included in Word 6 documents, and – because WordBasic works across platforms – the viruses can infect any machine running Word 6, regardless of platform. On the Macintosh, the virus only affects Microsoft Word 6.0 and 6.0.1; earlier versions of Word do not include WordBasic and cannot be infected, even when using infected Word 6 documents from another system. Commercial anti-virus utilities like Virex and SAM can detect the viruses, but the freeware Disinfectant does not, since it’s designed only to pursue viruses in machine code form. If you use a commercial anti-virus package, contact your vendor if you have questions about detecting WordBasic viruses.

Quick checks with some large corporate and educational Macintosh sites using Word 6 didn’t reveal widespread concern, although incidence varied widely. One source at a large site estimated that 80 to 90 percent of Macs in the company were infected; conversely, several sites reported they’d never seen the viruses on a Mac. An educational site reported detecting and removing the viruses "a few times a week," and a support manager at a large corporation noted the WordBasic viruses appear frequently on Macs in heavily cross-platform departments. Several sources noted that Mac users think the virus can’t spread to the Mac, and thus take no preventative measures.

I’ve seen no reports of significant damage caused by the viruses; the main cost seems to be the time support personnel spend dealing with it or purchasing and installing anti-virus software, a task apparently sometimes dictated by (in the words of one source) "overly paranoid" management. One site reported the virus had spread in an infected template file to nearly every employee via email. "No one got hurt, but we spent well over a week chasing it down, explaining everything, and re-assuring everybody. That certainly wasn’t cheap." Interestingly, all these sources spoke to me only on the condition they remain anonymous.

If you use or support Word 6 in an environment where documents are regularly exchanged with others (particularly outside your organization), it might be worth investigating how to detect the viruses and manage the situation, rather than waiting for a larger problem to develop. Microsoft’s detection tool takes a while to scan a hard disk (especially on a Mac), but you only need to do it once. Better safe than sorry.

Microsoft — 206/635-7200