This is a story about computer viruses, and about complacency. And about embarrassment. In the process, I've been reminded that MS Word™ macro viruses are now responsible for more virus attacks than all the other kinds combined. It also seems that computer virus infections may be more common than we like to think because some people don't like to admit that they got caught offside. How many of your friends will admit to having passed on a virus, even unknowingly?

Last March, my son sent me a small humour file as an e-mail attachment. It was a MS Word 97 document, but I have only MS Word 6.0 at home. I've got Word 97 at work. So I put it on a diskette, and scanned the diskette for viruses to ensure that I wasn't taking one into the office on the diskette. I scanned it again on my computer at work, just to be sure. Nothing happened.

So I opened the file in Word 97 at my desk during my lunch hour, and enjoyed the humour. Then I passed the diskette to Harry, in the next office from mine. He enjoys a good joke too. He's also the guy who receives financial data from about 300 companies on diskettes, and he gets a few infected diskettes from those companies every year. So he's very careful about computer viruses. He scans everything he gets, which was a very good thing. His scanner immediately flagged the file on the diskette as infected with the W97M.Ethan.A macro virus. Of course, he didn't open the file, but he was quick to tell me that I had a problem.

A little investigation quickly revealed what had gone wrong. Every virus scanner needs a list of virus "signatures" so that the scanner knows what to look for. Neither of the scanners I had used knew what to look for to catch the Ethan.A macro virus. That virus appeared in January of this year; I hadn't updated my virus signature file at home since December of last year. The virus signature file on my machine in the office was even older. However, Harry's scanner was equipped with a current virus signature file. His signature file had been updated two days before I gave him the diskette because of the appearance of the Melissa macro virus. The only thing which saved me was because macro virus protection was enabled in my Word 97 installation, and I refused to allow macros to run when the document opened. (But don't rely on that feature in Word 97 — I gather that there are some macro viruses which know how to disable it.)

The office Systems Dept. was quick to respond. By the time they were done, they had implemented a planned upgrade for the anti-virus software on my machine and downloaded the latest virus signature file for the scanner from Norton's website. That let me confirm that the file on my diskette was indeed infected — and that the macro protection options that I had set up in MS Word had prevented the virus from infecting my system. My system was still clean. That was good news indeed.

What had me most worried was that by the time I found out that the humour file was infected, I had already passed two Word 97 files via the LAN to the department typist. She takes my raw output, tidies it up, and makes it fit for public consumption. She does that for everybody in the department. If the virus had taken hold on my workstation, those files would have infected her workstation when she opened them. From there, the whole department could have been infected very quickly. If that had happened, disinfection would have taken the better part of a day, and nobody would have been able to use their computers for word-processing until it was done for fear of spreading the virus further. As it was, neither the systems techie nor I left the office that evening until nearly 7:00 PM. My wife wasn't amused — we had an evening engagement that night. My boss wasn't amused either. It occurred to me that a request for overtime or CTO would not be well received, so I didn't ask.

There was a time when I updated my virus signature files monthly on my home system. I saw virus attacks happen to friends and acquaintances, but never to me. So I got complacent, and didn't follow my own rules. (see A Computer Virus Primer — RM) Now I'm embarrassed. My son was embarrassed too when I told him about the infection in the file he'd given me. I don't know what he's going to say to the friends of his to whom he also sent a copy of the file. But I doubt that he was as embarrassed as I was when I had to explain these events to my boss. Of course, if my son gave a copy of that file to his faculty advisor, and thus infected Wilfred Laurier University's LAN, he'll have been worse off than me. If anything like that happened, he hasn't admitted it.

"It can't happen to me," you say; "I wouldn't be so stupid as to take a humour file into the office." Right. But do you ever bring work home from your office, and take the results back to your office machine? And what about the files that your kids bring home from school to check out on your home system? Have you considered the possibility that one of those files might infect your home computer, and thus cause you to infect your office system through the work you took back to the office? All without knowing that you'd done it? If I'd had Word 97 at home, that's exactly what would have happened the next time I took homework back to the office. All because my virus scanner signatures were not up to date. (They are now — that got fixed on the weekend after I found out about the infected file.)

The really good news is that protection doesn't have to cost much. The previous version of Norton AntiVirus (NAV 4.0) for all Windows systems (including 3.1) is available on CD-ROM at London Drugs for $19.95 (or was at the time of this writing). You may not need to pay the extra $45 for the current version. The downside of this option is a lack of printed documentation and the lack of telephone support. (Documentation is on the CD-ROM, in Adobe Acrobat format, but Norton does not provide telephone support for a product version for more than 6 months after the successor version is out.) On-line support is still available, and can be useful. My own experience with Norton suggests that quality of the on-line support is uneven, but that can probably be said of most software suppliers.

But if you go the NAV 4.0 route, you must update the signature file which comes on the CD-ROM. It's more than a year out of date. The install routine will do that automatically, if you let it. But it does take time — the download is about 1350KB in size.
 

Robert Mayhew
Vancouver, B.C.

copyright © 1999