[Storyboy]

Hey,

I just found out that a Word file I sent to a Windows-user couldn't be opened because of the existence of this O97M.Tristate virus.

I admit that I have not used virus-protection since upgrading to X, so I don't know where the virus originated.

How do these Macros work? Is my Mac immune in all but the transmission to others? Is this a defect in MS Office? Should I trash Office and re-install?

Thanks.

PS: Let me know if this is the wrong forum.

[malvolio]

Here is some info on that particular virus. I don't see how it could infect your system if you don't run Virtual PC.
Was the infected doc one you had created, or one you were forwarding from someone else?

[Amorph]

Office for Macintosh can preserve and transmit Word macro viruses. They don't affect the Mac itself, but they can turn its copy of Office into a carrier.

If you do a lot of Word document sharing with PC users, you should keep an up-to-date antivirus program around. Not so much for yourself as for the poor PC users you're exchanging documents with.

[Storyboy]

Originally posted by Amorph:
Office for Macintosh can preserve and transmit Word macro viruses. They don't affect the Mac itself, but they can turn its copy of Office into a carrier.

Is there anyway I can reverse this without the use of an Antivirus program? Would a re-install be free of the problem?

I have created Word files at work on a Windows machine and emailed them to myself here at home, to edit on the Mac. Is that how one catches these things?

[Cipher13]

Originally posted by Amorph:
Office for Macintosh can preserve and transmit Word macro viruses. They don't affect the Mac itself, but they can turn its copy of Office into a carrier.

If you do a lot of Word document sharing with PC users, you should keep an up-to-date antivirus program around. Not so much for yourself as for the poor PC users you're exchanging documents with.

I disagree - make THEM keep an up to date AV program around It's their problem, not ours.

[jasong]

Reinstalling Office will not solve the problem. The virus is in the document, not the application.

Sorry dude, anti-virus software is the only way to go.

-- Jason

[CharlesS]

Originally posted by Storyboy:
Is there anyway I can reverse this without the use of an Antivirus program? Would a re-install be free of the problem?

I have created Word files at work on a Windows machine and emailed them to myself here at home, to edit on the Mac. Is that how one catches these things?

Yep, that's probably how you got it.

You'll need an AV program (sorry...) on both your Mac and also on your Windows machine at work. If the Windows machine is owned by the company you work for, you may want to inform the IT people that one of their machines may be infected with a virus.

And in the future, turn on "Macro Virus Protection" in the Word preferences so that it will warn you before executing any macros.

[baggie]

There is one cost free way you can share documents with your PC colleagues, largely without virus risk - send them as PDFs.

This may not be a suitable solution if you need the documents to remain editable, but if the documents need only be read only, or you need only to be able to make comments on the contents, PDF is one great way to go.

You can produce PDFs for free in OS X, or if you and your colleagues need more output and sharing flexibility, you could buy Adobe Acrobat.

[jasong]

Baggie, that only works if the virus in question is an Office Macro Virus. While this is the most common, there are plenty of Windows viruses that will attach themselves to any type of file.

-- Jason

[JKT]

Originally posted by jasong:
Baggie, that only works if the virus in question is an Office Macro Virus. While this is the most common, there are plenty of Windows viruses that will attach themselves to any type of file.

-- Jason

I think what baggie meant was that if the original poster creates PDFs in MacOS X from their Word files, in place of saving them as .doc files, then it would be impossible for them to transmit a virus. You are correct that this would not work the other way around (Win to Mac).

[CharlesS]

Originally posted by jasong:
Baggie, that only works if the virus in question is an Office Macro Virus. While this is the most common, there are plenty of Windows viruses that will attach themselves to any type of file.

-- Jason

How could you catch a virus from a PDF or an RTF file?

[Millennium]

Originally posted by CharlesS:
How could you catch a virus from a PDF or an RTF file?

Actually, there is one known PDF virus on record. Adobe had recently introduced a feature whereby you could attach JavaScript to PDFs, and a virus was soon created. It never really caught on, though, and it only affected Adobe Acrobat anyway.

[Millennium]

Originally posted by Storyboy:
Is there anyway I can reverse this without the use of an Antivirus program? Would a re-install be free of the problem?

A re-install won't help. The problem is not that Word has gotten a virus: Word itself is the problem. I don't just mean that as Microsoft-bashing: the viruses are actually run by Word.

I have created Word files at work on a Windows machine and emailed them to myself here at home, to edit on the Mac. Is that how one catches these things?

Sort of. It's not unique to e-mail; if you carried the files home on a CD or Zip disk, you would still catch them.

This is what a virus is. It attaches itself to ("infects") a single file. When an infected file is opened, the code from the virus is run, and usually this code seeks out other files on the same machine to infect. But the only way a virus can spread is for an infected file to be transferred from one machine to another; it cannot spread across machines on its own. In the old days, for a virus to spread from Alice's machine to Bob's, Alice would have to copy an infected file to a floppy, put it in Bob's machine, and copy the infected file onto Bob's hard drive, and then run the code. Nowadays, people download files from servers or e-mail them to each other more often than using floppies, but the basic principle is the same.

Most e-mail "viruses" (which you do not have) are not really viruses at all. They're something different, called worms. The differences is that viruses spread from file to file, where worms spread directly from computer to computer. A worm will download itself to a machine (usually using some kind of security hole in the target machine), run itself, and start the process with more machines. Files do not become "infected" by worms, because the file itself is the worm. Most worms nowadays use e-mail to spread, because Outlook anbd Entourage -the only e-mail clients susceptible to worms of this kind- provided a convenient environment for it. Using their macro systems, it was possible to compose entirely new e-mails, attach files, and get a big list of targets through the program's address book, and even better than that, most Outlook clients will automatically run any attachments as soon as they are downloaded, so you don't even have to trick the user into running the code. It was the perfect breeding ground for worms, and this is what Melissa (the first worm of this kind) took advantage of.

There is, incidentally, a third kind of file to watch out for: Trojan horses. Unlike viruses and worms, Trojan horses are completely unable to spread on their own, and they cannot run themselves either: a user must be tricked into it. Once they run, though, they perform some Bad Thing, and that's it. most spyware programs could be considered kinds of Trojan horses.

[CharlesS]

Originally posted by Millennium:
Actually, there is one known PDF virus on record. Adobe had recently introduced a feature whereby you could attach JavaScript to PDFs, and a virus was soon created. It never really caught on, though, and it only affected Adobe Acrobat anyway.

You've got to be kidding me. You'd think they would have learned a lesson from the Word Macro viruses.

When are these companies going to learn that adding the ability to put executable code in a common file type that gets transferred around frequently is a Bad Thing�?