The existing patches for this macro virus seem to me to miss the mark.
Does anyone on this list currently have a copy of the macro virus?
I would like to get a copy of it, so I can work on developing a more
discriminating patch against it.
Trying to block a virus like this by its signature text is, to me, silly,
since anyone intending on using the thing to do harm could easily
change those aspects. Therefore, perhaps a general macro virus protection
scheme is in order. Unfortunately, I haven't had any experience at
all with macro viruses, so I need a copy of this one to work off of.
Preliminarily, I was thinking of looking for things like AutoOpen,
AutoExec, messing with the registry, and rewriting normal.dot. Any
other suggestions? Is anyone else already doing this? I don't want
to reinvent the wheel, but I don't want to go for a commercial
antivirus package either. A free software (in the FSF sense) antivirus
package would probably be acceptable though, but I don't know of any of
those.
--
Erik Nielsen, Cyberhighway Internet Services NOC
I knew I'd hate COBOL the moment I saw they'd used "perform" instead of
"do".
-- Larry Wall on a not-so-popular programming language
