[10069] in bugtraq
Re: Melissa Macro Virus
daemon@ATHENA.MIT.EDU (Dimitry Andric)
Wed Mar 31 16:58:56 1999
Date: Wed, 31 Mar 1999 14:35:50 +0200
Reply-To: dim@xs4all.nl
From: Dimitry Andric <dim@XS4ALL.NL>
To: BUGTRAQ@NETSPACE.ORG
In-Reply-To: <000601be7aa6$46d952c0$cbc9a8c0@osowa.poland.wpi>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 30-03-99 at 14:10 Bronek Kozicki wrote:
>There is another kind of protection (and I used it sucesfully in my
network
>for last few months). Just set NORMAL.DOT read only attribute. When
exiting
>Word user will be warned with message "unable to save modified
Normal.dot" -
>he/she then comes to support, and then we know that we have problem.
Of
>course - normal.dot is placed in user's profile. This is pretty
simple kind
>of protection against macro-viruses in Word.
It takes only a few lines of VBA code to remove the read only
attribute from the NORMAL.DOT file (of course left as exercise for the
reader:). Since any user or any macro code can remove this attribute,
this kind of "protection" is useless.
Cheers,
/Dim
- --
Dimitry Andric <dim@xs4all.nl>
PGP key: http://www.xs4all.nl/~dim/dim.asc
KeyID: 4096/1024-0x2E2096A3
Fingerprint: 7AB4 62D2 CE35 FC6D 4239 4FCD B05E A30A 2E20 96A3
-----BEGIN PGP SIGNATURE-----
Version: Encrypted with PGP Plugin for Calypso
iQA/AwUBNwIIlLBeowouIJajEQKsnQCggELVoEFoNR5XwKHjvvxxQxyqIk0AnRok
GPkqmVfKX1e8E8HS2JMUzP2O
=zQtQ
-----END PGP SIGNATURE-----
