Re: Melissa Macro Virus

From: Dimitry Andric (dimat_private)
Date: Wed Mar 31 1999 - 04:35:50 PST

  • Next message: JJ Gray: "Potential vulnerability in SCO TermVision Windows 95 client"

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    On 30-03-99 at 14:10 Bronek Kozicki wrote:
    
    >There is another kind of protection (and I used it sucesfully in my
    network
    >for last few months). Just set NORMAL.DOT read only attribute. When
    exiting
    >Word user will be warned with message "unable to save modified
    Normal.dot" -
    >he/she then comes to support, and then we know that we have problem.
    Of
    >course - normal.dot is placed in user's profile. This is pretty
    simple kind
    >of protection against macro-viruses in Word.
    
    It takes only a few lines of VBA code to remove the read only
    attribute from the NORMAL.DOT file (of course left as exercise for the
    reader:). Since any user or any macro code can remove this attribute,
    this kind of "protection" is useless.
    
    Cheers,
    /Dim
    - --
    Dimitry Andric <dimat_private>
    PGP key: http://www.xs4all.nl/~dim/dim.asc
    KeyID: 4096/1024-0x2E2096A3
    Fingerprint: 7AB4 62D2 CE35 FC6D 4239  4FCD B05E A30A 2E20 96A3
    
    -----BEGIN PGP SIGNATURE-----
    Version: Encrypted with PGP Plugin for Calypso
    
    iQA/AwUBNwIIlLBeowouIJajEQKsnQCggELVoEFoNR5XwKHjvvxxQxyqIk0AnRok
    GPkqmVfKX1e8E8HS2JMUzP2O
    =zQtQ
    -----END PGP SIGNATURE-----
    



    This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 14:41:14 PDT