[bksvol-discuss] Re: rtf & viruses
- From: "Jackie McBride" <abletec@xxxxxxxxx>
- To: bksvol-discuss@xxxxxxxxxxxxx
- Date: Fri, 14 Dec 2007 16:49:36 -0700
Folks:
While rtf files are not per se infectible, the problem is that word
files can be saved w/an rtf extension, & they can contain macro
viruses. See below.
-
--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--
- ---EXTERNAL RELEASE---
EMERGENCY RESPONSE SERVICE
SECURITY VULNERABILITY ALERT
22 May 1999 12:00 GMT Number: ERS-SVA-E01-1999:001.1
VULNERABILITY SUMMARY
VULNERABILITY: Melissa virus being distributed in .RTF files
PLATFORMS: Machines with Microsoft Word 97 or Word 2000
SOLUTION: Make sure your antivirus software scans files whose names have
.RTF extensions
THREAT: Mail handling systems could experience severe loading problems
as a result of this virus' propagation
DETAILED INFORMATION
I. Description
The W97M.Melissa.A macro virus caused widespread problems in March, 1999 by
overloading organizations' electronic mail handling systems as a result of
its propagation. Among other actions, the virus redistributes itself by
sending a copy of itself (via the infected Word document) to the first 50
addresses in each of the user's MAPI address books. If any of these
addresses are mailing lists, the total number of recipients could be much
higher.
IBM has learned that the W97M.Melissa.A virus is again being distributed,
this time in a Word document whose file name extension is ".RTF". These
documents are not really RTF files, but actually Word files whose file
extension has been changed. Unfortunately, many users' virus scanners are
not configured to scan ".RTF" files by default, which could result in the
virus not being detected.
NOTE: THIS IS NOT A NEW VARIANT OF THE MELISSA VIRUS.
II. Impact
The potential impact of this document, if received and opened on a system
whose antivirus software cannot detect it, may be as serious as the impact of
the original Melissa virus outbreak in your organization. For complete
information on the impact of the Melissa virus, consult
http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html
III. Platform-Specific Threats
In order to successfully propagate, the infected document must be opened with
Microsoft Word 97 or Word 2000 on a system that also has Microsoft Outlook
installed. HOWEVER, Microsoft Outlook does NOT have to be the mailer used to
read the message.
IV. Solutions
All major antivirus software vendors released signature updates to detect the
W97M.Melissa.A virus in March, 1999. Make sure that your antivirus software
has the latest signature updates from your vendor.
Make sure that your antivirus software is configured to scan files with the
".RTF" extension. Some antivirus programs do NOT scan these files by
default, and may require action by you to do so. Follow the instructions
provided with your antivirus software to add the ".RTF" extension to the list
of file types scanned.
V. Acknowledgements
IBM-ERS would like to thank the Symantec AntiVirus Research Center for
providing some of the information used in this advisory.
===============================================================================
Copyright 1999 International Business Machines Corporation.
The information in this document is provided as a service to customers of
the IBM Emergency Response Service. Neither International Business Machines
Corporation, nor any of its employees, makes any warranty, express or implied,
or assumes any legal liability or responsibility for the accuracy, complete-
ness, or usefulness of any information, apparatus, product, or process
contained herein, or represents that its use would not infringe any privately
owned rights. Reference herein to any specific commercial products, process,
or service by trade name, trademark, manufacturer, or otherwise, does not
necessarily constitute or imply its endorsement, recommendation or favoring
by IBM or its subsidiaries. The views and opinions of authors expressed
herein do not necessarily state or reflect those of IBM or its subsidiaries,
and may not be used for advertising or product endorsement purposes.
On 12/14/07, Jamie Yates, CPhT <jamieyates@xxxxxxxxxxx> wrote:
> I opened it, Jim. I had a hard time believing the file was infected and I
> don't think it was. I think Verizon's version of Norton was just giving me a
> difficult time.
>
> It did make me wonder, later, though, if Bookshare scans the uploads for a
> virus. It seems like a malicious person could really do some damage.
>
>
> Jamie in Michigan
> Currently Reading - Snipped in the Bud by Kate Collins
> I'm an eBay affiliate! Please click my link before you bid: Find hard to
> find items on eBay!
>
--
Jackie McBride
Please join my fight against breast cancer
<http://teamacs.acsevents.org/site/TR?px=1790196&pg=personal&fr_id=3489>
& Check out my homepage at:
www.abletec.serverheaven.net
To unsubscribe from this list send a blank Email to
bksvol-discuss-request@xxxxxxxxxxxxx
put the word 'unsubscribe' by itself in the subject line. To get a list of
available commands, put the word 'help' by itself in the subject line.
Other related posts:
- » [bksvol-discuss] Re: rtf & viruses
