I have been struggling with the WM.CAP.A virus.
After receiving a Word file from a "trusted" source, I decided to open it up
(I was on deadline), after a warning about a possible virus.
I actually looked to see if there were any Macros, but none showed up.
I routinely forward my e-mail to 4 addresses. Here were the results (all
virus definitions have been updated in the last two months):
Machine 1 running IBM Anti-Virus: Message was of possible virus and I
deleted the file
Machine 2 running Norton Utilities 2.0 Virus Scan (which does not clean up
viruses): While receiving e-mail using MCI Mail, a warning popped up that I
had the WM.CAP.A virus (see below). I deleted the e-mail messages.
Problem 1: Norton is reporting a virus on files that I have deleted. The
message on the report says that I need to buy their anti-virus software to
disinfect my machine. I opened their protected recycle bin as well as the
regular recycle bin to make sure that the files that they mentioned were
deleted. Is this a sales pitch?
Machine 3 running McAfee Virus Scan (OEM): I received the messages in
Outlook Express and deleted them right away. McAfee never identified the
virus or made any further comment.
Machine 4 is a Mac: The Mac user said that the PC Word Viruses can't invade
the Mac. The files were not opened
Does anyone think that the Mac is at any risk?
Now my big problem.
I copied Excel files from Machine 2 to Machine 3 via diskette.
I ran McAfee and confirmed that there were no viruses on the 8 excel files
that I copied.
I attached the files and sent them to my mother-in-law (20 years in the
computer business).
She reported that the files were coming up with a possible virus message.
I thought that since I didn't open any files from the forwarded e-mail that
I should not have any viruses on my system.
Therefore, would Norton Anti-Virus Scan automatically open an e-mail
attachment to check for viruses?
How can my Excel files be infected if I am sending from a machine that
detects no viruses (I ran McAfee three times)?
Does anyone have any ideas, suggestions or similar experience?
Regards,
Alan Geist
[log in to unmask]
Info on WM.CAP.A from CIAC at http://ciac.llnl.gov/ciac/virdb/VIRS0007.TXT
Name/Aliases: WM.CAP.A
Type: Macro.
Disk Location: Word template files.
Features: Direct acting.
Damage: Interferes with a running application.
Size: Adds Macros to Word document/template files
Notes: SAM 4 with the 5/3/97 virus definitions can detect this virus but not
by name. It cleans the virus without problem. It deletes all existing macros
before infection.
Contains the Macros:
AutoClose
AutoOpen
AutoExec
CAP
FileClose
FileOpen
FileSave
FileSaveAs
FileTemplates
ToolsMacro -- this one is not encrypted and is only a procedure shell
The following text is in the macro code.
'C.A.P: Un virus social.. y ahora digital..
'"j4cKy Qw3rTy" ([log in to unmask]).
'Venezuela, Maracay, Dic 1996.
'P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !
Curious about the people moderating your
messages? Visit our staff web site:
http://nospin.com/pc/staff.html
|
