Rus Articles Journal

How to fight against macro viruses?

to the Author of article - owing to specifics of the work - are necessary “ to communicate “ with computer viruses almost daily: to treat the infected files, to eliminate various consequences of destructive action of viruses etc. I dare to hope that experience of it “ communication “ it can be useful to readers.

Treatment of the infected files

the easiest way of treatment - start of the anti-virus program. As a rule, the modern antivirus among other modules contains the anti-virus monitor which is constantly loaded into random access memory. In attempt of start or verification of the file infected with a macro virus, the antivirus will try to cure the file (in unsuccessful attempt of treatment - blocks access to it, i.e. will not give it to open or to copy).

It is also possible to use loading “ emergency “ the disk containing an antivirus with fresh bases (previously in BIOS needs to establish loading with CD - ROM `and). To load an antivirus, to scan the winchester, the found viruses will be neutralized.

If the antivirus could not cure the file infected with a macro virus (that happens very much and very seldom!), or it is necessary to work temporarily at the personal computer without the established antivirus, or not at hand loading “ emergency “ a disk, and the infected document Word ’and contains valuable information and is necessary as air, - is very effective way of manual treatment.

We keep (without opening!) the document Word in a format. rtf ( of rich text format ), i.e. it is necessary to change extension of the file. doc on. rtf . If you do not display expansions, it is necessary to start Windows Conductor, having opened any folder, for example, having clicked on a badge my computer . Choose the Service menu - Properties of the folder … In the opened dialog box of Property of the folder open the Look tab . In the scrolled list Additional parameters remove a tag from the line Hide Expansions for the registered types of files . Press of OK .

Find the file which needs to be cured. Now in its name expansion is displayed. doc . Change expansion in the name of the file. doc on. rtf (text format. rtf will allow to save all necessary information, including the text, drawings, tables; at the same time of VBA - a file superstructure in which macro viruses nest will be cleaned from a program code of a macro virus). There will be prevention of system: “ After change of expansion of a name of the file this file can be inaccessible. You really want to change expansion? Yes/no “. Authorize expansion change, having pressed Yes .

Further it is necessary to remove the infected Normal template . dot (after treatment at start of Word the Normal template . dot will be created anew) and other infected templates *. dot in the following folders (for Windows XP OS ):

1) C: /

2 Documents and Settings/Imya_polzovatelya/Application Data/Microsoft / Templates) C: / Documents and Settings/Imya_polzovatelya/Application Data/Microsoft/Word/STARTUP

3) C: / The Arrangement of Templates Documents and Settings / Imya_polzovatel / Templates

for Windows 98/ME:

1) C: /

2 Windows/Application Data/Microsoft / Templates) C: / WINDOWS/Application Data/Microsoft/Word/STARTUP

we Change extension of the file. rtf on. doc . We establish back a tag to Hide expansions for the registered types of files ( my computer - Service - Properties of the folder … - the Look - Additional parameters ): it is necessary in order that you had no inconveniences with renaming of files. We work with the file according to the usual scheme.

Attention! we will remove with

as a result of these actions a macro virus from the infected file and of Word ’and, but it can remain in other documents Word . Therefore before start of other documents it is necessary to scan system the anti-virus scanner (or to continue manual treatment that is very labor-consuming occupation! ).

How to be protected from macro viruses

1. Use reliable anti-virus programs ( of Panda, Norton, Kaspersky ) with regularly (not less once a week!) the updated bases.

2. Do not rely on the anti-virus monitor: always before copying and opening check the anti-virus scanner all executed files and documents (especially files on diskettes, flash cards, a compact - disks, received on the Internet).

3. Do so-called " more often; backup “ you store copies of the most valuable information on different carriers (for example, the disks CD - RW, flash cards etc.) .

4. Keep in mind that the ban of start of macroes recommended by some authors (the Service menu - the Macro - Safety … - the " dialog box; Safety “ - " tab; Safety level “ - Very high - OK ) is a half measure since at the same time start of macroes with standard names is not forbidden ( of FileOpen, FileSave, FileSaveAs, FilePrint, AutoExec ), i.e. there is an opening for macro viruses.

All to you kind!