First Viruses To Target Microsoft's Visio Software
Computer Associates and the McAfee division of
Network Associates have warned PC users to be on the lookout for the first macro viruses to target Microsoft's Visio software.
The good news is that the macro viruses are relatively harmless, but
the bad news is that, as with the first viruses for any platform or
computer software, other viruses writers can tweak the macro launch
application and add a malicious payload.
Both IT security firms have identified the virus as VIS5/Radiant
Angels and rate it as being of low risk to users as it does not carry
a dangerous payload.
Interestingly, the VIS5/RadiantAngels virus is activated when an
infected document is closed. Upon activation, the virus will perform
a simple self-check - if it finds a Visio diagram that is not already
infected, it will copy itself to that file by overwriting the first
code module.
Computer Associates said that since every drawing has a default cod
module it also will infect documents without macros.
After infecting the documents, the virus creates a file called
index.html in the root directory of the drive. The file contains the
following text:
"A Multitude of Suns Orbit in Empty Space; They Speak with their
light to all that is dark. To me they remain silent. Greets to all the
VX Community And Radiant Angels its...... Radiant"
Simon Perry, Computer Associates' security business manager, said
that the virus represents a new type of threat, as it is the first
virus to specifically infect Visio files - a widely used file format.
According to McAfee, Visio 2000 has standard templates, and the virus
would spread faster in such environments. Files infected with
Unstable.A, the firm said, will cause a message to be printed on the
31st of each month.
McAfee said that both Visio 5 and Visio 2000 include the ability to
disallow macros, similar to the Microsoft Office products. The
setting is turned off by default, but the company is advising users
to consider disabling macros should more dangerous Visio viruses
surface.
Computer Associates' can be found on the Web at http://www.cai.com.