WR - Virus - Part II

[steved at qualitycabinets.com]

Ok then. Well, the good new is this will be fairly easy to clean off.

If you do get infected with this virus, what you will have to do is go into
MS Word and open a file on your machine called Normal.dot. This is a
template file that contains all the macros you might use. Once you have that
open you go to the "Tools" section on your task bar, and then select the
"Macro" option. Under that menu select the "Visual Basic Editor"

Once this opens, there will be a large window, and 2 small one on the left
of the screen. In the upper left window there will be an item called
"Normal" in bold type, open that until you see and item called "This
Document". Double click on that and it will open your macro, and this is
where you will see the actual virus.

At this point go back to your tool bar and click the "Edit" option, scroll
down and click "Select All"

This highlights everything on the virus, Hit the Delete key and - whammo -
its gone.

Now save the file, and close the Visual basic editor and Word, when you
restart, it will be gone.

After you get Word open again, you will need to go into the Word option, and
turn on the "Macro Virus Protection" option, the virus disabled this when it
opened.

There is also a hack to your registry that is harmless, but removing
wouldn't hurt. This is a bit more of a complex operation, so if you want to
get rid of this thing, let me know and I'll be more than happy to assist you
in taking care of it.

Oh, and I have gotten the internet address that the log file gets sent to,
and am placed a call to the Dallas FBI office. I think they'll want to look
at this, since one of the systems hit by this bug happens to belong to the
US Air Force. Looks like someone is in for a bad weekend.

And one more time for the record, this DID NOT originate from the Passe de
Armes document, it was just a victim, like the rest of us.

Padraig O'Duinn

MKA Steve Dunne

============================================================================
Go to http://lists.ansteorra.org/lists.html to perform mailing list tasks.