automation application macro, most commonly a Visual Basic macro in a Microsoft Word or
Excel document. Macro viruses can cross system boundaries from Wind ows to Macintosh
computers with MS Office documents. Current versions of Microsoft Office contain strong
anti-macro protections to guard against known attacks.
ActiveX is one of Microsoft's distributed application technologies that enable web pages to
download programs on the fly with the full power of any executable running on your
machine. This makes ActiveX modules especially efficient and powerful, but also a security
risk since they can create, change, and delete files, add system programming code, or
take any other action your user account is allowed on your computer.
To help mitigate the risk, Microsoft provides a network architecture of encrypted security
certificates for ActiveX modules. This network gives you the option of refusing the
download of unsigned ActiveX modules from unknown authors, and at least disclosing the
signed identity of those modules that you do accept in case they later cause problems.
However, this approach is not universally accepted by the general user and professional
security communities, and is sometimes called "trust me now, try to catch me later". Users
running Internet Explorer on Windows machines should make sure that their browser
security settings are set to "disable" for unsigned ActiveX applets, and to "prompt" for
signed applets.
Hypothetical threats. The following script viruses are largely theoretical, but illustrate that they
can turn up wherever there is scripting code:
Java is a standard cross platform development environment, and is often used to download
scripts to add functionality like a clock or chat room interface to a web page. Java was
written with a strong security model which protects your computer's data and resources,
and it has so far proved remarkably resistant to script virus infection. You can turn Java off
in your browser if you want to be extra careful, but it will disable some useful functionality
on some web pages.
JavaScript is the standard web programming language. JavaScript also has a well-defined
security model that protects data and resources, and the few JavaScript viruses that have
been discovered have been mainly theoretical in nature. You can turn JavaScript off in
your browser settings if you want to be extra careful, but it will disable functionality on
many web pages.
MIME. The first script virus that triggered as soon as an email was opened was a MIME
virus that applied to older versions of Netscape Mail, Microsoft Outlook, and Eudora Mail.
In a variation on an old hacker technique, the attached MIME file was given a very long
name that triggered a bug which allowed the end of the name to be run as a series of
instructions, which could then be written to run the virus. However, a fix for the bug was
quickly developed for each vulnerable email program, and MIME viruses have so far
remained hypothetical.
Others. Several other scripting environments have also had viruses, including Corel Draw,
Hypertext Preprocessor, Windows Help, Windows installation files, and Windows registry
files. Anywhere there is a script interpreter there is an opportunity for a script virus to run.
Resources. The following sites provide more information on script and macro viruses:
Disabling Windows Scripting Host
Microsoft Macro Viruses
Yahoo -- Macro Viruses.