[ale] virus info

[David Dagon]

Greg_Cook at vfc.com wrote:

> hi guys,
>
> we seem to have a word macro virus here ( in addition to the windows 95/nt
> virus) referenced as 'X97M/Tristate.c'....i can't find anything about it on
> mcafee or my old copy of technet....does anyone have a clue about this or know a
> good site for info on word macro viruses.

Try:

          www.xemacs.org

Hehe.  Couldn't help myself.

This sounds like a Visual Basic Tristate constants (number format) virus.
It could be a mutation of:

     http://www.symantec.com/avcenter/venc/data/tristate.html

You might try Microsoft.  They have a tiger team on 24x7 ready to patch
the latest OLE/COM/COM+/DCOM/etc. security hole.

          http://www.microsoft.com/security/default.asp

I seem to recall that Symantec has a research lab, and prides itself on quick
turn arounds for patches.  Likely, they have a filter for the macro signature,
or can make one quickly if you email them.

    http://www.symantec.com/avcenter/index.html

     It's very easy to write malicious macros for DCOM and Active X, so I
would not be surprised if this is something new.

    Best of luck with it,


David Dagon
Georgia Institute of Technology
dagon at cc.gatech.edu