First impressions count when the world is taken by surprise by an exciting new (macro) virus

Almost 30 years of VBA and the mayhem miscreants wrought with it

61 Reg comments Got Tips?

Who, Me? Welcome to Who, Me?, The Register's weekly reminder, thanks to the recollections of our readers, of a time when it was only viruses of the computer variety that were all the rage.

Today's tale of oops comes from a reader we'll call "Sam" in order to protect the identity of the woefully foolish. Not that Sam was at fault here. Quite the contrary...

Our story goes back to the 1990s, when Sam was beavering away as an avid Microsoft Word user, writing engineering standards for a contract engineering company.

While insisting that he doesn't, and has never, worked in IT, he told us: "I had a few nifty macros sorted to fix up formatting on the documents to the required corporate standards."

There were also some macros to "do a few other wacky things I needed from time to time."

The words "macro" and "Word" will have sent shudders down many an IT administrator's back. While hugely useful, the handy bits of script were also regularly abused by miscreants, particularly as Visual Basic for Applications put in an appearance and allowed all manner of naughtiness to be achieved.

Users, however, loved their timesaving macros, even as IT departments and antivirus vendors struggled to keep up with the new attack vectors.

"One day," said Sam, "my macros stopped working and the menu system looked... odd."

A normal user might not have spotted it, but Sam spent his days elbow-deep in the guts of Word and swiftly identified the culprit.

The infamous CAP macro had found its way onto his system, copied itself to the default template, disabled the Tools menu "and generally made itself a pain to remove."

While not particularly destructive, this variant had copied itself into every document Sam had opened.

"This was very much virus-like behaviour," he said, "so being a good little minion, I reported it to our IT department.

"They informed me that it was NOT a virus, since their virus detecting software had picked up nothing."

Sam noted the retort, but still pottered around all the PCs in his department to scrape the nastiness off them and made sure his colleagues knew how to do that same.

He's right – a person this helpful certainly does not belong in the IT world.

The IT team eventually caught up and "a day or two later there was an email sent round to all users informing them of the CAP macro virus that," Sam said, without a hint of sarcasm, "the IT department had discovered that morning, with instructions on how to get clean."

By then it was too late. One of Sam's colleagues in another department revealed that he'd had "contact" with the outside world and sent out a file festooned with the virus.

The content of the document? His CV.

"First impressions..."

Ever been the canary in the virus coalmine, only to find your warnings ignored? Or unwittingly unleashed macro horror upon the world? It is time to make your confession to the sympathetic vultures of Who, Me? ®

SUBSCRIBE TO OUR WEEKLY TECH NEWSLETTER


Biting the hand that feeds IT © 1998–2020