From: Aron Roberts (aron@socrates.berkeley.edu)
Date: Wed Mar 21 2001 - 10:48:01 PST
Hi Jack,
In the message "[MAGNet] Re:", dated 2001-03-21, Robert N. Amsbury wrote:
>This is not a virus. Fast saves involve appending new changes to
>document directly to the end of the old document. So, basically,
>every time you open the document, it starts from the original form,
>then executes all the changes which have ever been made to it. What
>this means is that no matter how short the document is visually, if
>you start making changes to it, it will get larger and LARGER on the
>hard drive very quickly. If you disable Fast Saves and save the
>file again, you should find that it saves quickly and in less space.
Just to expand on Robert's trenchant comment, you can disable (or
enable) Fast Saves via the following steps:
1. From Word 98's "Tools" menu, select "Preferences...".
2. Click the "Save" folder tab.
3. Click the "Allow fast saves" button.
In nearly all cases, the causes that result in slow saves of Word
documents are either related to Word's "Fast Saves" feature or to
some other issue having nothing to do with viruses.
An additional step you might take when troubleshooting such
problems is to quit Word, then make backup copies of, and trash, the
following files.
- "Word Settings (8)" (in the "System Folder:Preferences" folder)
- "Normal" (in the "Microsoft Office 98:Templates" folder)
In a few cases, the presence of a Word macro virus might be the
cause of a perceptible slowdown when saving files in Word. Some
viruses do carry out actions when the user selects "File/Save" or
"File/Save As," such as copying viral macro code to the current
document. However, in most cases, these actions are performed
rapidly, and do not have any appreciable impact on the time required
to save the document.
If you've scanned your disks using Virex 6.1 with the latest Virus
Update (2001-03-01 at this writing) and found no viruses, the odds
that an as-yet-unidentified Word macro virus might be present are
quite remote.
If you've already ruled out most other possibilities, and have
already scanned for viruses, without finding any, below are two
methods that you could use to manually check for as-yet undetected
Word macro viruses.
Aron Roberts
Workstation Software Support Group
--The Normal template - where many viruses hang out ------------------------------------------------- Most Word macro viruses stash a copy of themselves (or a portion of their code) in the "Normal" template file.
As a result, this file often serves as the launching point for replicating a virus to additional documents. It is also the place from which a virus would typically deliver a viral 'payload' -- that is, to do something bad or at least annoying -- when a trigger event occurs.
Under the Mac OS, you can find this template file by searching for a file whose name is exactly "Normal", or else you can look for that file in the "Templates" folder in the "Microsoft Office 98" folder. (Under Windows 95/98, you can likely find this file by searching for NORMAL.DOT ...)
Determining if one's Normal template file is infected ... ---------------------------------------------------------
... by a VBA macro ------------------ To manually determine if the Normal template is infected with a Visual Basic for Applications (VBA) macro, at least on a Mac running Word 98 (I haven't tried this with Windows):
- From the "Tools" menu, select "Macro->Visual Basic Editor" - From the "View" menu, select "Object Browser" - Select "Normal" from the top left pop-up menu - Select "This Document" from the "Classes" list - Scroll down through the "Members of 'This Document'" list at right to see if any items are highlighted (boldfaced). (Such items apparently represent private items added to this file, such as viral macro code.) (One to look for: "Document_Open") - After you're done, close the Visual Basic Editor by selecting "Close and Return to Microsoft Word" from the "File" menu
... by a Word Basic macro ------------------------- To manually determine if the Normal template is infected with an older-style Word Basic macro, on a Mac running Word 98:
From Word's "Tools" menu, select "Macro->Macros". Select "Normal (Global Template)" from the "Macros in" pop-up menu.
If the Macro->Macros command is not present, it's possible that a macro has removed this command from Word's menus in order to make it more difficult for you to detect infections.
You might then try using the "Organizer" function, which has a "Macro Project Items" function that also lets you view macros in the Normal template file. (You may need to use Word's "Tools" menu, Customize..." item to allow you to conveniently access the Organizer function via a keystroke, or to assign it to a menu.) If the Macro->Macros function is still present, you can also get to the Organizer function by clicking the "Organizer" button in the Macros window.
------------------------------------------------------------------------ The following was automatically added to this message by the list server:
For information about MAGNet, its meetings and events, and its mailing list, including information on subscribing and unsubscribing, see the MAGNet Web site at <URL:http://mac.berkeley.edu/help/magnet/>.
This archive was generated by hypermail 2b29 : Wed Mar 21 2001 - 10:49:43 PST