|
August 8, 2001
Ain't so Peachy
The Peachy virus comes to PDF - in what security experts hope is not the
first of many viruses in what used to be termed a safe environment. Some
users are going to have to take precautions, but not everybody is
susceptible. If you use Adobe Acrobat Reader, you've been spared the pain
this time because your Reader can't start the virus. But if you use Adobe
Acrobat (the full version; not just the reader), you are susceptible.
That's because the full version of the package is able to start up other
types of programs, such as VBscript, which can contain viruses. And the
Peachy virus hides in a PDF file waiting to be started by Acrobat's ability
to run programs.
Recognizing the virus
The subject usually says one of the following:
You have one minute to find the peach"
- "Find the peach"
- "Find"
- "Peach"
- "Joke"
The infecting attachment is usually named one of the following:
- "find.pdf"
- "peach.pdf"
- "find the peach.pdf"
- "find_the_peach.pdf"
- "joke.pdf"
- "search.pdf"
To find out whether you are susceptible to this virus
- Open Adobe Acrobat - typically by clicking on your [Start] button, then
selecting [Programs], then Adobe Acrobat.
- From the help menu, look for [About Acrobat] or [About Acrobat Reader].
- If it says About Acrobat READER, take a deep breath of relief, close the program and go
about your own business.
- If it doesn't have the word READER, you are susceptible to the virus. Make
sure you have your system scanned.
What to do -
- As with any email or attachment that you believe contains a virus, do not
open it. Delete it.
- Update your virus checking software to make sure it includes the definition
for peachy. (This virus was discovered on August 7, so any release before
that date doesn't treat peachy.) Then scan your system for viruses.
- If you have Adobe Acrobat (not Reader), turn off Windows scripting host to limit the risk of infection.
Turning off Windows scripting host
In Windows 98
- From the [Start] button, select [Settings]
- Choose [Control Panel]
- Select [Add/Remove]
- Click on the [Windows Setup] tab
- Click on [Accessories ]to obtain details
- Remove the check mark next to [Windows Scripting Host].
- Click [OK]
In Windows NT
- From [My Computer], select [View/Options]
- Click on the [File Types] tab
- Scroll to [VBScript Script File]
- Select [Remove]
- Click [OK].
In Windows 2000
- From [My Computer], select [Tools/Folder Options]
- Click on [File Types] tab
- Scroll to [VBScript Script File]
- Select [Delete]
- Click [OK]
As of this writing, Adobe doesn't offer a patch to protect you against the
peachy virus. If/when the company offers one, we'll alert you via the
Insider TipLetter.
As always, we will continue to help alert you to virus threats - both in this anti-virus section and via email, through our Insider TipLetter. Subscribe here. (Free)
|