ShareFun.A virus

CATEGORY: Overblown computer security threats

Reporters wrote sensational news stories in February 1997 after a press release announced the ShareFun.A macro virus. Unfortunately, these news stories created numerous misconceptions:

ShareFun.A qualifies as the first "email macro virus." Note the emphasis here! The Christmas Tree worm used the same technique to spread itself in 1987; the Morris Internet worm (see related link) used a roughly similar technique in 1988. Legitimate security experts knew of this technique almost ten years ago.
ShareFun.A does not "cleverly work around all our safe computing practices" as one published report claims. It spreads by sending itself as a binary file attached to an otherwise blank message. Some people who received it then blindly opened the attachment without first inspecting it for macros, and thus they failed to follow safe computing practices.
Genuine virus & security experts so far seem willing to classify ShareFun.A as both a "worm" and a "virus." Note: few viruses are also worms; few worms are also viruses.
Some antivirus products can alert you to the mere existence of macros in a Word file. (Consult the user manual for whatever antivirus software you use to see if it offers this option.) You can also install add-on products for Word95 (e.g. Microsoft's free ScanProt package) or use an option in Word97 to disable macros whenever you open a file.

Some food for thought — you know to beware of blank messages with binary file attachments where the subject line reads "You have GOT to see this." Suppose a friend sends you a non-blank message with a different subject line. Would you open a binary-file attachment without checking it first for viruses? Why not? Your friend's message doesn't meet the criteria of the ShareFun.A alerts...

"This virus has only been seen at one site. There is no reason to panic."
-- virus expert Graham Cluley, 2 March 1997

Last updated: 2000/10/2