Hopefully I won’t be asked to take this one down:

I was just looking for hours of operation for the Picabu buffet/cafeteria here at Disney’s Dolphin resort while I’m here for the SANS SCADA Summit.  I just can’t do anything anymore without stumbling across something security related, I guess.

If you haven’t spotted what’s “wrong” in the above image, don’t feel bad.  It’s an oldie but goodie:

This is a Word 97 (yeah, the nineties) macro virus that will randomly change the names of documents you create to “Ethan Frome”.  The computer used to create the document is infected with it.  Don’t panic though, because:

  • The document above has been exported to PDF, so it‘s safe isn’t spreading the Ethan Frome macro virus.
  • There only seems to be one malicious variant of this macro virus, and it modifies your autoexec.bat (lol) to format your C: drive…

Not much more than a curiosity :) .  I have a friend who had the misfortune of having his resume retitled “Ethan Frome” from this same macro virus several years ago.  He didn’t realize it till I pointed it out.  Funny stuff.

I met some great people at the Summit today (or rather, yesterday.  It’s late.), and I’m looking forward to attending some more talks in the morning.

  4 Responses to “Ethan Frome macro virus at Disney”

  1. Man, the Picabu has some good food. I think they are open 24/7. If they aren’t it’s pretty close to it. You should also try the Sushi place in The Swan. GOOD STUFF!! Glad to hear you’re having a good time.

  2. Yeah, I’ve been enjoying the Picabu, too. Tasty and much cheaper than the other places in The Dolphin, I think.

  3. A google search for Ethan Frome in the title turns up quite a few more infected documents out there, most are .pdf, and happen to be hosted on government sites

  4. Searching “ethan frome .doc” returns a ton of interesting things. A lot that I don’t think people wanted to be as public as they are. Also as the above anonymous said, adding .gov to the search even better.

 Leave a Reply

(required)

(required)

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

   
© 2012 McGrew Security Suffusion theme by Sayontan Sinha