Avoid dangerous Office Trojan

Avoid dangerous Office Trojan

MELANI and CYCO observe increasingly malicious Office documents. How to protect yourself.

We the editors are increasingly encountered poorly crafted phishing invoices with Word attachments in recent days. Apparently, the Cycos, as well as the MELANI have now numerous feedback. These are an attempt to spread ransomware. The content can vary, the invoice amount also. Usually, a Word file in the annex, which, once opened, will download a malicious software is located. The macro Trojan is able to encrypt files of your PC or files from PCs on the same network.

Show picture on Twitter
Show picture on Twitter
Follow
GovCERT.ch @GovCERT_CH
Increased malicious Office documents in circulation: https://www.melani.admin.ch/melani/de/home/dokumentation/newsletter.html...
19:35 8 Jul 2016
20 20 Retweets 10 10 'like' specifications
Macro codes are programs that automate certain tasks in Office. If you not wide open the gateway, you configure Word and Outlook best, that macro codes without demand run. Proceed as follows here:

Protect Office range from macro Trojans
1. open Outlook. When Outlook 2010/2013 click above to start.
2. open the options, then the Trust Center (Security Center) or the Trust Center settings.
Under Outlook 2013 you will find the Security Center (Trust Center)
Under Outlook 2013 you will find the Security Center (Trust Center)
Zoom © screenshot / PCtipp
Click Trust Center settings. Open the macro settings left from the selection.
Customize the macro settings according to your needs. As everyday users choosing the best setting "disable all macros without notification.
Customize the macro settings according to your needs. As everyday users choosing the best setting "disable all macros without notification.
Zoom © screenshot / PCtipp
You can now make an appropriate selection. If you need anyway no macros for example as Otto normal users, we recommend setting disable all macros without notification. If you often work with macros, the setting notifications for all macros is more suitable. To be must authorize individually each macro.

You should make these settings in the same procedure also for Word and Excel. Unfortunately, this Office provides no global settings.
If the computer is already infected, only one thing can help: immediately disconnect the PC from the network to prevent a spread of the malicious software. A system restore is not possible. We recommend a clean installation. The data are then unfortunately lost, unless you have previously not regularly made backups. But do not pay money the blackmailers. It is not at all clear that promised is held. You can wait at most in such a case. After a certain time, the encryption algorithms are sometimes found.

General malware prevention
Generally, the usual safety precautions are of course - as always - recommended. These include regular data backups and current protection programs. In particular should be updated operating system, Office, browsers and plug-ins. Open basically no file attachments of mail in their trust are also only the shadow of a doubt. MELANI on this page summarizes more tips in dealing with email malware.

Tags: Word, vulnerability

Tweet