MVK 97 2.35
Macro Virus Killer
By Chris Stubbs

What's new in 2.35?
-Added the ability to immunize against the automatic e-mailing of the
 W97M/Melissa virus. MVK has always been able to remove it from infected
 documents and templates.

What's new in 2.34?
-Fixed a bug in the option: "Also leave alone modules if they appear to be
 totally innocent."

What's new in 2.33?
-Added a new option: "Also leave alone modules if they appear to be totally
 innocent."

What's new in 2.32?
-Disabling Auto Macros is now optional.
-Changed method for installing to the Startup folder to make it less likely
 for antivirus programs to false alarm on it. Should be faster, too.

What's new in 2.31?
-Added option to delete temporary file (ie. class.sys) automatically

What's new in 2.3?
-Added option to backup unvalidated modules before deleting in case you
 forget to validate a legitimate module.
-Restoring deleted menu items is now optional.
-Changed the interface a bit.

What's new in 2.21?
-Fixed a bug in the report.

What's new in 2.2?
-Improved startup directory check. Some viruses create an infected file in the
 startup directory to make themselves harder to remove. Files created by known
 viruses are removed automatically.

What's new in 2.1?
-MVK can now look at Class viruses and offers to delete the temporary file it
 uses to copy its code.
-MVK now also looks at the first two lines of Code Modules to look for the
 Validation Word.

What's new in 2.0?
-The entire program has been rewritten in Visual Basic for Applications.
-Creating a report file is now optional.
-You can now also install MVK just by copying MVK.DOT into Word's Startup
 directory. This is if you want to automate installing with a batch file or
 script.
-Removed code for converting templates into documents. Today's Word 97 Macro
 viruses don't convert documents into templates anymore.
-Removed code for working under Non-English versions and Macintosh versions of
 Word. I have no way of testing whether it really works. E-Mail me if you're
 able to test MVK under Non-English or Macintosh Word.

What's new in MVK 97?

MVK works like AntiCAP, but it is written for Word 97. It even uses
the options you selected if you installed AntiCAP. It also removes
the Class.Poppy type of viruses.

What is MVK?
MVK is a macro virus protection for Word 8 (Word 97). It is not a
replacement for your regular antivirus program. If used alongside your
regular antivirus it provides an extra layer of protection against macro
viruses your antivirus program doesn't know about.

How to use MVK:

Open the file MVK.DOT in Word. If you have Word's built in Macro Virus
Protection turned on, Word will ask whether to Enable Macros or Disable
Macros. Choose Enable Macros. You should turn off Word's Macro Virus
Protection by going Tools/Options/General/Macro Virus Protection. MVK 97
provides all the protection of Word's Macro Virus Protection plus more.

-or-

Copy MVK.DOT to Word's Startup Directory, usually
C:\Program Files\Microsoft\Office\Startup


MVK 97 will display a dialog like this:

+--------------------------------------------------------------------+
|MVK Options                                                         |
+--------------------------------------------------------------------+
|Validation Word                                                     |
|Any module that contains ____                                       |
|in the name or first two lines will be left alone by MVK            |
| [] Also leave alone modules if they appear to be totally innocent. |
|                                                                    |
|Options                                                             |
| [] Make a report file called _________                             |
|    [] Include copy of unvalidated modules in report                |
| [] Offer to delete temporary file used by Class viruses (Class.sys)|
|    [] Delete temporary file automatically                          |
| [] Restore menu items deleted by viruses                           |
| [] Disable Auto Macros                                             |
|                                                                    |
|     OK      Registering/About              Cancel                  |
+--------------------------------------------------------------------+

There are six options displayed, but if you don't use custom macros, you
can just leave them as they are and click OK.

The first option is called the validation word. It lets you continue to use
macros that you write. If you do not use macros, then you do not have to worry
about the validation word at all. MVK chooses a validation word at random
when you install it. When you create a module, put the validation word anywhere
in the module name or the first two lines and it will not be deleted by MVK. The
validation word is case sensitive.
The second part of the first option is 
"Also leave alone modules if they appear to be totally innocent."
If you choose this option, MVK will also leave alone modules that don't
do anything suspicious.

The report file option lets you choose whether MVK creates a log of all actions.
The default is C:\MACRO.LOG but you can change it to any other place you want.
The report option, "Include copy of unvalidated modules in report" will
include a copy of unvalidated modules in the report.

If you check the third option then MVK will offer to delete the temporary file
used by Class viruses. Most of the Class macro viruses use a temporary file
to copy their code to other documents. This temporary file is usually in C:\ and
has a SYS extension, but it is not really a system file. MVK will analyze the
class virus and display a dialog box offering to delete the temporary file.
If you select the fourth option "Delete temporary file automatically" MVK will
delete the file automatically.

The fifth option, "Restore menu items deleted by viruses", restores menus back
to their original state. Some macro viruses delete certain menu items.


The seventh option, "Disable Auto Macros" will Disable Auto macros like
AutoOpen, AutoClose and AutoNew. If you use Auto macros then uncheck this box.

When you click OK, MVK 97 will create a file called MVK.DOT in Word's
STARTUP directory if necessary. This file contains two protective macros,
Autoexec and FileOpen. They will check for macro viruses when you start Word
and when you open a file. They will also restore any menu items that were
deleted by a macro virus.

To uninstall MVK just delete MVK.DOT.

If you are upgrading to a new version of MVK, answer yes when it displays
a dialog box asking if you are upgrading. It will then create a file that
will do the update the next time you restart the computer.

MVK 97 is shareware.
The registration fee is $20 Canadian per computer or $300 Canadian for an
unlimited license. At today's exchange rate, it is about $14 US per
computer or $200 US for an unlimited license. Educational institutions
(schools, universities, and colleges) get 15% off. If you register you get
unlimited support via e-mail, and new versions before they are released. If
you register MVK 97 you are registered for all new versions of MVK 97
Also, registering gets the option of having a version customized for your
organization. For example, a version that uses the settings you specify
instead of displaying the Options Box.
E-Mail me if you have any questions. Send the registration fee to:

Chris Stubbs
11134 Dunning Crescent
North Battleford, SK
S9A 3M8
Canada

Send suggestions, questions, comments, suspicious files, etc to
stubbc@sk.sympatico.ca Feel free to send me any reports or possible bugs
or any feature requests.
