How to stamp out RTF viruses, fix TweakUI, and more

eep 'em coming.

Now viruses can hide in RTF files

I've written in the past that I often save word processing documents as RTF files before sending them by e-mail to my correspondents. RTF files support most of the text formatting that's available in Microsoft Word and other word processors.

But an RTF file, which is stored as plain text, doesn't save any Word macro programs. This means an RTF file can't get infected with a macro virus as we mail it back and forth.

Unfortunately, a malicious person can still e-mail a macro virus by merely changing a .DOC file's extension to .RTF. (Microsoft should prevent Word from running macros in files with .RTF extensions, but it doesn't.)

For this reason, I recommend that my correspondents open RTF attachments using WordPad or Word Viewer, which can't run macros at all. This provides a fairly safe way to edit and exchange formatted documents. (WordPad is part of Windows. Word Viewer is a free program available at support.microsoft.com/support/kb/articles/Q165/9/08.asp.)

Unfortunately, virus authors found a weakness in RTF. A hacked RTF file, if sent as the body of an e-mail message, will crash Microsoft Outlook and other e-mail readers -- without you even opening an attachment.

Reader Kurt Seifried notified me that Microsoft has posted a patch for Windows 95, 98, and NT. (Windows 2000 is not vulnerable to the problem.) Go to www.microsoft.com/technet/security/bulletin/ms00-005.asp. After installing the fix, RTF files should once again be a harmless way to exchange documents.

A better workstation locking program

Last week I reported that reader Ken Oden recommended a $10 shareware program called Password. This utility gives Windows 95/98 machines some of the workstation-locking features of Windows NT and 2000.

No sooner had I written this than Oden found a free program that he raves about. The program is called DesktopShield 2000, although it works only under Windows 95 and 98. (In Windows NT and 2000, you lock your workstation using Ctrl+Alt+Delete or the shortcut I described last week.)

To get the utility, go to www.crosswinds.net/~steff3, then click Programs.

One too many tweaks in TweakUI

In my Oct. 9 column, I reported that Microsoft has released a version of TweakUI that is updated for Windows Me. TweakUI is a free utility that Microsoft has made available (but "unsupported") since Windows 95. It allows you to customize several user-interface aspects of Windows that would otherwise require you to manually edit the Registry.

Reader C. Ward Yelverton downloaded the new version of TweakUI. Then he found out -- the hard way -- that you shouldn't turn off its "Show Control Panel" check box.

After you turn off "Show Control Panel," Windows Me refuses to run any Control Panel applet. Because TweakUI itself is such an applet, you can't even run TweakUI to change the setting back.

Fortunately, you can recover by deleting one setting iin the Windows Registry. Microsoft posted the solution at support.microsoft.com/support/kb/articles/Q274/8/49.asp in response to Yelverton's pleas. He asked me to warn others not to do what he did.

If I haven't scared you out of it, you can get the latest TweakUI (which runs under Windows 95, 98, 2000, Me, and NT) at www.microsoft.com/ntworkstation/downloads/PowerToys/Networking/ NTTweakUI.asp.

Readers Seifried and Yelverton will receive a free copy of Windows Me Secrets for being the first to send me tips that I printed.

Success in ICANN elections

Three of the five people who won election to the board of the Internet Corporation for Assigned Names and Numbers (ICANN), the Internet's coordinating body, were among the slate of candidates I recommended in my Oct. 2 column.

The five new board members are Karl Auerbach, Andy Mueller-Maguhn, Nii Quaynor, Ivan Moura Campos, and Masnobu Katoh.

The official results are at www.icann.org. A good analysis of the winners is at www.latimes.com/business/cutting/20001016/t000098564.html. Thanks to all who voted.