Revolutionary Multi-Platform Virus Attacks Word 6 Users World-Wide
from S&S International, Inc.
BURLINGTON, MASS., Aug 23, 1995 -- S&S Software International Inc.
A brand new virus has been released into the wild capable of infecting all
Microsoft Word 6 users (including those running Word under Windows 95).
It is the world's first virus to infect data files by installing macros.
S&S International PLC, developers of Dr. Solomon's Anti-Virus Toolkit, have
analyzed the revolutionary new virus which uses innovative techniques to
spread. It is known to be in the wild in the USA, United Kingdom, and
Finland, infecting Microsoft Word documents - even travelling via email.
The virus, which has been named by experts as WinWord.Concept, is also known
as WW6Macro, and Microsoft call it Prank Macro, has a number of revolutionary
new features.
WinWord.Concept is the first virus ever seen to infect documents rather
than executable code.
WinWord.Concept is the first ever multi-platform vtrus capable of infecting
Windows 95, Windows NT, and Apple Macintosh computers, as well as Windows 3.x
running Microsoft Word 6.
WinWord.Concept virus could potentially spread much faster than traditional
viruses, as users share documents more often than programs. Additionally,
some users have already unwittingly received this virus via email.
WinWord.Concept opens the door for a whole new breed of macro based viruses
capable of infecting data files, which had previously been relatively safe.
Winword.Concept makes use of the well-developed WinWord macro language,
WordBasic, to infect Word 6 documents (*.DOC) and the NORMAL.DOT global
template.
When an infected Word document is opened under Microsoft Word for the first
time, the virus takes control as an AutoOpen macro and infects the NORMAL.DOT
template (or any other template designated as the global default template).
A message box appears on the screen at this time (but not subsequently)
displaying the number "1". Every subsequent document saved using the
File/Save As menu option is infected with the WinWord.Concept virus. If
another user opens this Word file they will also be infected by the virus -
and every subsequent document they create will also be infected.
Because of this, the WinWord.Concept virus has a good chance of becoming
widespread - people exchange documents far more often than executable
programs.
Alan Solomon, Chairman of S&S International, said, "There has been
considerable discussion in the past about the possibility of a virus written
in a macro language. The nightmare is now a reality".
Users of Dr. Solomon's Anti-Virus Toolkit can download detection for this new
virus from their BBS (617 229-8804), E-mail or CompuServe (GO DRSOLOMON).
Other users can detect the virus via Microsoft Word itself. Users are advised
to select Tools/Macros and check the list of macros available. If there are
macros named AAAZFS, AAAZAO, AutoOpen, Payload, and FileSaveAs, then the
document is infected.
Dr. Solomon's team of experts has prepared a paper describing how to remove
the virus to anyone who finds they are infected. This can be obtained by
calling S&S International Software at (617) 273-7400, and asking for
technical support.
For further information please call David Emm at (617) 273-7400.
Info from Dr. Solomon's On-Line
WinWord.Concept is a revolutionary new virus.
It is the world's first multi-platform virus - spreading under Windows,
Windows 95, Windows NT and is the world's first virus to successfully
infect data rather thanexecutables - infecting Microsoft Word documents.
The good news is that the WinWord.Concept virus carries no destructive
payload - all it does is spread. Unfortunately it could easily be altered to
do something more damaging.
The virus is also known as WW6Macro and Prank Macro. So far, we at Dr
Solomon's have received reports of this virus from UK, USA, France, Germany,
Finland, Russia, Sweden, Canada, and Turkey.
The virus infects Microsoft Word documents by use of Word macros, one of
which is automatically invoked when Word loads a document.
Fortunately there is an obvious sign of this virus. When an infected document
is loaded into Word a dialog box appears containing a '1'. Note: This only
applies to WinWord.Concept - it cannot be relied upon to indicate the
presence of any other macro virus.
Another way to detect if the virus is present is to check the macros
installed in your MS Word Normal template. To do this choose Tools|Macro.
If you see the following macros: AAAZAO, AAAZFS, AutoOpen, PayLoad and
FileSaveAs, then you probably have WinWord.Concept. Please note: You have
to have all of these macros, not just one or two.
Dr Solomon's have provided a way of detecting this virus, even if you're not
running Word (ie. you can scan network drives, new floppy diskettes, and
compressed files without risk of infection).
One way of protecting yourself against the virus is to write a simple
Autoexec macro. Under Tools|Macros create a macro called AutoExec that looks
like this:
Sub MAIN
DisableAutoMacros
MsgBox("Turning all AutoMacros off.", "Protection installed", 64)
End Sub
