|
PureBytes Links
Trading Reference Links
|
If you use Macros in Microsoft products read on, otherwise not necessary
Return-Path: <press-english-interest-return-34-Peter2150=aol.com@xxxxxxxxxxxxxxxxxxxxx>
Received: from rly-zc01.mx.aol.com (rly-zc01.mail.aol.com [172.31.33.1]) by
air-zc02.mail.aol.com (v62.10) with ESMTP; Mon, 25 Oct 1999 13:59:37
-0400
Received: from dfmail.datafellows.com (dfmail.datafellows.com
[194.252.6.39]) by rly-zc01.mx.aol.com (v62.10) with ESMTP; Mon, 25
Oct 1999 13:59:16 -0400
Received: (qmail 12694 invoked by uid 107); 25 Oct 1999 17:44:10 -0000
Mailing-List: contact press-english-interest-help@xxxxxxxxxxxxxxxxxxxxx; run
by ezmlm
Precedence: bulk
Delivered-To: mailing list press-english-interest@xxxxxxxxxxxxxxxxxxxxx
Delivered-To: moderator for press-english-interest@xxxxxxxxxxxxxxxxxxxxx
Received: (qmail 12000 invoked from network); 25 Oct 1999 17:33:54 -0000
Message-Id: <4.1.19991025202324.00a54ca0@xxxxxxxxxxxxxxxxxxx>
X-Sender: mimmi@xxxxxxxxxxxxxxxxxxx
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1
Date: Mon, 25 Oct 1999 20:31:52 +0300
To: press-english-technical@xxxxxxxxxxxxxxxxxxxxx,
press-english-interest@xxxxxxxxxxxxxxxxxxxxx,
press-pr@xxxxxxxxxxxxxxxxxxxxx,
press-english-virus-announcement@xxxxxxxxxxxxxxxxxxxxx
From: Marita Nasman-Repo <Marita.Nasman-Repo@xxxxxxxxxxxxxxx>
Subject: MEDIA RELEASE:Data Fellows discovers the first virus to infect
MS Project
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
This press release comes from Data Fellows. For more
information on Data Fellows' mailing list policy,
see end of message.
Press release
For immediate release
Data Fellows discovers the first virus to infect MS Project
Almost all popular Microsoft applications can now be carriers of viruses
Espoo, Finland, October 26, 1999. - Data Fellows, one of the world’s leading
developers of anti-virus and encryption software, announced today the discovery
of a new computer virus. P98M/Corner is the first macro virus to infect the
Microsoft Project application. This virus is capable of infecting both Project
and Word and can travel between them.
"This virus sample arrived to us in an anonymous e-mail sent through a remailer
service", explains Mr. Mikko Hypponen, Manager of Anti-Virus Research at Data
Fellows Corporation. The Corner virus has not been seen in the wild yet.
With the discovery of the first MS Project macro virus, almost all popular
Microsoft applications are now suspectible to virus infections. Macro viruses
have been written for the following Microsoft applications:
- Microsoft Word 2.0
- Microsoft Word 95
- Microsoft Word 97
- Microsoft Word 2000
- Microsoft Excel 4.0
- Microsoft Excel 95
- Microsoft Excel 97
- Microsoft Excel 2000
- Microsoft PowerPoint 97
- Microsoft PowerPoint 2000
- Microsoft Access 97
- Microsoft Project 98
The Corner virus keeps on spreading from one user to another in infected Word
"DOC" and Project "MPP" files. In addition to spreading, the virus does not do
anything visible.
The virus code does contain these comments:
'I never realized the lengths I'd have to go
'All the darkest corners of a sense
'I didn't know
'Just for one moment
'hearing someone call
'Looked beyond the day in hand
'There's nothing there at all
'Project98/Word97-2k Closer
"Although the Corner virus does not do anything but replicate, it is still a
serious risk to users of Microsoft Project", comments Hypponen. "We're likely
to see several new viruses using similar techniques in the future."
TECHNICAL INFORMATION
When an infected document is opened in Microsoft Word 97 or 2000, Corner.A
checks if Microsoft Project is running. If it is, it gets infected.
The Word part of the virus is a simple class infector. It spreads when an
infected document is closed. At this time it sets the Office 2000 security
settings to low, disables the "Tools/Macros" menu and turns off the macro virus
protection. After that the virus replicates to all opened documents.
Corner is not able to infect Microsoft Word 2000, unless the user has first
changed the security settings to medium or low.
To infect Project, the virus adds a new blank project and inserts the virus
code into the "ThisProject" class module.
When an infected document is opened in Microsoft Project 98, Corner.A infects
the Word application, even if it is not running.
The MS Project part of the virus is not resident, and it does not infect the
global project. The virus replicates during the project deactivation (after an
infected project has been opened).
The virus infects a Word application by opening it and inserting the virus code
in the global template's class module "ThisDocument". This process is hidden
from the user and the user can't see the infection of Word.
Further technical information is available on our web site
http://www.DataFellows.com/v-descs/corner.htm
An screenshot of the virus is available at:
http://www.DataFellows.com/virus-info/v-pics/
About Data Fellows
Data Fellows is a leading developer of centrally managed, widely distributed
security solutions. The company offers a full range of award-winning,
integrated anti-virus, file encryption and VPN solutions for workstations,
servers and gateways. F-Secure products and Framework are uniquely suited for
delivery of Security as a Service™ by enterprise IT departments as well as a
wide range of partners including ISPs, outsourcing firms and ASPs. For the
end-user, Security as a Service is invisible, automatic, reliable, always-on,
and up-to-date. For the administrator, Security as a Service means policy-based
management, instant alerts, and centralized management of a
massively-distributed user base.
A privately owned company, Data Fellows offers a worldwide network of
distribution, technical support and training in over 80 countries.
For more information, contact
Data Fellows, 675 North First Street, 8th floor,
San Jose, CA 95112;
tel 408-938-6700; fax 408-938-6701;
info@xxxxxxxxxxxxxxx
or visit our web site at http://www.DataFellows.com/
Mailing list policy
You have previously expressed interest in our products, or have asked
to be included on one of our press release lists by personally giving us
your e-mail address for this purpose.Our mailing list are for the
exclusive use and the expressed purpose of Data Fellows and are not
sold or or given to third parties.
If you no longer wish to receive our press releases, or your email address
has been added to our lists without your consent, you can unsubscribe at
http://www.DataFellows.com/news/subscribe.html
If you only wish to receive our press releases concerning viruses,
please go to
http://www.DataFellows.com/news/subscribe.html
and first unsubscribe from
press-english-interest@xxxxxxxxxxxxxxxxxxxxx
and then subscribe to
press-english-virus-announcement@xxxxxxxxxxxxxxxxxxxxx
________________________________________________
Marita Nasman-Repo tel: +358 9 8599 0613
Communicator fax : +358 9 8599 0599
mobile: +358 40 517 4613
Data Fellows Corporation http://www.DataFellows.com
F-Secure products: Integrated Solutions for Enterprise Security
_________________________________________________
|