For immediate releaseEspoo, Finland, October 26, 1999. - Data Fellows, one of the worlds leading developers of anti-virus and encryption software, announced today the discovery of a new computer virus. P98M/Corner is the first macro virus to infect the Microsoft Project application. This virus is capable of infecting both Project and Word and can travel between them.
"This virus sample arrived to us in an anonymous e-mail sent through a remailer service", explains Mr. Mikko Hypponen, Manager of Anti-Virus Research at Data Fellows Corporation. The Corner virus has not been seen in the wild yet.
With the discovery of the first MS Project macro virus, almost all popular Microsoft applications are now suspectible to virus infections. Macro viruses have been written for the following Microsoft applications:
The Corner virus keeps on spreading from one user to another in infected Word "DOC" and Project "MPP" files. In addition to spreading, the virus does not do anything visible.
The virus code does contain these comments:
'I never realized the lengths I'd have to go
'All the darkest corners of a sense
'I didn't know
'Just for one moment
'hearing someone call
'Looked beyond the day in hand
'There's nothing there at all
'Project98/Word97-2k Closer
"Although the Corner virus does not do anything but replicate, it is still a serious risk to
users of Microsoft Project", comments Hypponen. "We're likely to see several new viruses
using similar techniques in the future."
The Word part of the virus is a simple class infector. It spreads when an infected document is closed. At this time it sets the Office 2000 security settings to low, disables the "Tools/Macros" menu and turns off the macro virus protection. After that the virus replicates to all opened documents.
Corner is not able to infect Microsoft Word 2000, unless the user has first changed the security settings to medium or low.
To infect Project, the virus adds a new blank project and inserts the virus code into the "ThisProject" class module.
When an infected document is opened in Microsoft Project 98, Corner.A infects the Word application, even if it is not running.
The MS Project part of the virus is not resident, and it does not infect the global project. The virus replicates during the project deactivation (after an infected project has been opened).
The virus infects a Word application by opening it and inserting the virus code in the global template's class module "ThisDocument". This process is hidden from the user and the user can't see the infection of Word.
Further technical information is available on our web site: http://www.F-Secure.com/v-descs/corner.shtml
A screenshot of the virus is available at: http://www.f-secure.com/virus-info/v-pics/
A privately owned company, Data Fellows offers a worldwide network of distribution, technical support and training in over 80 countries.
For further information, please contact
Hong Kong:
Yui Kee Co. Ltd.
Mr. Allan Dyer, Technical Director
Tel: +852 28708555
Fax: +852 28736164
f-secure@yuikee.com.hk
or visit the Yui Kee web site at http://www.yuikee.com.hk/
USA:
Data Fellows, 675 North First Street, 8th floor,
San Jose, CA 95112;
tel 408-938-6700; fax 408-938-6701;
http://www.F-Secure.com/