First MS Project Virus Found

First MS Project Virus Found

October 26, 1999: 10:20 a.m. ET

ESPOO, FINLAND (NB) -- By Sylvia Dennis, Newsbytes. Data Fellows has warned its anti-virus software users of an insidious new virus that affects Microsoft [NASDAQ:MSFT] Project application users.
The P98M/Corner virus is notable for being the first virus to affect MS Project. The virus also "completes the loop" as far as Microsoft applications software products are concerned - Data Fellows said practically all popular Microsoft applications can now be carriers of viruses.
P98M/Corner can also infect MS Word and, as a macro virus, can move freely between Word and Project. The firm said that the Corner virus keeps on spreading from one user to another in infected Word DOC and Project MPP files. In addition to spreading, the virus does not do anything visible.
Mikko Hypponen, Data Fellows' anti-virus manager, said that the virus code contains the following rhyme:
I never realized the lengths I'd have to go All the darkest corners of a sense I didn't know Just for one moment Hearing someone call Looked beyond the day in hand There's nothing there at all Project98/Word97-2k Closer
Hypponen said the virus is still a serious risk to users of Microsoft Project, even though it does not do anything but replicate. "We're likely to see several new viruses using similar techniques in the future," he said.
Data Fellows said Corner.A checks if Microsoft Project is running when when an infected document is opened in Microsoft Word 97 or Word 2000. If Project is running, it gets infected.
The Word part of the virus, the firm said, is a simple class infector. It spreads when an infected document is closed. At this time it sets the Office 2000 security settings to low, disables the "Tools/Macros" menu and turns off the macro virus protection. After that the virus replicates to all opened documents.
The company said that Corner is not able to infect Microsoft Word 2000, unless the user has first changed the security settings to medium or low. To infect Project, the virus adds a new blank project and inserts the virus code into the "This Project" class module.
When an infected document is opened in Microsoft Project 98, Corner.A infects the Word application, even if it is not running.
The MS Project part of the virus is not resident, and it does not infect the global project. The virus replicates during the project deactivation (after an infected project has been opened).
Technical details of the virus can be found on the firm's Web site at http://www.datafellows.com/v-descs/corner.htm .
Data Fellows said that macro viruses have now been discovered for the following Microsoft applications: Word 2.0, Word 95, Word 97, Word 2000, Excel 4.0, Excel 95, Excel 97, Excel 2000, PowerPoint 97, PowerPoint 2000, Access 97 and Project 98
Reported by Newsbytes.com, http://www.newsbytes.com .
06:27 CST Reposted 09:14 CST
(19991026/Press Contact: Marita Nasman-Repo, Data Fellows +358-9-8599- 0613/WIRES PC, BUSINESS, ONLINE/MSVIRUS/PHOTO)

Back to the Goodies Page!