New computer virus infects WinWord 6 users

S&S releases fix for world's first macro virus

BURLINGTON, MASS., Aug. 30, 1995 -- A new computer virus is capable of
infecting all users of Microsoft Word for Windows version 6, including
users running Word under Windows 95.

"WinWord.Concept" is spreading worldwide, with users already infected in
the United States, United Kingdom, Finland, Germany, France, Canada,
Turkey and Holland.

The new virus uses innovative techniques to spread, according to the
industry-leading anti-virus research team at S&S Software International
Inc., maker of DR SOLOMON'S ANTI-VIRUS TOOLKIT.

WinWord.Concept:

* Is the world's first virus to infect data files by installing
  macros.
* Infects documents instead of executable code.
* Travels via electronic mail.
* Is the first ever multi-platform virus capable of infecting
  Windows 3.1, Windows 3.11, Windows 95, Windows NT, and Apple
  Macintosh computers.
* Opens the door to a whole new breed of macro-based viruses capable
  of infecting data files, which had previously been considered
  relatively safe.

WinWord.Concept is also known as "WW6Macro," and Microsoft
calls it "Prank Macro."

As users share documents more often than programs, the antivirus research
team at S&S cautions that the virus could potentially spread faster than
conventional viruses.

"There has been considerable discussion in the past about the possibility
of a virus written in a macro language. Now it's happened," said Dr. Alan
Solomon, chairman and founder of S&S, and leader of the company's
anti-virus research team.

This "hit squad" detects 150-200 new viruses a month. It provides
24-to-48-hour virus identification and, when possible, repair.

WinWord.Concept makes use of WordBasic, the well-developed WinWord macro
language, to infect Word 6 documents (*.DOC) and the NORMAL.DOT global
template -- or any other template designated by the user as the global
default template.

Macro triggers

When a user opens an infected document for the first time, the virus takes
control as an AutoOpen macro and infects the global template.

A message box appears on the screen at this time -- but not subsequently --
displaying the number "1." Every subsequent document saved using the File
- SaveAs menu option is infected with the virus.

If another user opens this Word file, that second user will also be
infected by the virus -- and every new document created by that second
user will also be infected.

Detection, fixes

Users of Dr. Solomon's Anti-Virus Toolkit may download detection for this
new virus from the S&S BBS at 617-229-8804; via the Internet at
support@us.sands.com, or via CompuServe at GO DRSOLOMON.

The research team has also prepared a white paper describing how to remove
the virus. The white paper is available to any user that calls technical
support at S&S at 617-273-7400.

Users may detect the virus via Microsoft Word itself. Select Tools/Macros
and check the list of macros available. If the macros AAAZFS, AAAZAO,
AutoOpen, Payload and FileSaveAs are all present, then WinWord 6 is
infected.

About S&S

"DR. SOLOMON'S ANTI-VIRUS TOOLKIT is the leading European anti-virus
software, with nearly 3 million users worldwide.

The TOOLKIT detects and kills more than 6,700 computer viruses, including
the most complex encrypted and polymorphic viruses.

S&S introduced new versions of the TOOLKIT for DOS, Windows, OS/2 and
NetWare in late August. The company also plans Fall 1995 introductions of
TOOLKITS for Macintosh, SCO UNIX, Windows 95, Windows NT Server and
Windows NT Workstation.

S&S Software opened offices in April near Boston and Los Angeles to sell
and support its anti-virus and security software in the U.S. The company
is a subsidiary of S&S International PLC, based in the United Kingdom.

Founded in 1984, S&S specializes in security and networking products for
IBM-compatible systems. It is one of the fastest-growing independent
companies in the UK, ranked fifth by Price Waterhouse for 1995, and is one
of the 50 largest software companies in Europe.

The TOOLKIT is the winner of multiple awards, including the prestigious
"Queen's Award for Technological Achievement." It is also the winner of
exhaustive comparative reviews conducted by Virus Bulletin and Secure
Computing.

S&S Software International Inc
17 New England Executive Park
Burlington, MA 01803
617-273-7400,  fax 617-273-7474
CompuServe: Go Drsolomon
Internet: Support@us.sands.com
Tech support: 800-595-9175
 
 =========================================================
 From the 'New Product News' Electronic News Service on...
 AOL (Keyword = New Products) and Delphi (GO COMP PROD)
 =========================================================
 This information was processed from data provided by the
 company/author mentioned. For additional details, please
 contact them directly at the address/phone# indicated.
 Trademarks are the property of their respective owners.
 =========================================================
 All submissions for this service should be addressed to:
 BAKER ENTERPRISES,  20 Ferro Dr,  Sewell, NJ  08080  USA
 Email: rbakerpc@delphi.com  -or- RBakerPC (on AOL/Delphi)
 =========================================================
