Data Fellows discovers the first virus to infect MS Project

First published: 26^th October 1999

Almost all popular Microsoft applications can now be carriers of viruses

Espoo, Finland, October 26, 1999. - Data Fellows, one of the worlds leading developers of anti-virus and encryption software, announced today the discovery of a new computer virus. P98M/Corner is the first macro virus to infect the Microsoft Project application. This virus is capable of infecting both Project and Word and can travel between them.

"This virus sample arrived to us in an anonymous e-mail sent through a remailer service", explains Mr. Mikko Hypponen, Manager of Anti-Virus Research at Data Fellows Corporation. The Corner virus has not been seen in the wild yet.

With the discovery of the first MS Project macro virus, almost all popular Microsoft applications are now suspectible to virus infections. Macro viruses have been written for the following Microsoft applications:

• Microsoft Word 2.0
• Microsoft Word 95
• Microsoft Word 97
• Microsoft Word 2000
• Microsoft Excel 4.0
• Microsoft Excel 95
• Microsoft Excel 97
• Microsoft Excel 2000
• Microsoft PowerPoint 97
• Microsoft PowerPoint 2000
• Microsoft Access 97
• Microsoft Project 98

The Corner virus keeps on spreading from one user to another in infected Word "DOC" and Project "MPP" files. In addition to spreading, the virus does not do anything visible.

The virus code does contain these comments:

        'I never realized the lengths I'd have to go
        'All the darkest corners of a sense
        'I didn't know
        'Just for one moment
        'hearing someone call
        'Looked beyond the day in hand
        'There's nothing there at all
        'Project98/Word97-2k Closer

"Although the Corner virus does not do anything but replicate, it is still a serious risk to users of Microsoft Project", comments Hypponen. "We're likely to see several new viruses using similar techniques in the future."

TECHNICAL INFORMATION

When an infected document is opened in Microsoft Word 97 or 2000, Corner.A checks if Microsoft Project is running. If it is, it gets infected.

The Word part of the virus is a simple class infector. It spreads when an infected document is closed. At this time it sets the Office 2000 security settings to low, disables the "Tools/Macros" menu and turns off the macro virus protection. After that the virus replicates to all opened documents.

Corner is not able to infect Microsoft Word 2000, unless the user has first changed the security settings to medium or low.

To infect Project, the virus adds a new blank project and inserts the virus code into the "ThisProject" class module.

When an infected document is opened in Microsoft Project 98, Corner.A infects the Word application, even if it is not running.

The MS Project part of the virus is not resident, and it does not infect the global project. The virus replicates during the project deactivation (after an infected project has been opened).

The virus infects a Word application by opening it and inserting the virus code in the global template's class module "ThisDocument". This process is hidden from the user and the user can't see the infection of Word.