Anti-Virus: Trend Micro Discovers First Virus to Target Microsoft Office 2000; Online Scanning Service, HouseCall, Allows Users to Protect Their Systems - Company Business and Marketing

Edge: Work-Group Computing Report, Jan 25, 1999

Trend Micro Inc., the leader in centrally managed virus protection and content filtering products and services, Thursday announced the discovery of the first virus to target Microsoft's yet to be released Office 2000 application. "W2KM_PSD" can infect both Word 2000 and Word 97 documents. While this virus has not yet been spotted at any customer sites, Trend Micro has updated its free online scanning service, HouseCall at http://housecall.antivirus.com so concerned users of Word 97 and Word 2000 (Beta2) can reassure themselves that the virus is not in their system.

According to Trend Micro experts who analyzed and developed detection for this latest virus, "W2KM_PSD" is very similar to one of the more popular macro viruses currently infecting Word 97 documents, "W97M_PSD", with alterations made to take advantage of some of the capabilities in Word 2000. New security features added to Microsoft Office 2000 should help prevent transmission of this new virus in that environment, so users should not be overly concerned. Office is Microsoft's suite of software applications including Word, PowerPoint, Access or Excel. "Trend Micro's Antivirus Research Group and Engineering Team (TARGET) provides Trend customers with round-the-clock virus research and analysis," said Eva Chen, chief technology officer for Trend Micro. "By finding viruses first, providing updated protection quickly, and educating our customers early, Trend Micro provides customers with a proactive defense against virus outbreaks before they have a chance to infect, do damage and reduce productivity." About "W2KM_PSD" Users can trigger the "W2KM_PSD" virus and infect their system by opening an infected Word 97 or Word 2000 document. When infecting Word 2000 documents, the virus will turn Microsoft Office's "Security Level" to "low" by modifying the Windows Registry. In addition, when the day of the month is the same as the current minute, the virus will fill an active Word document with a randomly determined number of shapes of various colors. The virus can run under Microsoft Word 97 but will not be able to change the security setting or change the display of an active document. The virus does not damage or change data, but may make it quite difficult to view an infected document's contents on screen. About Microsoft Office 2000 Security New security features in Microsoft Office 2000 should make the transmission of this virus more difficult since Microsoft Office installs with the highest security level setting as its default. Users who do not change their security settings should not be at risk. The highest setting allows only "signed" macros from trusted partners to run. "Signing" a macro allows its originator to indicate who has created the macro, and a list of trusted sources is included with Office 2000. It also means that if the macro code is changed, the signature will be removed and the macro code will not be permitted to run under the highest security level setting. In addition, Word 2000 does not give end-users the ability to "enable" un-signed macros when the security level is set at "high." How to Reduce Risk of Infection Trend Micro cautions users to keep their security settings at "high," be wary of opening e-mail attachments from unknown senders, and back up their systems frequently to prevent data loss. As a precaution, Trend Micro has updated its free HouseCall online virus-scanning service to detect and remove the "W2KM_PSD" macro virus. With HouseCall, concerned users can reassure themselves that the virus is not in their system. In addition, Trend customers will be able to update their Trend Micro virus protection software at the end of January at http://www.antivirus.com/download/pattern.htm and can use HouseCall in the mean time to determine if their system is infected. More information about "W2KM_PSD" can be obtained from Trend's web site at http://www.antivirus.com. Trend Micro provides centrally controlled server-based virus protection and content-filtering products and services. By protecting information that flows through file servers, e-mail servers and Internet gateways, Trend Micro allows companies worldwide to stop viruses and other malicious code from a central point before they ever reach the desktop. Trend Micro's award-winning products have been chosen by Check Point, Hewlett-Packard, IBM, Lotus Softswitch, Microsoft, Netscape, Oracle, Sun Microsystems, Wingra and WorldTalk as a key part of their server security solutions. Trend Micro is publicly held in Japan with North American headquarters in Cupertino, Calif., and offices worldwide. Evaluation copies of all of Trend Micro's products may be downloaded from its award-winning site, http://www.antivirus.com. Web site visitors may also test-drive products online through Trend Micro's Virtual Lab. Recent Trend Micro awards: