Revolutionary Multi-Platform Virus Attacks Word 6 Users World-Wide from S&S International, Inc. BURLINGTON, MASS., Aug 23, 1995 -- S&S Software International Inc. A brand new virus has been released into the wild capable of infecting all Microsoft Word 6 users (including those running Word under Windows 95). It is the world's first virus to infect data files by installing macros. S&S International PLC, developers of Dr. Solomon's Anti-Virus Toolkit, have analyzed the revolutionary new virus which uses innovative techniques to spread. It is known to be in the wild in the USA, United Kingdom, and Finland, infecting Microsoft Word documents - even travelling via email. The virus, which has been named by experts as WinWord.Concept, is also known as WW6Macro, and Microsoft call it Prank Macro, has a number of revolutionary new features. WinWord.Concept is the first virus ever seen to infect documents rather than executable code. WinWord.Concept is the first ever multi-platform vtrus capable of infecting Windows 95, Windows NT, and Apple Macintosh computers, as well as Windows 3.x running Microsoft Word 6. WinWord.Concept virus could potentially spread much faster than traditional viruses, as users share documents more often than programs. Additionally, some users have already unwittingly received this virus via email. WinWord.Concept opens the door for a whole new breed of macro based viruses capable of infecting data files, which had previously been relatively safe. Winword.Concept makes use of the well-developed WinWord macro language, WordBasic, to infect Word 6 documents (*.DOC) and the NORMAL.DOT global template. When an infected Word document is opened under Microsoft Word for the first time, the virus takes control as an AutoOpen macro and infects the NORMAL.DOT template (or any other template designated as the global default template). A message box appears on the screen at this time (but not subsequently) displaying the number "1". Every subsequent document saved using the File/Save As menu option is infected with the WinWord.Concept virus. If another user opens this Word file they will also be infected by the virus - and every subsequent document they create will also be infected. Because of this, the WinWord.Concept virus has a good chance of becoming widespread - people exchange documents far more often than executable programs. Alan Solomon, Chairman of S&S International, said, "There has been considerable discussion in the past about the possibility of a virus written in a macro language. The nightmare is now a reality". Users of Dr. Solomon's Anti-Virus Toolkit can download detection for this new virus from their BBS (617 229-8804), E-mail or CompuServe (GO DRSOLOMON). Other users can detect the virus via Microsoft Word itself. Users are advised to select Tools/Macros and check the list of macros available. If there are macros named AAAZFS, AAAZAO, AutoOpen, Payload, and FileSaveAs, then the document is infected. Dr. Solomon's team of experts has prepared a paper describing how to remove the virus to anyone who finds they are infected. This can be obtained by calling S&S International Software at (617) 273-7400, and asking for technical support. For further information please call David Emm at (617) 273-7400. Info from Dr. Solomon's On-Line WinWord.Concept is a revolutionary new virus. It is the world's first multi-platform virus - spreading under Windows, Windows 95, Windows NT and is the world's first virus to successfully infect data rather thanexecutables - infecting Microsoft Word documents. The good news is that the WinWord.Concept virus carries no destructive payload - all it does is spread. Unfortunately it could easily be altered to do something more damaging. The virus is also known as WW6Macro and Prank Macro. So far, we at Dr Solomon's have received reports of this virus from UK, USA, France, Germany, Finland, Russia, Sweden, Canada, and Turkey. The virus infects Microsoft Word documents by use of Word macros, one of which is automatically invoked when Word loads a document. Fortunately there is an obvious sign of this virus. When an infected document is loaded into Word a dialog box appears containing a '1'. Note: This only applies to WinWord.Concept - it cannot be relied upon to indicate the presence of any other macro virus. Another way to detect if the virus is present is to check the macros installed in your MS Word Normal template. To do this choose Tools|Macro. If you see the following macros: AAAZAO, AAAZFS, AutoOpen, PayLoad and FileSaveAs, then you probably have WinWord.Concept. Please note: You have to have all of these macros, not just one or two. Dr Solomon's have provided a way of detecting this virus, even if you're not running Word (ie. you can scan network drives, new floppy diskettes, and compressed files without risk of infection). One way of protecting yourself against the virus is to write a simple Autoexec macro. Under Tools|Macros create a macro called AutoExec that looks like this: Sub MAIN DisableAutoMacros MsgBox("Turning all AutoMacros off.", "Protection installed", 64) End Sub