New Word Virus Found

The Energy Department has found a new macro virus that infects Microsoft Word, and while the virus is relatively mild, most current antivirus tools can't yet detect it.

The virus, called W97M.Footprint, overwrites the footers--standard text that word processors can print at the bottom of each page to identify the source of the document--of all open documents, DOE's Computer Incident Advisory Capability group said this week.

If your computer is affected, the virus will delete an open document's existing footers as well as any macros attached to the document.

"The risk of damage is low, because most users do not have macros in files and would be alerted by Word's macro detector," CIAC said. In addition, fixing damaged footers is relatively easy, the group said.

Macro viruses use the "macro" programming languages that come with word processors and other software so users can automate tasks. However, the macro languages also opened up a new environment for viruses to spread. In addition, because some software runs the same on Microsoft Windows or Apple Macintosh systems, macro viruses sometimes can function on different types of computers.

CIAC recommended that until antivirus software can be updated to catch the new virus, people password-protect their "normal.dot" file, the file that stores default settings for Word documents.

The virus probably doesn't damage Macintosh Word files because the virus explicitly writes to the "C:" drive, the label used for hard disks only on Windows systems, CIAC said.

Until antivirus software catches up, a strong indicator that the virus' presence generally is likely if the files "footprint.$$$" and "footprint.$$1" are on the C: drive, CIAC said.

Related news stories
• Security tool switched with Trojan horse January 21, 1999
• Trojan horse steals AOL passwords, URLs January 7, 1999
• Debate rages over NT virus December 23, 1998

Copyright (C) 1998-1999 The Active Network. All rights reserved.
Please click here for full terms of use and restrictions.