URGENT/INFORMATION/URGENT/INFORMATION/URGENT/INFORMATION/URGENT/

VIRUS ALERT

Revolutionary multi-platform virus attacks Word users
worldwide

A brand new virus has been released into the wild
capable of infecting all Microsoft Word 6 users
(including those running Word 6 under Windows 95).
It is the world's first virus to infect data files.

S&S International, developers of Dr Solomon's
Anti-Virus Toolkit, have analysed the revolutionary
new virus which uses innovative new techniques to
spread. The virus (which is known to be in the wild in
the USA, United Kingdom, Finland, France, Germany
and Canada) infects
Microsoft Word documents and can even be
transmitted via email.

The virus, which has been named WinWord.Concept
(also known as WW6Macro and Prank Macro virus)
by experts, has a number of revolutionary new
features.

* WinWord.Concept virus is the first virus ever seen
to infect
  documents rather than executable code.

* WinWord.Concept virus is the first ever
multi-platform virus
  capable of infecting Windows 95, Windows NT, and
Apple Macintosh
  computers, as well as Windows 3.x computers
running Microsoft Word 6.

* WinWord.Concept virus could potentially spread
much faster than
  traditional viruses, as users share documents more
often than
  programs. Additionally, some users have already
unwittingly received
  this virus via email.

* WinWord.Concept virus opens the door for a whole
new breed of
  macro-based viruses capable of infecting data files,
which had
  previously been considered safe.

WinWord.Concept makes use of the well-developed
WinWord macro language - Word Basic to infect
WinWord 6 documents (*.DOC) and the
NORMAL.DOT global template.

When an infected Word document is opened under
Microsoft Word for the first time, the virus takes
control as an AutoOpen macro and infects the
NORMAL.DOT template (or any other template
designated as the global default template).

A message box appears on the screen displaying the
number "1". Every subsequent document saved using
the File|Save As menu option is infected with
WinWord.Concept. If another user opens this Word
file they will also be infected by the virus - and every
subsequent document they create will also be
infected.

Because of this the WinWord.Concept virus has a
good chance of becoming widespread - people
exchange documents far more often than executable
programs.

Alan Solomon, Chairman of S&S International, said
"There has been considerable discussion in the past
about the possibility of a virus written in a macro
language. The nightmare is now a reality".

Dr Solomon's have stated that the samples they have
does not contain a destructive payload but the Macro
is capable of containing something.
Also reported on Compuserve is users finding
corruption in saved documents.

Users of Dr Solomon's Anti-Virus Toolkit can
download detection for this new virus from our FTP
site. File name WW6MACRO.ZIP


-------------------------------------------------------------------------

PC users will find the file WVFIX.ZIP & MAC users will
find the file
WVFIX.SIT.HQX useful as they contain a readme file
plus WVFIX.DOC.
This document contains a macro that will identify and
remove the
Winword.concept macro virus from your global
document template. It also has information for F-Prot
users on updating there software to detect the virus.

This document contains complete instructions on
how the macro works as well as customization
options.


------------------------------------------------------------------------

Other users can detect the virus via Microsoft Word
itself. Users are advised to select Tools|Macros and
check the list of macros available.
If there are macros named AAAZFS, AAAZAO,
AutoOpen, Payload, and
FileSaveAs, then a WinWord.Concept infection is
present.

------------------------------------------------------------------------

Dr Solomon's technical support team have prepared
a paper describing how to remove the virus to anyone
who finds they are infected and is listed below.

Unfortunately, there is no easy way to remove the
virus from documents.

If hit, you can try loading ALL your WinWord
documents one by one and deleting macros AAAZFS,
AAAZAO, AutoOpen, PayLoad and FileSaveAs, if
present in the document, by using
Tools/Macros/Organiser Having cleaned up all the
*.DOC files, use Tools/Macros/Organiser to remove
the macros from the global templates. After that,
although disactivated, the virus body (macros) will still
be present in the document files and detected by
FindVirus.

To avoid this, use File/SaveAs any format BUT
WinWord 6. Then delete source .DOC file and open
newly saved document. It will be converted to
WinWord format automatically. Now you can save it
as a WinWord document.



------------------------------------------------------------------------
 Written and updated 24/8/95 by Dave Phillips

 


Dave

/=========================\~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~l
|Dave Brokenshaw          |  *"Is there anybody out
there"            l
|University Of Wales      |      *            ^___^                  
l
|College of Medicine      |_______________mm_(_o
o_)_mm_______________l
|Heath Park, Cardiff, UK.
|___l___l___l___l___l___l___l___l___l___l___l
|Tel  (0) 1222 744656    
|_l___l___l___l___l___l___l___l___l___l___l_l
|Fax  (0) 1222 743664    
|___l___l___l___l___l___l___l___l___l___l___l
|brokenshaw@cardiff.ac.uk | The opinions blah blah
blah ... ... ... ..l
\=====================================================================l
                       | http://www.uwcm.ac.uk/ |
                        \----------------------/
                                      
                         E-MAIL COMMUNICATIONS ARE
BEST
                         
                            
