Sophos Quick To Respond To New Virus Threat

March 27, 1998 Sophos Press Release

WOBURN, MA -- Sophos, the leading developer of network anti-virus software, today announced the appearance of the first virus to infect Microsoft Access Files.

The new virus, named AM97/Accessiv, operates through the macro language in Microsoft's Access 97 database product. As with Winword/Concept, the first Word virus, the new virus is not destructive, but simply looks for other Access databases to infect. This means that of the four main components of Microsoft's Office 97 suite, only PowerPoint remains free from virus attack.

Sophos quickly analyzed the virus and is the first company to make a fix to its standard product available. An IDE (virus signature) file is currently available on Sophos's website (http://www.sophos.com).

"While the appearance of any new virus type is interesting, we don't believe that users need to be unduly concerned about this new virus." said Richard Jacobs, President of Sophos, Inc. "Although it would be very easy to add a payload to this virus, the way in which Access is used means that this type of virus is very unlikely to propagate successfully. The new virus helps to remind people that viruses are not limited to Microsoft Word, any system with a sophisticated macro language is susceptible to virus attack."

The speed with which Word viruses have spread is due to the fact that users frequently exchange Word documents. This has been helped by the explosion in email and Internet use over the last few years, which have greatly increased the ease and speed with which documents can be transferred. Viruses rely on this exchange of infected objects between users to propagate, without it they stagnate.

Database files, such as Access, tend to be large files that sit on one system and often contain complex and confidential data. Whereas documents are easily sent to several people, databases stay in one place and people come to them (either physically or electronically). This means that Access files are rarely moved between systems, providing almost no opportunity for a virus to spread.