27 Oct 1999
First MS Project macro virus discovered
Sophos researchers have announced the discovery of the first
virus capable of infecting Microsoft Project 98 files.
OF97/Closer (aka P98M/Corner) is capable of cross-infecting both
Word documents and MS Project 98 files.
It is important to stress that Sophos have had no reports of
this virus in the wild, and it is not considered to be a threat at
this time. It is purely of interest because it is the first virus
to infect Microsoft Project 98 files. Projects created by earlier
versions of Microsoft Project cannot be infected by this virus.
Project files are not typically distributed as freely and
regularly as Word documents.
The MS Word part of the virus is an unexceptional class
infector. It's only point of interest is that if MS Project 98 is
running the virus will insert its code into the current open
Project file.
If the infected Project file is opened on an uninfected machine
the virus will infect all currently open Projects and also
cross-infect Microsoft Word.
The virus code includes the following text (which is never
displayed):
I never realised the lengths I'd have gone
All the darkest corners of a sense
I didn't know
Just for one moment
hearing someone call
Looked beyond the day in hand
There's nothing here at all
Project98/Word97-2k Closer
About Sophos
More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing security and data protection solutions that are simple to manage, deploy and use and that deliver the industry's lowest total cost of ownership. Sophos offers award-winning encryption, endpoint security, web, email, and network access control solutions backed by SophosLabs - a global network of threat intelligence centers. With more than two decades of experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has received many industry awards.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.