First MS Project macro virus discovered

Sophos Press Release

Sophos researchers have announced the discovery of the first virus capable of infecting Microsoft Project 98 files.

OF97/Closer (aka P98M/Corner) is capable of cross-infecting both Word documents and MS Project 98 files.

It is important to stress that Sophos have had no reports of this virus in the wild, and it is not considered to be a threat at this time. It is purely of interest because it is the first virus to infect Microsoft Project 98 files. Projects created by earlier versions of Microsoft Project cannot be infected by this virus.

Project files are not typically distributed as freely and regularly as Word documents.

The MS Word part of the virus is an unexceptional class infector. It's only point of interest is that if MS Project 98 is running the virus will insert its code into the current open Project file.

If the infected Project file is opened on an uninfected machine the virus will infect all currently open Projects and also cross-infect Microsoft Word.

The virus code includes the following text (which is never displayed):

I never realised the lengths I'd have gone
All the darkest corners of a sense
I didn't know
Just for one moment
hearing someone call
Looked beyond the day in hand
There's nothing here at all
Project98/Word97-2k Closer

More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs - a global network of threat intelligence centers. Sophos is headquartered in Oxford, U.K., and is publicly traded on the London Stock Exchange under the symbol “SOPH.” More information is available at www.sophos.com/company.