Users of Microsoft Word susceptible to new virus

A NEW KIND of computer virus has descended upon the world. How easy is it to create one? Fifteen minutes after opening a Microsoft Word reference manual, I had cranked out a one-line program that could eliminate crucial system files from a hard drive. After an hour I had adapted the program to run automatically whenever anyone opened a file called HELPFUL.DOC.

By bedtime I had figured out how to get this file to transmogrify Word itself so that it would embed my trick program in any document it opened. In an evening, I had created a virus of my very own. This is scary stuff. Lacking the skill and knowledge to create a classic computer virus, I managed to put together this new kind with relative ease. Scarier still is that if I can do it, millions of others can too.


Worse, to wreak its havoc, this type of virus requires only that its recipient open an innocent-looking document. Conventional wisdom in the networked world had suggested that one could elude viruses by shunning program files of unknown provenance. No longer.

The realm of computer viruses has suddenly grown larger, though all that has really changed is the advent of a pointedly devilish example from points unknown. The Microsoft Corp. prefers to call it a "prank macro"; others have dubbed it the "Word concept virus." Macros are simple commands that do complicated things. A rudimentary macro, for example, might record the word "Festschrift" as you typed it and then play it back every time you pressed Alt-F.


But modern macros are full-blown programs that do everything from creating standard forms to changing the way menus work. Workers often use macros without knowing it. Languages for writing macros in today's applications offer so much power that programmers can do almost anything with them.

So, too, can saboteurs. Although these languages have been around for years, the prank virus stunningly reveals their

tremendous potential for trouble. Fortunately the prank itself is mostly harmless. Use Microsoft Word to open a document containing it, and the virus infects Word so that it saves files only in so-called template form.

That matters hardly at all, except that every time someone else loads one of those templates, it will infect that copy of Word so that it can infect other files. That no data are truly harmed suggests kindness on the part of the unknown author, who includes the phrase "That's enough to prove my point" in the body of the virus.

Since discovering the problem, the Microsoft Corp. has spread the word about it. The company also inadvertently spread the virus via an infected file called OEMLTR.DOC on a CD-ROM called the "Windows System Compatibility Test," which most users are unlikely to encounter.

But Microsoft spokesmen say no copies of Word itself have been sold with the virus code.

The macro can infect Word 95 and Word 6 documents. Unlike classic viruses, which are highly specific to a particular type of machine and operating system, this kind can work wherever you run Microsoft Word, including PCs using Windows 3.1, 95 and NT, as well as Macintoshes.

To check for it, pull down Word's Tools menu and click Macros. If items called AAZAAO and AAAZFS appear in the list box, your copy of Word and at least one of your documents are infected.


Stephen Manes and Peter H. Lewis alternate writing this column, which appears every Monday.