Computer experts fear potential of new virus

CHARLES ARTHUR

Technology Correspondent

Computer experts are expressing alarm about a new and potentially dangerous computer virus that conceals itself in word processing files and can run on many different types of computer.

The virus, known as "Prank", exploits Microsoft's market dominance by attaching itself to files written with the company's word processing program - called Word - which is installed on millions of machines worldwide. This means that rather than being restricted to particular varieties of personal computer, the virus can be spread among any computer that runs version 6.0 or later of Word.

"We first noticed it a few weeks ago, and there has been an increasing amount of talk about it," says Richard Jacobs, technical manager of Sophos, based in Abingdon, which writes anti-virus software. "Normal anti-virus software won't detect it." Infections have been reported in the UK, US and Finland.

Prank hides itself in a "macro" attached to a Word document. A macro is a mini-program created by the computer user to automate a common function. But in the newer versions of Word, the macro can be attached to the document, which is then sent as a single file to another user. When the user opens the document using Word - running under Windows 95, Windows 3.1 or an Apple Macintosh - the virus macro copies itself into the standard template of the user's machine, infecting all subsequent documents. It can also be spread by electronic mail.

Users can recognise the virus when they first open an infected document. A message box appears on the screen showing the number 1. Each subsequent document saved within the program will be infected.

Prank's ability to run on different machines makes it much more "evolved" than previous viruses, which relied on a specific operation of an operating system to do their work. Previously, a virus written for an IBM PC could not infect an Apple Macintosh, or vice-versa.

"We knew it was possible for a long time. It has no 'payload' as such, it's just designed to spread itself," says Alan Solomon, head of S&S International in Aylesbury, which also specialises in anti-virus software. "But it would be easy for somebody to copy this and turn it into something nastier." Mr Jacobs adds: "It would be trivial to remove the sign that it is there and replace it with something destructive."

The existence of Prank indicates the strong grip Microsoft has on the word processing market. Previously, experts believed it would be possible to write such a macro for Lotus 1-2-3, which was widely popular on PCs in the late 1980s.

Microsoft is aware of the problem and has written software "patches" that remove the virus. These are available for free from its World Wide Web site on the Internet [at http://www.microsoft.com]. The company refused to comment on rumours that it had written the patches because it accidentally sent out infected documents on a CD-ROM.

Officially, the company says: "It's more a minor annoyance than anything that can harm your work." But Mr Jacobs reckons that the chance of a vicious strain of the virus being written is "increasing in likelihood - the more people talk about it, the more likely it is."