Footprint Macro Virus

PROBLEM:	A new word 97 macro virus has been detected at a DOE site and is known to have been in documents sent to other sites. It is not yet detected by most antivirus tools.
PLATFORM:	Windows 95, or Windows NT running Microsoft Word 97 (version 8). Word 98 on the Macintosh is probably not susceptible as the virus explicitly writes to the C: hard drive which does not exist on the Macintosh.
DAMAGE:	Overwrites the footers on all open documents. It also overwrites all macros in open documents and open and attached templates with the macro virus code.
SOLUTION:	Use an updated antivirus product when one is available. Until then, password the normal.dot file, turn on macro virus detection in Word, and take care when opening files containing macros.
VULNERABILITY ASSESSMENT:	Risk of infection is high because this virus has been seen in the wild within the DOE complex. The risk of damage is low, because most users do not have macros in files and would be alerted by Word's macro detector. Also fixing damaged footers in Word documents is a relatively easy task.

The W97M.Footprint Word macro virus has been seen within the DOE complex.
This macro virus attaches to Word objects in Word 97 in much the same way as W97M.Class. Because of this method of infection, this virus will not infect older versions of Microsoft Word. When an infected document is opened, the virus writes the body of the virus code into two files:

C:\footprint.$$$
C:\footprint.$$1

The virus then tests the currently open documents for a custom property:

Property Name		Value
FootNote1		True

If the property exists, the virus knows the file has already been infected. If the property does not exist, the virus creates the custom property, overwrites the document footer with the document path, deletes any existing macros attached as Word objects, and copies the virus macro into the file. The virus then deletes all the macros attached as Word objects in all attached document templates and copies itself into the templates as well.

Detecting The Virus

If you open a document and the Word macro virus protection detects a macro in the document being opened, disable the macro and then use the File, Properties command to see the document properties. Check the Custom tab and if a custom property named: FootNote1 exists the document has been infected.

We expect that most antivirus scanners will be updated to detect this virus in the near future.

Protecting A System

Password Protecting The Normal.dot File

1. Start Word.
2. Choose the Tools, Macro, Visual Basic Editor command.
3. In the Project window of the Visual Basic Editor, click on Normal.
4. Choose the Tools, Normal Properties command, Protection tab.
5. Check the Lock Project for Viewing check box and type in a password twice.
6. Close the dialog box, close the Visual Basic editor.
7. Quit Word.

WARNING: If you ever have to type in the password to make changes to the normal.dot file be aware that the file remains unprotected until you quit Word and restart it.

Turning On Macro Virus Protection

To turn on macro virus protection, perform these steps:

1. Start Word.
2. Choose the Tools, Options command, General tab.
3. Check the Macro Virus Protection check box.
4. Close the dialog box.

Manual Cleaning of a System

To clean a copy of Microsoft Word that has been infected with a macro virus, perform these steps:

1. Start Word.
2. Choose the Tools, Templates and Add-Ins command.
3. Make a note of all templates that load at startup (normal.dot plus those checked in the dialog box.)
4. Quit Word.
5. Find the normal.dot file that Word loads at startup and delete it. It is normally in /Program Files/Microsoft Office/Templates.
6. Delete any other templates that you noted in step 3.
7. Start Word then quit Word to create a new normal.dot file.
8. Password protect normal.dot as indicated above.
9. Delete the files: C:\footprint.$$$ and C:\footprint.$$1.

1. Make sure the Normal.dot template is locked.
2. Make sure macro virus protection is turned on.
3. Open the file and disable the macros with the macro virus protection dialog box.
4. Choose the File, Properties command, Custom tab.
5. Select the FootNote1 property and press the delete button.
6. Close the File properties dialog box.
7. Save the document with a new name as a Word6/95 document. If you save it as a Word 97 document, the virus will be deleted, but the macro detector will still alert every time the document is opened.
8. Open the document again and save it as a word 97 document if you want to change it back to the current format.

This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes.