ExcelMacro Virus: ExcelMacro.Laroux; NCSA Commentary.

CARLISLE, Penn.--(BUSINESS WIRE)--July 26, 1996--Recently, several reports have surfaced about a new virus which is capable of infecting Microsoft Excel Spreadsheets.

The National Computer Security Association which Certifies Anti-Virus products and manages the Anti-virus Product Developer's Consortia (eighteen member-companies of the four year old consortia include all significant developers and publishers of Anti-Virus software products). NCSA has analyzed information from many sources about this virus and currently believes the following to be true:

-- A macro virus which infects Microsoft Excel Spreadsheets, versions 5 and 6 operating on Windows 3.x, NT and '95 platforms, does exist and is called the ExcelMacro.Laroux virus.

-- The virus behaves much like the now-common Word.macro virus Concept, which was first discovered in July, 1995. Like the Word.macro virus, ExcelMacro.Laroux can travel with e-mail attachments (if Excel Spreadsheets are attached to e-mail), over networks, or any other way that Excel Spreadsheets travel. Also like Concept, the Laroux virus does not intentionally cause damage to systems it infects. Though, like Concept, a small percentage of systems are likely to experience some system or application anomalies when the infection is present.

-- A version of ExcelMacro.Laroux which was intentionally crippled, so as to not be infectious has been circulated among anti-virus product developers and virus writers for the past several weeks.

-- It was analyzed by Sarah Gordon of Command Software. It was named by her, and a full analysis was written by her. A short analysis, which NCSA believes to be accurate can be found at Command's web site: (www.commandcom.com).

-- A non-crippled version of the virus is apparently "in the wild" -- that is, it has apparently infected more than one site world-wide. Two sites, possibly of the same company, are currently confirmed as having widespread infection by ExcelMacro.Laroux.

-- Microsoft contacted NCSA to solicit assistance and to offer assistance in any actions which might restrain the growth and damage of this virus. Microsoft claims to have first learned of the existence of this virus on Wednesday, July 24, and says it has had no customer reports of the virus to date. Both of these claims appear to be credible to NCSA analysts.

Currently, NCSA believes this virus is less worrisome than Winword.concept, is likely to grow more slowly and infect fewer systems than Winword.concept, and is likely to be easier to control than Winword.concept. However, this virus should be taken seriously, and protection measures should be instituted as they become available. There are several reasons for this belief:

-- Unlike the Winword.concept virus, there does not appear to have been any mass distribution of ExcelMacro.Laroux to date. The size of the initial "seed" or distribution of a virus significantly impacts its short-term growth in society.

-- Excel is not installed or used on nearly as many PCs as Microsoft Word. The increased "space" between infectible entities should slow the growth somewhat.

-- Spreadsheets are probably less-often shared between organizations than Word documents. This makes replication and infection within an organization possibly quite rapid (as with Word documents), but slows the likely rate of infection between organizations.

-- Most anti-virus companies will rapidly make available detection capabilities for the ExcelMacro.Laroux virus. Because of the significant modifications made to most anti-virus products to enable them to detect Word macro viruses in late 1995 and early 1996, most Anti-virus product developers should be able to much more quickly enable detection capabilities in their products for this new virus.

-- The end-user base has experience with word macro viruses. This experience will translate into better and more effective protection against this virus by most organizations.

Therefore, it is likely to be several months before this virus becomes widespread.

NCSA recommends that all organizations enable full-time, background protection (TSR, VxD, or similar protection) on most desktop PCs with an NCSA Certified Anti-Virus Product as the best and most effective means of reducing total costs and disruption of computer viruses.

This new Excel macro virus does not change NCSA's ongoing recommendation for full-time desktop protection mechanisms as, by far, the most cost effective. Protection at the server level is less effective compared with protection at the desktop for all classes of viruses, including macro viruses. Organizations should update their anti-virus software as soon as feasible after vendors provide detection capabilities for this new virus.

NCSA has recently published a comprehensive survey of the virus problem and growth in North American businesses. It is available in its entirety at NCSA's web site (www.ncsa.com) as a zip word document.

NCSA also has recently completed a Computer Virus Study which analyzes all aspects of the current computer virus problem. The study contains a comprehensive software model of cost of computer viruses versus various protection strategies. The model takes all types of viruses including macro viruses into consideration and is the basis for NCSA's recommended anti-virus policies. The study and model may be purchased directly from NCSA at 717/258-1816 x 251.

CONTACT: NCSA

Peter Tippett, 717/258-1816 x213

Joe Wells, 805/499-2814

or

Network Associates

Amy Neuberger or Cheryl Snapp, 801/373-7888