Prilissa Macro Virus 

On Friday, November 12th, Microsoft was made aware of a Word 97 macro virus (dubbed "Prilissa") that affects Outlook® and Outlook Express users. The macro functionality of Microsoft Office applications provides a programming environment that allows customers and developers to extend the functionality of Office. However, malicious hackers have recently taken advantage of this macro functionality to create this harmful virus. As with all virus issues, Microsoft takes this issue very seriously and is taking steps to proactively notify our customers to help minimize its impact. Microsoft is actively working with the anti-virus community and other Internet security groups to educate customers on the situation and to help minimize the impact of this class of virus.

What is the "Prilissa" macro virus?

It is a Word 97 macro virus delivered via e-mail in an attached Word document that can only affect users if the attachment is opened on December 25th. The e-mail contains the subject line "Message From [UserName]" and/or contains the message body "This document is very Important and you've GOT to read this!!!" If the attached Word document is opened on December 25th and the macro virus is enabled (i.e. it is allowed to run), it can propagate itself by sending e-mail with the infected document to a number of recipients. The virus reads a list of e-mail addresses from the Outlook Address Book and sends an e-mail message to the first 50 recipients programmatically. The virus also can reformat the hard disk drive of Microsoft Windows® 95 or Windows 98 computers and will overlay the attached document with random shapes.

Will Office 97/Office 2000 protect me from this and other macro viruses?

Yes. Microsoft Office applications, including Microsoft Word and Microsoft Excel are designed to protect you from macro viruses, including the "Prilissa" virus and any variants, provided the macro virus protection in these applications is turned on (which is the default setting). With the macro virus protection turned on, every time you open a document that contains macros, a dialog box appears and asks you to choose whether to enable or disable included macros. You should always disable macros when you are not certain of their purpose or functionality. By choosing to disable the macros, you will prevent any macro viruses from running, preventing infection by the virus. The virus is only activated if you open the attached document and choose to enable the macros, or if your macro virus protection settings have been previously turned off and you open the attachment.

It should be noted that even if the message containing the virus is not opened, it could still infect others if it is forwarded. To minimize risk from this virus and to prevent spreading the virus further, if you receive e-mail with the above-mentioned attachment and/or subject line, you should delete it immediately without opening the message.

How do I ensure the Office macro virus protection is turned on?

In Word 97 and Excel 97

1. On the Tools menu, click Options.
2. On the General tab, check Macro Virus Protection.

In Word 2000 and Excel 2000

• Double-click the Tools menu, point to Macro and then choose Security.

Select the level of security you want. High security will allow only macros that have been signed to open. Unsigned macros will be automatically disabled. Medium security always brings up the macro dialog protection box that allows you to disable macros if you are unsure of the macros.

Important Note  If you are not able to follow the steps above because you cannot find the menu items, you may already be infected. If so, run anti-virus software containing the latest update, and scan your system often. Support for this particular virus is already available from a number of anti-virus companies (see more information below). If you are not able to run anti-virus software, it will be necessary to delete or rename your normal.dot file. This is the global template in Word, which will automatically be recreated once Word is launched. After this is done, repeat the steps above.

How do I ensure I will not be infected?

• Make sure the Office macro virus protection is turned on as described above. Always choose "disable macros" when asked, if you are unsure of the purpose of the macro in the document. Doing so will still allow you to open the document and read its contents. Once certain the macro is safe, and only if you need to run the macro, you can then re-open the document and enable the macro.
• Run the latest anti-virus software, and scan often. This is how you can ensure that the macros in documents are safe. Disinfectors for this particular virus are already available from a number of anti-virus companies. Also remember to keep your anti-virus software up to date by installing the latest signature files for that company. (Most companies creating anti-virus applications release a new signature file each month.) Consult the List of Anti-Virus Software Vendors, available in the Microsoft Knowledge Base.
• Communicate this information to all those who could become infected.

What should I do if I have (or think I have) been infected by this virus?

• Run anti-virus software containing the latest update, and scan your system often. Support for this particular virus is already available from a number of anti-virus companies. Consult the List of Anti-Virus Software Vendors, available in the Microsoft Knowledge Base.
• Make sure your Office virus protection is turned on. Once the Prilissa virus has been allowed to run, it will disable the virus protection in Word 97. Remember to make sure Office macro virus protection is turned on by performing the steps listed above.

What if I have more questions on Macro Viruses?

To learn more about virus protection, read Protect Your Microsoft Office Data from Viruses on the Office Update Web site.