Microsoft Reduces Virus Risk in Upgrade of Office

Acknowledging a security breach in its flagship computer programs, Microsoft said Thursday an upgrade of its popular Office software suite will begin shipping this month without some of the features that have made computers vulnerable to viruses such as the Melissa strain, which has tied up many corporate networks in recent days.

The word-processing program in Office 2000, known as Word, will be set to automatically disable mini-programs called “macros” unless they contain special digital signatures from trusted sources. A growing number of viruses have used macros to sneak into computers and wreak havoc on networks. People who want to use macros in Word documents would have to change the setting.

“That’s a first step,” said Alan Paller, director of research at Maryland-based SANS Institute, which trains security experts. But Paller said the action will only partially solve the problem.

Although most viruses are now spread in macros packaged with Word, if that avenue is closed hackers are likely to use other approaches such as packaging the virus with Excel spreadsheets.

Microsoft is reluctant to turn off the macros in Excel because macros are increasingly used for such applications as expense accounts.

“We found that there were a larger number of viruses in Word so we decided to be hard-core,” said George Meng, Microsoft’s product manager for Office. He added that Microsoft chose not to disable the function in Excel because macros are more widely used for spreadsheets.

The default settings that Microsoft establishes when it ships its software are important because most corporate information managers tend to leave the settings that way. Changing the settings once the program has been installed in a computer can be a painstaking process.

Steve White, a computer security expert for IBM, said Microsoft could quickly wipe out a generation of viruses if it stopped using macros, but he doubts this will happen.