Microsoft Office converter to disinfect virus files

Microsoft programmers are working on a file conversion program that will disable infected Office 2003 files by converting them into the new, XML-based Office 2007 formats, AccountingWEB's John Stokdyk reports.

Called the Microsoft Office Isolated Conversion Environment (MOICE), the converter will be available in a few weeks time and was previewed by Microsoft security technologist David LeBlanc.

Malformed Office document files are becoming an increasingly popular means for gaining control of remote PCs - for example to build so-called spam "botnets". Last week's monthly security bulletin from Microsoft, for example, included news of seven critical updates, three of which addressed malformed file threats affecting Office itself, Word and Excel.

Trojan horses, worms and keyboard logging viruses can be propagated via Office documents sent as email attachments, or via "drive-by" downloads from malicious websites. VBA macros can also be constructed to let hackers take control of remote computers. According to a recent study (9-page PDF) conducted by Google, 10 percent of 4.5 million sites surveyed successfully launched such attacks (not all of them via Office documents - but some will use this route).

The new Office file formats were designed to eliminate security problems, LeBlanc explained and to make the documents more transparent. To achieve this, Microsoft stripped out a lot of the internal code that is often vulnerable to attack. What MOICE does is direct a suspect attachment to a quarantine area where it can't affect the network and then convert it into the XML-based Office 2007 format and then back into an Office 2003 .doc, .xls or .ppt file. Some of the tools used in this process are based on the Office 2007 file converters supplied by Microsoft to let users of older versions open and edit the new formats.

LeBlanc acknowledged that there will be some downsides to the new MOICE tool. "Converting a file twice before you can open it adds a performance penalty," he wrote. "Whether it's something you'll notice depends on the size of the files - if you use it to pre-process resumes, you may not notice, but larger documents could take a noticeable amount of time. We're also stripping out things like macros and VBA projects - sure, it's a big app-compat hit, but this is a security feature."

You may like these other stories...

It's not a reality—yet—but accounting software is poised to eliminate accountants. We are at a tipping point for many similar professions: online education replacing professors, legal software replacing...
Whenever I speak to accountants about creating a cloud practice, the most common question is, “How do I charge my clients?” Ten years ago, maybe even five years ago, if I would’ve posed this question...
While reputational risk is the No. 1 nonfinancial concern among corporate directors, cybersecurity/IT risk is gaining steam. In fact, both private companies and organizations with more than $1 billion in revenue felt they...

Upcoming CPE Webinars

Jul 31
In this session Excel expert David Ringstrom helps beginners get up to speed in Microsoft Excel. However, even experienced Excel users will learn some new tricks, particularly when David discusses under-utilized aspects of Excel.
Aug 5
This webcast will focus on accounting and disclosure policies for various types of consolidations and business combinations.
Aug 20
In this session we'll review best practices for how to generate interest in your firm’s services.
Aug 21
Meet budgets and client expectations using project management skills geared toward the unique challenges faced by CPAs. Kristen Rampe will share how knowing the keys to structuring and executing a successful project can make the difference between success and repeated failures.