Microsoft Office converter to disinfect virus files

Microsoft programmers are working on a file conversion program that will disable infected Office 2003 files by converting them into the new, XML-based Office 2007 formats, AccountingWEB's John Stokdyk reports.

Called the Microsoft Office Isolated Conversion Environment (MOICE), the converter will be available in a few weeks time and was previewed by Microsoft security technologist David LeBlanc.

Malformed Office document files are becoming an increasingly popular means for gaining control of remote PCs - for example to build so-called spam "botnets". Last week's monthly security bulletin from Microsoft, for example, included news of seven critical updates, three of which addressed malformed file threats affecting Office itself, Word and Excel.

Trojan horses, worms and keyboard logging viruses can be propagated via Office documents sent as email attachments, or via "drive-by" downloads from malicious websites. VBA macros can also be constructed to let hackers take control of remote computers. According to a recent study (9-page PDF) conducted by Google, 10 percent of 4.5 million sites surveyed successfully launched such attacks (not all of them via Office documents - but some will use this route).

The new Office file formats were designed to eliminate security problems, LeBlanc explained and to make the documents more transparent. To achieve this, Microsoft stripped out a lot of the internal code that is often vulnerable to attack. What MOICE does is direct a suspect attachment to a quarantine area where it can't affect the network and then convert it into the XML-based Office 2007 format and then back into an Office 2003 .doc, .xls or .ppt file. Some of the tools used in this process are based on the Office 2007 file converters supplied by Microsoft to let users of older versions open and edit the new formats.

LeBlanc acknowledged that there will be some downsides to the new MOICE tool. "Converting a file twice before you can open it adds a performance penalty," he wrote. "Whether it's something you'll notice depends on the size of the files - if you use it to pre-process resumes, you may not notice, but larger documents could take a noticeable amount of time. We're also stripping out things like macros and VBA projects - sure, it's a big app-compat hit, but this is a security feature."

You may like these other stories...

There's thunder and lightning in the cloud these days. And the rumbling is all about security. Could peer-to-peer file transfers be the answer? As the old accounting adage goes, there's more than one way to skin a...
Saving Excel spreadsheets as PDF files has gotten incrementally easier over the years, but can still require more effort than necessary. When saving a document as a PDF, many users go through several mouse clicks on the File...
Imagine being able to file a business expense, such as a cab ride or a meal with a new client, in real time from an app on your smartphone. Here’s the best part: Imagine being reimbursed for that expense in 24 to 48...

Already a member? log in here.

Upcoming CPE Webinars

Nov 5Join CPA thought leader and peer reviewer Rob Cameron and learn ways to improve the outcome of your peer reviews while maximizing the value of your engagement workflow.
Nov 18In this session Excel expert David Ringstrom, CPA tackles what to do when bad things happen to good spreadsheets.
Nov 19How do you minimize redundant work and unnecessary steps to maximize the amount of work moving through your firm?
Nov 20Kristen Rampe will share how to uncover new opportunities with your clients by asking powerful questions.