Microsoft Office Documents Compromised

There is an exploit making the rounds that does not require the use of internal macros in an office document. Basically, that means that if you open an infected document, it can execute the virus without any other interaction by the user. Most of these documents are coming in the form of well crafted Emails. Unfortunately, even clicking on a document that comes from a trusted source can initiate this infection if that source has been compromised. Please use extreme caution when opening Microsoft Office documents that are sent to you by “anyone” via the internet.

We realize this is a tall request, so if you do open a document and notice anything suspicious, at all, please report it to IT immediately.

The virus cannot execute if you are using “Protected View” within Office. This view is on by default, however, in some cases it may have been deactivated for user productivity or inadvertent user action. You can tell if Protected View is operational if, when opening a document from an email, a message at the top of the document indicates that the document is in Protected View and editing of the document is not allowed. You can remove that statement and allow editing, however, if the document is infected, allowing editing is when the infection will spread to your computer.

You can also check your settings to make sure that Protected View is enabled:

  1. Click File > Options
  2. Click Trust Center > Trust Center Settings > Protected View
  3. The settings should look as follows if Protected View is active:

As always, if you have any questions, please ask IT.

Read more about about this Microsoft Office exploit…
OLE attacks spike, supplementing malicious macros as attack vector
Microsoft Word 0-day used to push dangerous Dridex malware on millions

Ready to get started?

"Your passport to all things web."

1 Abbey Lane
Camp Hill, PA 17011
Phone: (717) 516-6955

Design and hosting by CourseVector. All rights reserved. Copyright 2019. | Sitemap

To contact us after hours please use the panic button.
Fees may be incurred depending on reason for support.