Nasty bug
The bug that the malicious hackers behind the virus have exploited has been found in PowerPoint 2000, 2002 and 2003.
Security experts said the virus was aimed at companies in Asia because Chinese characters are used in the subject line of the e-mail the booby-trapped files are attached to and in name of the poisoned PowerPoint presentation.
The presentation purports to be 18 humorous slides about love between men and women.
The PowerPoint presentation is attached to an e-mail that arrives from a Google GMail address.
Anyone opening the PowerPoint file will trigger the virus that installs a keylogger that records everything typed on an infected machine. It also opens up a backdoor into that machine that the creators of the virus are likely to exploit to gather the recorded keystrokes or to install other malicious programs.
Once a machine has been compromised the virus installs a blank version of the poisoned presentation to hide evidence that a computer has been taken over.
In an advisory about the exploit Microsoft said "limited" attacks were taking place using the bug and added: "In order for this attack to be carried out, a user must first open a malicious PowerPoint document attached to an e-mail or otherwise provided to them by an attacker."
The bug is known as a "zero-day" attack because it was exploited so soon after being discovered.
To protect themselves against hackers exploiting the bug, Microsoft warned users not to open or save PowerPoint files that turn up unexpectedly - even if they are from trusted sources.
PowerPoint has become widely used in businesses for presentations.
The virus bearing the booby-trapped PowerPoint files started circulating a day after Microsoft issued a series of software patches as part of its regular security updates. Typically these updates are issued on the second Tuesday of every month.
Security firms said the timing was deliberate as it gave the virus the longest chance to rack up victims before Microsoft gets round to closing the loophole.
Microsoft said it was on target to release a patch to protect against the exploit on 8 August.
