Absolute PC Security and Privacy.pdf

Most macro viruses work by exploiting an application’s auto-execute macros. These are
macros that load and run automatically when a document is opened, or when another program
event occurs, without any prompting or action by the user. Once the macro is running, if there
is malicious code within the macro, it can delete text, delete files, rename files, copy itself to
other documents and templates, and cause untold other damage. Most macro viruses also copy
themselves to the application’s default template (in Microsoft Word, that’s the Normal
template, with the filename normal.dot), so that they run whenever you open any document
within that application. And since the default template is used whenever you create a new
document with that application, all subsequent documents you create will be infected.
Figure 4.1 shows how a typical macro virus is loaded and executed. The process starts when
you launch an application and open an infected document. When the document is opened, it is
loaded into memory, and the macros contained within the document are also loaded. If a
macro is written to run automatically, the virus macro loads into your system memory and
then delivers its payload.
Figure 4.1 : How a macro virus infects your system
Obviously, the macro virus spreads when you share an infected document with other users.
Whoever opens the infected document will have their computer infected, and all new
documents created on that computer will also be infected. When that user shares a document
with yet another user, the infection spreads again.
Which Types of Documents Can Be Infected
Virtually any document or document template that contains macros can theoretically be
infected with a macro virus. In practice, Microsoft Office applications have been the
recipients of most macro virus attacks, with Microsoft Word a particular target.
That said, macro viruses have been discovered that target documents in the following
applications:
• Microsoft Word (DOC and DOT files)