-=> Quoting Peter Stefanovic to Christoph Nagl <=-
CN> What sort of viri can such a document include and how is the virus
CN> executed?
PS> Word 6.0 can be hit with a Macro virus, this happens when you run a
PS> Macro to insert certain names or function within Word, word uses
PS> certain excutable files within itself to run the your macro, the
PS> virus attachs itself to those ???.exe files that run your function
PS> and then spread themself all over your Word's excutables or right
PS> thoughtout your ???.exe's on your HDD..
It can? Please name one...
I've been working with over 100 of the most popular macro viruses,
nd
I've yet to see one that actually touches .EXE files (except Nuclear, which
isn't that popular anymore). The only way a macro virus can do this is if it
uses the 'Shell' statement, and then runs executable code at the command
prompt level, which builds a virus "on the fly" or runs an actual virus
already on the drive. The virus then becomes a "dropper".
I'm working with Office97 macro viruses now, and they're not the same
as the present strains. The new structure in Office97's format makes it
arder
to write them, but once done *RIGHT* will pose problems for the AV people,
ut
as always, they'll recover...
PS> I hope this was clear & helpful..
...but slightly incorrect...
... Jim, you don't ask the Almighty for his I.D. Bones
--- WtrGate+ 0.93.PRE9-d beta sn 116
---------------
* Origin: hacker heaven bbs - #include (1:320/2600)
|