TIP: Click on subject to list as thread! ANSI
echo: virus_info
to: PETER STEFANOVIC
from: DAVID DESROSIERS
date: 1997-03-13 12:56:00
subject: Re: infected winword document

 -=> Quoting Peter Stefanovic to Christoph Nagl <=-
 CN> What sort of viri can such a document include and how is the virus
 CN> executed?
 PS> Word 6.0 can be hit with a Macro virus, this happens when you run a
 PS> Macro  to insert certain names or function within Word, word uses
 PS> certain excutable  files within itself to run the your macro, the
 PS> virus attachs itself to those   ???.exe files that run your function
 PS> and then spread themself all over your Word's excutables or right
 PS> thoughtout your ???.exe's on your HDD..
        It can? Please name one...
        I've been working with over 100 of the most popular macro viruses, 
nd
I've yet to see one that actually touches .EXE files (except Nuclear, which
isn't that popular anymore). The only way a macro virus can do this is if it
uses the 'Shell' statement, and then runs executable code at the command
prompt level, which builds a virus "on the fly" or runs an actual virus
already on the drive. The virus then becomes a "dropper".
        I'm working with Office97 macro viruses now, and they're not the same
as the present strains. The new structure in Office97's format makes it 
arder
to write them, but once done *RIGHT* will pose problems for the AV people, 
ut
as always, they'll recover...
 PS> I hope this was clear & helpful..
        ...but slightly incorrect...
... Jim, you don't ask the Almighty for his I.D. Bones
--- WtrGate+ 0.93.PRE9-d beta sn 116
---------------
* Origin: hacker heaven bbs - #include (1:320/2600)

SOURCE: echomail via exec-pc

Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.