Viruses << >>

Macro Viruses

Arrival of WM/Concept.A in August 1995 caused a revolution in the anti-virus industry, as none of the producers of anti-virus software was ready for this kind of threat. It infects the documents created by MS WORD and this was a challenge because Anti Virus People had through out claimed that viruses does not effect documents. New technologies to detect and disinfect this new virus were required. Microsoft, producer of Word for Windows, called this virus a 'Prank Macro', denying that this was a virus and denying that this virus was the birth of a new threat. The virus writers had different agenda and today we have more than 2000 Macro Viruses posing a threat to or MS WORD Documents and MS EXCEL Spread sheets

In order to reliably detect this new type of viruses, all researchers were facing a difficult task. A WordDocument is not just a simple text-file, but rather a complex structure stored (Embedded WordObject) in another complex structure (OLE2 - Object Linking and Embedding version 2).

OLE2 (Object Linking and Embedding version 2) is a specific format to store e.g. all Office files and is supported throughout all Windows platforms with the respective library files for those platforms. An OLE2 file can be seen as a file system in a file. An OLE2 file has an internal FAT, a Root-Directory called RootEntry, subdirectories called Storages and Embedded Objects called Streams. An OLE2 file can contain several Embedded Objects, even multiple of each. OLE2 is a very good way to store data.The idea behind it is simple. If you change e.g. one byte in a stored embedded object, it is of no use to store the entire (large) object again when being saved, but rather the changed part.

Both Word and Excel supports writing Macros (in Office 97 VBA5 is used as the language for writing Macros). They can be used for product extension and hence provide fantastic utility. Viruses too smelled the oppurtunity and targeted these Macros

For virus like behavior macros viruses has to be designed with 3 basic thoughts in mind.

Of course, once the first objective is achieved the other two can be manipulated quite easily