Copyright: Copyright © 2001 Kaspersky Lab


API Function Calls

With the API function calls the macro starts functions and procedures of the operation system and other programs stored in the DLL files.

This instruction may be dangerous. With this instruction the virus may perform some action without using corresponding standard VB instructions. For example, to delete some file the virus may call the corresponding procedure from the Kernel32.dll system library.


Add Code in Module

With the VBProject.VBComnponents.Item(n).Codemodule.InsertLines instruction the macro adds new strings to the module.

This instruction is highly dangerous. The virus may add virus-code to the module. A lot of viruses (the so-called polymorphic viruses) each time after being executed partially change their code to make it difficult for antivirus scanners to detect them.


Add Module

With the VBProject.VBComponents.Add instruction the macro adds new module to the project.

This instruction is safe but is usually used by viruses to subsequently insert virus-code into the new module.


All Ask Level of Antivirus Protection

While operating with the All ask level of antivirus protection the program is set to ask a user for instructions each time some virus-suspected macro-instruction is detected.

The All ask level of antivirus protection rule tree


Change File Attributes

With the SetAttr instruction the macro changes file attributes.

The instruction is safe per se but may be used by viruses to disable the ReadOnly attribute of the Normal template to subsequently infect it.


Changing Settings

Choosing the Level of Antivirus Protection

High Level of Antivirus Protection

Middle Level of Antivirus Protection

All Ask Level of Antivirus Protection

Low Level of Antivirus Protection

Custom Level of Antivirus Protection


Check button "Use answer as default" is available only if you have key-file.


Choosing the Custom Level of Antivirus Protection

If you often or regularly use some certain macro(s) calling some virus-suspected macro-instruction(s) we recommend you to personalize your rule tree. It means that you should set your KAV Office Guard to automatically enable this (these) macro-instruction(s) if detected. Otherwise you will be doomed to instruct KAV Office Guard each time it detects this (these) macro-instruction(s).

To personalize your rule tree follow the steps:

1.	Select the Custom level of antivirus protection from the Security settings option buttons list. The Custom tab will appear within the main window

2.	Switch to the Custom tab and customize your rule tree the way you need (For details on how to customize the rule tree see below).

Personalizing the rule tree


Choosing the Level of Antivirus Protection

To choose the antivirus protection level follow the steps:

1.	Switch to the Security settings tab within the main window.

2.	Select the desired button from the option button list.

·	Maximum – the highest possible level of antivirus protection.

·	Middle – normal level of antivirus protection appropriate for most users.

·	All ask – at this level of antivirus protection KAV Office Guard will ask a user for instructions if any virus-suspected instruction is detected.

·	Low – low level of antivirus protection.

·	Custom – this level of antivirus protection enables a user to select the rule for each controlled macro-instruction. You may change settings within the Custom tab sheet.

The Custom option button is available only if you have a valid registration key-file.

The Middle level of antivirus protection is appropriate for most users. The Low level of antivirus protection is not recommended.

If you choose a level of antivirus protection below Middle the corresponding warning will appear on your screen.


Closing Down the Interface Part of KAV Office Guard

To closedown only the interface part of KAV Office Guard select the Close command from the main dynamic menu.

In this case the interface part of KAV Office Guard will be deactivated and its service part won’t be unloaded.


Contents

Main Functions and Features

KAV Office Guard: Protecting against Unknown Viruses

Interface

Changing Settings

Intercepting Virus-Suspected Macro-Instructions

Viruscheck Log

General Information on Your KAV Office Guard Copy

Virus-Suspected Macro-Instructions Reference List

Glossary


Copy Modules (Word MacroCopy command)

With the WordBasic.MacroCopy instruction the macro copies a module from one project to another.

This instruction is highly dangerous. The virus may copy the module to load its copy into a virus-free macro. As a result the virus-free document will be infected.


Copy Project Items

With the OrganizerCopy instruction the macro copies a project item from one project to another.

This instruction is highly dangerous. The virus may copy the project item to load its copy into a virus-free macro. As a result the virus-free document will be infected.


Create ActiveX Object

With the CreateObject instruction the macro creates new ActiveX object.

This instruction may be dangerous. When gained the access to some ActiveX object the virus may take advantage of its features. For example Macro.Word97.Melissa virus may secretly create Outlook.Application object, read all the addresses from your address book, create new letter and insert into it some infected document. Now if you connect to the Internet this virus will mail this letter to all the addresses from your address book.


Create ActiveX Object on Remote Server

With the CreateObject instruction the macro creates new ActiveX object on a remote server.

This instruction may be dangerous (For details see chapter "Create ActiveX Object").


Create Directory

With the MkDir instruction the macro creates new directory.

This instruction is safe per se but if used by virus may cause troubles to your computer. For example the virus may create an unwanted hierarchy of directories on your hard drive.


Create Event Procedure

With the VBProject.VBComponents.Item(n).Codemodule.CreateEventProc instruction the macro creates an event processing procedure within the macro.

This instruction is safe but may be used by viruses to subsequently add virus-code to the procedure.


Custom Level of Antivirus Protection

Choosing the Custom Level of Antivirus Protection

How to Customize the Rule Tree

Reviewing Rules for Middle and Low Levels of Antivirus Protection


Date and time of seance of KAV Office Guard.

Mode of automatic update KAV Office Guard.

Virus-check log of KAV Office Guard

Rule tree

Check button "Use answer as default"

Check button "Use answer as default" is available only if you have key-file.

Import Module

Export module

Copy Project Items

Copy Modules (Word MacroCopy command)

Excel Sheet Copy

Add Module

Remove Module

Delete Project Items

Rename Project Items

Create Event Procedure

Add Code in Module

Insert Code in Module from File

Insert Code Line(s)

Delete Code Line(s)

Replace Code Line(s)

Delete File(s)

Change File Attributes

Create Directory

Remove Directory

Open File with Write Mode

Disable 'Save Normal Template' Prompt

Disable Virus Protection Warning

Shell Command

Create ActiveX object

Create ActiveX Object on Remote Server

Get Access to ActiveX Object

Sending Keystrokes

API Function Calls

Permit

Ask

Denied

Terminate macro execution


Date and time of seance of KAV Office Guard._1
Date and time of seance of KAV Office Guard.


Delete Code Line(s)

With the VBProject.VBComponents.Item(n).Codemodule.DeleteLines instruction the macro deletes strings from the module.

This instruction is highly dangerous. If executed by virus your working macros may be lost.


Delete File(s)

With the Kill instruction the macro deletes one or several files on your disk.

This instruction is highly dangerous. If executed by virus some data from you hard drive may be lost!


Disable 'Save Normal Template' Prompt

With the Options.SaveNormalPrompt = False instruction the macro unchecks the Prompt to save Normal template check box. As a result the prompt to save Normal template that is the starting point for developing new documents and contains Global Word macros is depressed.

Probability that this macro-instruction is executed by virus-code is very high. After this instruction is executed the virus infects NORMAL.DOT and saves the changes. As the prompt to save Normal template was depressed you will not notice that your template was changed.


Disable Virus Protection Warning

With the Options.VirusProtection = False instruction the macro unchecks the Enable macro virus protection check box.

Probability that this macro-instruction is executed by virus-code is very high. No working macro needs to depress macro virus protection.


Excel Sheet Copy

With the Sheets.Copy instruction the macro copies contents of one Microsoft Excel sheet to another.

This instruction may be dangerous. Since each Microsoft Excel 97 sheet has its module within the project while copying a sheet macro copies the corresponding module including its code. If this code contains a virus the instruction execution will result in that this virus will be also copied. But since the Microsoft Excel sheet may contain no attached macro this macro-instruction may be safe.


Export Module

With the VBProject.VBComponents.Item(n).Export instruction the macro writes the project module into a file on your disk.

This instruction is safe but is usually used by viruses to subsequently import the module.


File Operations

Delete File(s)

Change File Attributes

Create Directory

Remove Directory

Open File with Write Mode


General Information on Your KAV Office Guard Copy

The About tab sheet within the main window displays general information on your program copy.

The table lists all the registration key-files being employed by KAV Office Guard – the Key number column lists key-numbers, the Licence name column lists license names, the Info column contains additional information on the key-files, the Expiration column lists the license expiration dates, the File column lists corresponding file names.

If you click the Support button within the About tab sheet the Kaspersky Lab contact information will appear on your screen.


Get Access to ActiveX Object

With the GetObject instruction the macro gets access to existing ActiveX object.

This instruction may be dangerous (For details see chapter "Create ActiveX Object").


Glossary

Visual Basic for Application (VBA) – a programming language in the Microsoft Office 97, 2000 environment.

Macro-instruction – an instruction written with the macro language of an application (WordBasic) or a VBA instruction.

Macro – program code in VBA that may be triggered by user or some event.

Module – a collection of declarations and procedures that are stored together as a unit.

Virus-suspected macro-instruction – a macro-instruction frequently used by viruses to write their code into a file or to perform destructive actions.

Procedure – a named sequence of statements executed as a unit.


Maximum Level of Antivirus Protection

While operating with the Maximum level of antivirus protection the program is set to deactivate all macros attempting to execute any virus-suspected instruction.

The Maximum level of antivirus protection rule tree


How Do Macro Viruses Operate

All Microsoft Office applications support auto-macros, i.e. macros automatically called on some occurrence. Auto-macros are assigned to events with their names enabling the application to decide which macro when should be called. In Microsoft Word, for example, while opening a file the application automatically executes the AutoOpen macro if there is one in this document, and while printing some document it executes File->Print.

Macros/functions associated with some key or point in time are also executed automatically (i.e. without user involved); i.e. the application calls this kind of macro/function when some certain key (or key-combination) is pressed or at some point in time.

Macro viruses infecting Microsoft Office documents generally employ one of the described above features. The virus either contains auto-macros (auto-function) or may be automatically executed when some certain key (or key-combination) is pressed. There are also quasi-viruses not employing these methods but reproducing themselves when triggered by user.

Accordingly if the document is infected, while calling certain auto-macro the application actually executes virus-code. If the virus contains macros with standard names they take the control when user refers to corresponding menus (the File->Open command, the File->Close command, the File->SaveAs command). If some macro of this virus is associated with certain key (or key combination) this virus may be activated only by the corresponding key (or key combination).

The majority of macro viruses store their functions in the form of Microsoft Office 97 standard macros. But there are viruses employing methods to hide their code and storing this code in a form different from the one of macros. There are three known methods of the kind and they all use the property of a macro to create, edit and execute other macros. These viruses are generally armed with a small (sometimes polymorphic) virus macro-loader that calls the built-in macros editor, creates new macro, fills it with basic virus-code, executes and then usually destroys it to eliminate all traces of presence of the virus. The basic code of such viruses is stored either in the virus itself in the form of text strings (sometimes encrypted) or in the document variables or Auto-text areas.

The physical layout of a virus within a file depends on the format of this file. As for Microsoft products, their format is extremely complex and each file-document of Microsoft Office corresponds to a set of data-blocks (each of these blocks are also of its own format) associated with each other by a bulk of housekeeping data. This format is called OLE2 - Object Linking and Embedding. The structure of Microsoft Office (OLE2) files reminds sophisticated file-system of DOS drives: "root directory" of this file-document or spreadsheet indicates main subdirectories of the data-blocks, several FAT tables contain information on the layout of data blocks within this document and etc.

Furthermore the Microsoft Office Binder system supporting standards of all Microsoft Office applications enables a user to create files containing several documents of various Office applications. For example a file may contain several Microsoft Word documents and a Microsoft Excel spreadsheet. And in this case within one file documents may be infected with Word viruses and spreadsheets with Excel viruses.

All Microsoft Office applications enable a user to paste objects from other applications in their documents. For example in Microsoft PowerPoint you may paste in the presentation some document from Microsoft Word containing some Microsoft Excel spreadsheet and etc. And in this case macro viruses may also infect these inserted documents.

Since formats of Word, Excel and Microsoft Office files are so complex the location of a macro virus within the file may be represented just in the diagram form:

Virus-free file–document or spreadsheet
File header
Housekeeping data (directories, FAT)
Text
Fonts
Macros (if present)
Other data
Infected file–document or spreadsheet
File header
Housekeeping data (directories, FAT)
Text
Fonts
Macros (if present)
Macros of virus
Other data

Besides all Microsoft Office applications are enabled to encrypt macros within a document. Therefore some viruses within documents may be also encrypted.

Microsoft Office viruses may infect not just an IBM-PC but computers of any class. The computer may be infected with macro virus if it runs some software fully compatible with Microsoft Office (e.g. Microsoft Word for Macintosh).


How to Customize the Rule Tree

Rule tree

Macro-Instructions Inheriting the Group Rule

Macro-Instructions with Independent Rules

Macro-Instructions with Strictly Independent Rules


If you want your instruction within this dialog box to be assigned as a rule to this macro-instruction check the "Use this answ
If you want your instruction within this dialog box to be assigned as a rule to this macro-instruction check the "Use this answer as default rule" check box. If you checked the "Use this answer as default rule" check box your current rule tree will be edited accordingly.


Import Module

With the VBProject.VBComponents.Import instruction the macro reads a module from the file on your disk and adds it to the project.

This instruction is highly dangerous. The virus may import some module to load its copy into a virus-free macro. As a result the virus-free document will be infected.


Insert Code Line(s)

With the VBProject.VBComponents.Item(n).Codemodule.AddFromString instruction the macro inserts new strings into the module.

This instruction is highly dangerous. The virus may first place virus-code into a string and then with the AddFromString instruction add text from this string to the virus-free module.


Insert Code in Module from File

With the VBProject.VBComponents.Item(n).Codemodule.AddFromFile instruction the macro inserts into the module new strings from some file.

This instruction is highly dangerous. The virus may first export its code to some file and then with the AddFromFile instruction add strings from this file to the virus-free module.


Intercepting Virus-Suspected Macro-Instructions

When some macro tries to execute a virus-suspected instruction KAV Office Guard according to the rule assigned to this macro-instruction (See chapter "Rule Tree") may prohibit the instruction execution, enable it, terminate the whole macro or ask a user to choose one of these actions.

If you assigned the Ask rule to this macro-instruction the KAV Office Guard - Permit this action? dialog box will appear on the screen.

The upper area of this dialog box informs you on what virus-suspected macro-instruction this macro tries to execute. For details on this macro-instruction click the Details button and for information on what kind of threat to your computer does this macro-instruction pose click suitable button.

In the bottom area of this dialog window you may see three the following buttons enabling you to instruct KAV Office Guard on what action should be performed:

·	Yes – to permit the macro-instruction;

·	No – to prohibit the macro-instruction;

·	Stop – to terminate the macro.

If you want you instruction within this dialog box to be assigned as a rule to this macro-instruction check the Use this answer as default rule check box.

The Use this answer as default rule check box is available only if you have a valid registration key-file.

If you checked the Use this answer as default rule check box your current rule tree will be edited accordingly.

Note that if the Ask rule assigned to this macro-instruction within you current rule tree is strictly independent from the group rule it will be changed to merely independent new rule.

KAV Office Guard for sure will detect activity of any macro-virus infecting Microsoft Office 2000 documents, but it is a user who should decide on weather this certain virus-suspected macro-instruction really indicates the presence of a macro virus. If you decide that the document is infected we recommend you to start antivirus scanner or refer to your system administrator. The chapter "Virus-Suspected Macro-Instructions Reference List" reference list will enable you to make the right decision.


Interface

Starting KAV Office Guard

Main Dynamic Menu

Main Window

Closing Down the Interface Part of KAV Office Guard


KAV Office Guard Intercepting Macro Viruses. Rules for Virus-Suspected Macro-Instructions

KAV Office Guard monitors the performance of macros within Microsoft Office 2000 applications. When some macro is started and attempts while operating to call a macro-instruction corresponding to one in the virus-suspected macro-instructions list the program is activated and takes the control. Then depending on the settings KAV Office Guard performs one of the following actions: enables or prohibits the instruction, terminates the whole macro or allows a user to choose one of these actions. KAV Office Guard action that is associated with certain macro-instruction we shell call hereinafter a rule for this macro-instruction.

 – Ask for further instructions.

 –  Stop macro.

 – Forbid suspicious macro-instruction.

 – Permit suspicious macro-instruction.

For example you may enable the following rules: to stop all macros attempting to perform the most dangerous actions, to ask a user to confirm the macro instruction copying Microsoft Excel sheets, to enable the macro-instruction creating procedures and to ignore all the other macro-instructions. The described above example relates each virus-suspected macro-instruction to one of the rules.

The example assigning rules to all the virus-suspected macro-instructions


KAV Office Guard: Protecting against Unknown Viruses

Viruses Infecting Microsoft Office Documents

Macro-Instructions Suspected For Virus

KAV Office Guard Intercepting Macro Viruses. Rules for Virus-Suspected Macro-Instructions


Low Level of Antivirus Protection

While operating with the Low level of antivirus protection the program is set to enable all virus-suspected macro-instruction except for the most dangerous. For most dangerous virus-suspected macro-instruction KAV Office Guard will ask a user for instructions.

The Low level of antivirus protection rule tree


Macro Events. Macro Code Changes

Add Code in Module

Insert Code in Module from File

Insert Code Line(s)

Delete Code Line(s)

Replace Code Line(s)


Macro Events. Module Operations

Import Module

Export module

Copy Project Items

Copy Modules (Word MacroCopy command)

Excel Sheet Copy

Add Module

Remove Module, Delete Project Items

Rename Project Items

Create Event Procedure


Macro runs functions and procedures of OS and other programs by calling API-functions that are included into dll-files.


Macro viruses

To automate repeated operations macro language elements were embedded into many text processors, spreadsheet and graphic editors, and engineering systems. Macros may be of complex structure and may have the comprehensive set of instructions.

Macro virus is a piece of macro code and is designed to perform destructive actions against a computer and to transfer its code from the infected file (documents or spreadsheets) to others.

Today, at the end of 1999 we already know several programs where macro viruses were detected. They are the principal applications of Microsoft Office with built-in Visual Basic for Applications (VBA) macros:

·	Microsoft Word (text editor) (WordBasic macro elements are embedded in Microsoft Word 6/7 and VBA elements in Microsoft Word 8 and later);

·	Microsoft Excel (spreadsheet editor);

·	Microsoft Access (database editor);

·	Microsoft PowerPoint (presentation editor);

·	Microsoft Project (project manager).

AmiPro editor turned to be also liable to macro virus attacks as it is armed with special script language embedded.

Currently Microsoft Office (Word, Excel and PowerPoint) macro viruses are the most widespread. Macro viruses for other Microsoft Office applications are comparatively uncommon, and as for AmiPro, today we know just one macro virus affecting this editor.

To allow macro viruses to spread in a system there has to be a built-in macro language elements allowing:

1)	to assign specific macro program(s) to specific file;

2)	to copy macro program(s) from one file to other ones;

3)	to pass the control to some macro program(s) without user's permission (auto and standard macros).

The three above-listed systems where macro viruses were detected meet these requirements:

1)	macro program(s) are assigned to specific file(s) (AmiPro), or exists only within the file body (Microsoft Office applications);

2)	macro language allows to copy files (AmiPro) or copy macro programs into the system and other files (Microsoft Office);

3)	while working with a file the macro programs are executed under some conditions (file opening, closing, and so on), these programs are defined by special commands (AmiPro), or they have standard names (Microsoft Office).

These features of modern systems were designed to write "document auto-processing systems" employed in major business organizations and within global networks and allowing to set up the so called computerized document-processing environments, but they also allow for the viruses to spread their copies, i.e. to infect files.


Macro-Instructions Inheriting the Group Rule

Some macro-instruction icons and control indicators fully depend on those of the group. These macro-instructions inherit the group rule.

All the macro-instructions on default inherit the group rule.


Macro-Instructions Suspected For Virus

Macro-instructions enabling the virus to replicate itself and adversely affect your software may be considered as suspected for virus. These instructions may also be executed by standard macros. The tree of all the controlled virus-suspected macro-instructions is shown below.

The tree of macro-instructions suspected for virus

It is convenient to divide macro-instructions in four the following groups:

1.	Macro events. Normal macros rarely change the code of other macros and hardly ever their own. Code changes with high probability manifest the presence of a macro virus. Macro events may be divided in two groups. First of all it is a group comprised by project module operations enabling a macro to create, add, copy, export and import modules, and second is a group of macro code changing macro-instructions inserting, deleting and replacing code lines.

2.	File operations. Macro-instructions working with files are also may be suspected for virus. For example if the macro virus that infected your software was designed to delete files it may disannul your data.

3.	Other commands. This group includes macro-instructions changing the document antivirus protection, starting external applications (calling Shell command), working with ActiveX objects, emulating keystrokes. These macro-instructions may also be employed by viruses.

4.	API function calls. Operation system function and procedure calls and other program calls by means of API interface enable viruses to perform harmful actions without using corresponding Visual Basic commands.

For details on all virus-suspected macro-instructions and corresponding macro language commands and information on their usage frequency refer to chapter "Virus-Suspected Macro-Instructions Reference List".


Macro-Instructions with Independent Rules

Some macro-instruction icons and control indicators may be different from those of the group. These macro-instructions have their independent rules.

To define some macro-instruction as having an independent rule you need just to assign a rule different from that of the group to this macro-instruction or change its control indicator status.

Macro-instructions with independent rules may be restored to macro-instructions inheriting the group rule.


Macro-Instructions with Strictly Independent Rules

Some macro-instructions may have icons and control indicator statuses strictly independent from those of the group. These macro-instructions have strictly independent rules.

To define some macro-instruction as having a strictly independent rule you need just to select the Set Strict command from the dynamic menu.

To disable the strictly-independent-rule status select the Remove Strict command from the dynamic menu.

Rules of macro-instructions with strictly independent rules are fully independent from the group rule and control indicator status.


Main Dynamic Menu

To monitor and manage performance of the KAV Office Guard interface part use its main dynamic menu.

To open the program main dynamic menu, point and click your mouse right button on the indicator [image] in the Windows taskbar notification area.

The main dynamic menu contains the following items:

·	Show settings – To display the program main window.

·	Disable KAV Office Guard/Enable KAV Office Guard – To suspend/resume the performance of KAV Office Guard. While suspended KAV Office Guard does not monitor performance of your macros.

·	Close automatically – To automatically closedown the interface part of KAV Office Guard when all the Microsoft Office 2000 applications using VBA are closed.

·	Help – To display the Help Topics window.

·	Close – To closedown the interface part of KAV Office Guard.

If you selected the Close command the service part of KAV Office Guard will not be unloaded.


Main Functions and Features

Kaspersky Office Guard for Microsoft Office 2000 (KAV Office Guard) is a program protecting Microsoft Office 2000 documents from both well-known and new macro viruses. If some document is infected by some virus KAV Office Guard (regardless of the type of this virus) will detect it and take corresponding steps to disable it.

KAV Office Guard performs the following functions:

·	Monitors the activity of macros written in Visual Basic for Application (VBA) within Microsoft Office 2000 applications. When some macro is started KAV Office Guard checks each instruction executed by it and compare these instructions to the list of virus-suspected macro-instructions, i.e. the set of macro-instructions that might be executed by virus code.

For more information on virus-suspected macro-instructions, their description and usage frequency see chapter "Virus-Suspected Macro-Instructions Reference List".

·	When some macro tries to execute a virus-suspected instruction KAV Office Guard according to the preset antivirus protection level may prohibit the instruction, enable it, stop the whole macro or allow a user to choose one of these actions. For example, you may set the program to stop all macros attempting to execute virus-suspected instructions.

KAV Office Guard for sure will detect activity of any macro-virus infecting Microsoft Office 2000 documents, but it is a user who should decide on weather this certain virus-suspected macro-instruction really indicates presence of the macro virus. If you decide that the document is infected we recommend you to start antivirus scanner or refer to your system administrator. The chapter "Virus-Suspected Macro-Instructions Reference List" reference list will enable you to make the right decision.


Main Window

Main Window Tabs

Main Window Buttons


Main Window Buttons

Within the bottom area of the main window you may see the following buttons: Ok, Cancel, Apply and Help. Use the following buttons to do the following:

·	OK – to apply all changes made and to close the window;

·	Cancel – to cancel all changes made and to close window;

·	Apply – to apply all changes made and to keep the window open;

·	Help – to refer to Help Topics.


Main Window Tabs

The KAV Office Guard main window is equipped with two following tabs: Security setting and Statistic. The Security settings tab is designed to enable a user to choose the antivirus protection level that KAV Office Guard should provide, the Statistic tab shows the program performance results. Besides if on the Security settings tab sheet you choose the Custom level of antivirus protection the corresponding tab will appear within the window.

Since any time you decide to disable/enable the program, to call for Help, to closedown the interface part of KAV Office Guard and etc. you may use the dynamic menu the main window is not equipped with a menu.


Middle Level of Antivirus Protection

While operating with the Middle level of antivirus protection the program is set to stop the majority of virus-suspected macro-instructions.

This level of antivirus protection is appropriate for most users.

The Middle level of antivirus protection rule tree


Microsoft Office Viruses: Background

The history of Microsoft Office macro languages began from Word 2.0 with embedded WordBasic. As the document exchange, especially in major business organizations, is much more intense then the exchange of programs and Microsoft Word viruses correspond to simple class infectors they spread fast and wide.

The next application with embedded macros was Microsoft Excel 5.0. Embedded in it Visual Basic for Applications 3.0 (VBA3) language differed from WordBasic by its concept and was much more powerful and flexible. As a result soon after this first Microsoft Excel viruses were detected.

In Microsoft Office 97 developers implemented new approach to the organization of macros within Microsoft Office applications. All major Microsoft Office 97 applications (Access, Excel, PowerPoint, and Word) were armed with macros based on the same macro language, Visual Basic for Applications 5.0 (VBA5). This language was still more powerful and independent from the application it was used by. It enabled developers to write macro programs equally working in Microsoft Word, Microsoft Excel, PowerPoint and Access. Besides both Microsoft Word and Microsoft Excel use the macros-automatic-translation-function that on opening of a document developed in some previous version of the editor automatically translates its macros from WordBasic or VBA3 into VBA5. Therefore the majority of macro programs (including viruses) which were written for previous versions of Microsoft Office are enabled to work with Microsoft Office 97. Virus-writers didn’t hesitate and soon after the Microsoft Office 97 release developed viruses for all its applications. Besides there were developed first cross-platform macro viruses “feeling fine” in several Microsoft Office environments. Macro.Office97.Triplicate that efficiently operates in Microsoft Word, Excel and PowerPoint is an example of such virus.

Microsoft Office 2000 is also armed with Visual Basic for Applications 6.0 (VBA6) language used by all its applications and with the macros-automatic-translation-function. Currently macro programs written in VBA can be executed not just in Microsoft Access, Excel, PowerPoint and Word, but in FrontPage and Outlook either.


Mode of automatic update KAV Office Guard.


Open File with Write Mode

With the Open For Append instruction the macro opens a file in the write mode.

This instruction is highly dangerous. If executed by virus some data from you hard drive may be lost!


Other Commands

Disable 'Save Normal Template' Prompt

Disable Virus Protection Warning

Shell Command

Create ActiveX object

Create ActiveX Object on Remote Server

Get Access to ActiveX Object

Sending Keystrokes


Remove Directory

With the RmDir instruction the macro removes the directory.

This instruction is highly dangerous. If executed by virus some data from you hard drive may be lost!


Remove Module, Delete Project Items

With the VBProject.VBComponents.Item(n).Remove and OrganizerDelete instructions the macro removes an item from the project.

This instruction is highly dangerous. It is usually used by viruses to remove items containing auto-macro text and substitute it with new infected items. If just to add an infected item it may result in that the program compiler will warn a user about two similar name auto-macros present. Viruses simply remove current modules to avoid these complications. If some module is removed all its executable macros are lost.


Rename Project Items

With the OrganizerRename instruction the macro renames the project items.

This instruction is not very dangerous but is usually executed by viruses.


Replace Code Line(s)

With the VBProject.VBComponents.Item(n).Codemodule.ReplaceLine instruction the macro replaces code lines in module with some others.

This instruction is usually used by polymorphic viruses. As a result code of such viruses constantly changes making it difficult to detect them.


Reviewing Rules for Middle and Low Levels of An-tivirus Protection

You may check rule trees designed for the Middle and Low levels of antivirus protection.

To do it follow the steps:

1.	Select the Middle (Low) level of antivirus protection within the Security settings tab sheet.

2.	Click the Apply button.

3.	Select the Custom level of antivirus protection. The Custom tab will appear within the main window.

4.	Switch to the Custom tab.

The Custom tab sheet will show you a rule tree for the level of antivirus protection you applied.


Rule tree

Two frames are located on the Custom tab sheet. The left frame shows you the rule tree that includes virus-suspected macro-instructions, control indicators and rule icons while the right frame lists rule option buttons.

Within the rule tree you may change control indicators and rules for macro-instructions and their groups. Depending on what changes you made macro-instructions may inherit the group rule, have independent rules or strictly independent rules.

To change any control indicator of any macro-instruction or group follow the steps:

1.	Highlight the desired string within the rule tree.

2.	Click the control indicator with your mouse or press Spacebar on your keyboard or select the Check Node item from the dynamic menu.

Macro-instruction control indicators may change their statuses.

Macro-instruction control indicators

An element of the rule tree	Control indicators	Comments
The macro-instruction inheriting the group rule, and the macro-instruction with some independent rule	,	The macro-instruction control is enabled/disabled on a consecutive basis.
The macro-instruction with some strictly independent rule	,	The macro-instruction control is enabled/disabled on a consecutive basis
The group including only macro-instructions inheriting the group rule.	,	The group macro-instruction control is enabled/disabled on a consecutive basis.
The group including macro-instructions with independent rules.	, [image]; [image],	After the group indicator status is changed twice all the macro-instructions inherit the group rule.
The group including macro-instructions with strictly independent rules.	,	The group macro-instruction control, except for those macro-instructions with strictly independent rules, is enabled/disabled on a consecutive basis.
To assign a rule to some macro-instruction or group follow the steps:

1.	Highlight the desired string within the rule tree.

2.	Select the desired rule from the list of option buttons.

·	Permit – to permit the virus-suspected macro-instruction.

·	Ask – to ask a user for instructions each time this macro-instruction is detected;

·	Denied – to prohibit this macro-instruction and to begin execution of the next macro-instruction;

·	Terminate macro execution – to terminate the macro.

Depending on weather you change settings of the group or instruction your rule tree settings will change accordingly.


Rule for virus-suspected macro-instruction or group.


Sending Keystrokes

With the SendKeys instruction the macro emulates keystrokes.

This instruction may be dangerous. By emulating keystrokes the virus may initiate actions without the user permission. For example it may initiate export or import of some infected file.


Shell Command

With the Shell instruction the macro starts some external program.

This instruction is highly dangerous. By this instruction the virus may start any program on your computer to perform destructive and other actions. For example with this instruction Trojan may gather information on your computer, then start the FTP program in a hidden window and mail this data via the Internet.


Starting KAV Office Guard

Each time your computer loading a Microsoft Office 2000 application it starts the so-called service part of KAV Office Guard designed to perform functions of an antivirus “watch”. This service part activates when there is an attempt to execute one of the virus-suspected macro-instructions. When some virus-suspected macro-instruction is detected the service part of KAV Office Guard starts its the so-called interface part or if you decide to change antivirus settings you should start it from the Windows menu.

To start the interface part of KAV Office Guard from the Windows menu follow the steps:

1.	Click Start.

2.	Point and click Programs.

3.	Point and click KAV Office Guard.

After the KAV Office Guard interface part is started corresponding indicator [image] should appear in the notification area on your Windows taskbar .

To open the main window of KAV Office Guard select the Show settings menu item within the main dynamic menu or double-click the indicator [image] in the notification area on your Windows task bar.


To ask a user for instructions each time this macro-instruction is detected.


To permit the virus-suspected macro-instruction.


To prohibit this macro-instruction and to begin execution of the next macro-instruction.


To terminate the macro.


Virus-Suspected Macro-Instructions Reference List

Macro Events. Module Operations

Macro Events. Macro Code Changes

File Operations

Other Commands

API Function Calls


Virus-check log of KAV Office Guard.


Viruscheck Log

The Statistic tab sheet within the main window informs you on viruscheck results.

The Log button arouse Report Viwer which allows you to see a log of the actions taken by KAV Office Guard to protect your computer and your Microsoft Office 2000 documents from malicious macros. A separate log is kept for each session of KAV Office Guard, which you can select from the date and time the session started, shown in the drop-down list.

The log lists the time the macro tried to execute a suspicious instruction, a copy of the instruction itself, and the action taken by KAV Office Guard. This action is also reflected in the icon displayed at the far left of the line. If the macro was terminated a red exclamation mark icon is displayed. If only the instruction was disallowed, a yellow exclamation mark icon is displayed.


Viruses Infecting Microsoft Office Documents

Macro viruses

Microsoft Office Viruses: Background

How Do Macro Viruses Operate


With the CreateObject instruction the macro creates new ActiveX object on a remote server.


With the CreateObject instruction the macro creates new ActiveX object.


With the GetObject instruction the macro gets access to existing ActiveX object.


With the Kill instruction the macro deletes one or several files on your disk.


With the MkDir instruction the macro creates new directory.


With the Open For Append instruction the macro opens a file in the write mode.


With the Options.SaveNormalPrompt = False instruction the macro unchecks the Prompt to save Normal template check box.


With the Options.VirusProtection = False instruction the macro unchecks the Enable macro virus protection check box.


With the OrganizerCopy instruction the macro copies a project item from one project to another. This instruction is highly dang
With the OrganizerCopy instruction the macro copies a project item from one project to another. This instruction is highly dangerous.


With the OrganizerDelete instruction the macro removes an item from the project.


With the OrganizerRename instruction the macro renames the project items.


With the RmDir instruction the macro removes the directory.


With the SendKeys instruction the macro emulates keystrokes.


With the SetAttr instruction the macro changes file attributes.


With the Sheets.Copy instruction the macro copies contents of one Microsoft Excel sheet to another.


With the Shell instruction the macro starts some external program.


With the VBProject.VBComnponents.Item(n).Codemodule.InsertLines instruction the macro adds new strings to the module.


With the VBProject.VBComponents.Add instruction the macro adds new module to the project.


With the VBProject.VBComponents.Import instruction the macro reads a module from the file on your disk and adds it to the proje
With the VBProject.VBComponents.Import instruction the macro reads a module from the file on your disk and adds it to the project.


With the VBProject.VBComponents.Item(n).Codemodule.AddFromFile instruction the macro inserts into the module new strings from s
With the VBProject.VBComponents.Item(n).Codemodule.AddFromFile instruction the macro inserts into the module new strings from some file.


With the VBProject.VBComponents.Item(n).Codemodule.AddFromString instruction the macro inserts new strings into the module.


With the VBProject.VBComponents.Item(n).Codemodule.CreateEventProc instruction the macro creates an event processing procedure
With the VBProject.VBComponents.Item(n).Codemodule.CreateEventProc instruction the macro creates an event processing procedure within the macro.


With the VBProject.VBComponents.Item(n).Codemodule.DeleteLines instruction the macro deletes strings from the module.


With the VBProject.VBComponents.Item(n).Codemodule.ReplaceLine instruction the macro replaces code lines in module with some ot
With the VBProject.VBComponents.Item(n).Codemodule.ReplaceLine instruction the macro replaces code lines in module with some others.


With the VBProject.VBComponents.Item(n).Export instruction the macro writes the project module into a file on your disk.


With the VBProject.VBComponents.Item(n).Remove and OrganizerDelete instructions the macro removes an item from the project.


With the WordBasic.MacroCopy instruction the macro copies a module from one project to another.