Bugtraq mailing list archives

word 97 macrovirus protection problem


From: thomas () 88 NET (thomas lakofski)
Date: Mon, 26 Jul 1999 22:37:53 +0000


hi,

i recently noticed, while dealing with a macro virus going around my
office (too new for latest av software), that word 97's 'macro virus
protection' feature doesn't work when printing documents directly from
explorer.

normal scenario:

1) open document
2) word pops up macro warning dialog
3) click 'disable'
4) open visual basic editor and delete the module containing the virus

but, if like i was, you're printing a few documents and one happens to
have a virus:

1) select multiple documents
2) right click, select 'print' context menuitem
3) word opens each document sequentially and prints them, including the
document with a virus in it.  word doesn't ask about the macros in this
document, just goes ahead and enables them anyway.
4) i now have a macro virus in my normal.dot, with no indication of ever
having run a macro-containing file.

[skip rant on stupid macro security model]

regards,

-thomas

......
[obligatory-useless-waste-of-bits-bit-goes-here] ultra-umbra-magic-crypto
EF D8 33 68 B3 E3 E9 D2  C1 3E 51 22 8A AA 7B 98 supercomputer-AES-xspook


Current thread: