Rus Articles Journal

What is macro viruses?

In this article will be a question of macro viruses, in particular, about those representatives of this numerous family who strike the documents Word .

PC users often underestimate macro viruses, disregarding that the macro written, for example, in the VBA language and integrated into the document Word or of Excel , has all same potential, as the usual program. It can format your winchester, remove any files for choice, copy any confidential information (for example, passwords) and to send it by e-mail etc. of

What is macro viruses

Macro viruses are the programs written on the so-called macro languages which are built in some systems of data processing (text and graphic editors, spreadsheets etc.) . For the reproduction such viruses use possibilities of macro languages, they are had from one infected file to another. The greatest distribution was gained by macro viruses for Microsoft Word , of Excel . Macro viruses receive management when opening or closing of the infected file, intercept standard file functions and then infect files to which in any way there is an address. The majority of macro viruses are resident viruses: they are active not only at the time of opening or closing of the file, but until the text or tabular editor is active (and some can remain in random access memory before switching off of the personal computer!) . Ease of creation of macro viruses blows the mind, everything is literally near at hand: it is enough to start of Word , to choose the Service menu - the Macro - the Visual Basic Editor - and the program VBA environment will be started ( of Visual Basic for Application )!

Principle “ works “ macro viruses

During the work with the document MS Word performs various operations: opens the document, keeps, prints, closes etc. At the same time of Word looks for and carries out the corresponding built-in macroes: when saving the file on command the File - the macro of FileSave volunteers to Keep , at preservation on command the File - to Keep as … - of FileSaveAs , at the press on command of the Press … - of FilePrint etc. There are also several macroes which are automatically caused at emergence of the corresponding situations. For example, when opening the Word document checks it for existence of a macro of AutoOpen . If such macro is present, then of Word carries out it. When closing the document Word the macro of AutoClose carries out , at start of Word the macro of AutoExec is caused, at completion of work - of AutoExit , during creation of the new document - of AutoNew (similar mechanisms, but with other names of macroes, are used also in Excel ).

The macro viruses striking the Word files , as a rule, use one of four receptions:

1) is present at a virus an automacro;

2) in a virus is redefined one of standard system macroes (associated with any menu item);

3) a virus macro automatically is caused when pressing any key or a combination of keys;

4) a virus begins to breed only if the user starts it on performance.

Main mechanism of infection such: when we open the infected document Word , the macro virus copies the code to the area of global macroes of the document. And at an exit from Word ’and global macroes (including virus macroes) automatically register in dot - the file of global macroes (the Normal template . dot ).

Then the virus redefines standard macroes (for example, of FileOpen , of FileSave , of FileSaveAs , of FilePrint ) and with their help intercepts teams of work with files. By a call of these teams the file to which there is an address catches.

How to find macro viruses

Characteristic signs of presence of macro viruses are:

1) impossibility of saving the infected Word document in other format (on command to Keep as …);

2) impossibility of record of the document in other catalog or on other disk the Keep team as …;

3) impossibility of preservation of the made changes in the document (the Keep team );

4) inaccessibility of the " tab; Safety level “ (the Service menu - the Macro - Safety …);

5) since many viruses are written with mistakes (or incorrectly work in various versions of the Microsoft Office package ), emergence of the corresponding system messages with an error code is possible;

6) others “ strangenesses “ in behavior of the documents Word ;

7) often macro viruses can be found visually. The matter is that most of virus writers differ in vanity: in properties of the Word file (the window of Property volunteers - to choose on click of the right button of a mouse from a context menu of Property ) on the Report tab entry fields ( the Name fill, the Subject , with the Author , Category , Keywords and the Comment ). This information (as a rule, in macro viruses it is written with Latin mix with Cyrillics and includes - among other - some senseless words, the type munitsipalizmo etc.) can be seen at guidance of the mouse pointer on an icon of the Word file - it appears in the emerging hint and below at the left in the folder, in a window is detailed (if Use of typical tasks for folders is included by ).

All to you kind!