Possible Macro Virus Attacks and How to Prevent Them

Abstract: Computer viruses written in the macro language of powerful office packages, particularly of Microsoft Word for Windows are a relatively new phenomenon. Most of the viruses of this kind known to date rely heavily on the availability of the so-called "auto" macros (macros which execute automatically when the document containing them is opened or closed) in order to spread. This has created, among some anti-virus producers, the illusion that macro viruses have to depend on the auto macros in order to replicate. Based on this erroneous assumption,  some companies have developed inadequate antivirus products and protection schemes. This paper demonstrates that the assumption is false—that there are many other ways which a WordMacro virus can use to get control and replicate successfully. The paper describes all these methods known to the author, emphasizes that they pose a problem mostly to the anti-virus programs of the generic kind (i.e., not to the virus-specific scanners), and explains what measures have to be taken in order to block these attacks reliably.