This is where the
Macro Virus Protection feature kicks in. If you have it disabled, our virulent
macros
will be activated and taa taa.......you've activated the virus and
infected your Word environment. So, once again, I stress that you TURN ON
the macro virus protection feature in Word 97.Next, when our alert warning
prompts out, select Disable Macros. This would prevent all macros in the document
from running and opens the document in ReadOnly mode. Don't worry.....of course
the viral code won't be activated since you've disabled all macros.
After it's done and the document is opened, go to Tools-Macro-Visual Basic Editor.
This would launch the VB IDE. Double click ThisDocument.
And surprise.......you'll get to see the entire VBA code of the virus. If ThisDocument
is empty, find for any module within the project explorer window. This should
give the viral code of the doc. Also, if there are any forms, you can get to
view it too. There goes....my tutorial on catching a macro virus. This method
works even with unknown and undetected macro viruses.
Additional Tips & Tricks:
- To know whether your Word environment is infected by a macro virus, find for
Normal.dot file in your harddisk. Note it's size. The normal size is 26k-27k
(for Word 97). If the filesize is about this range, it's not infected.
However, if it's way above this range for example 40K or 50K, then, there's a
BIG possibility that it's infected.
- Also, when you get a large Normal.dot fiile, try viewing it in Notepad or a
Hex Editor. There's a chance that you could uncover viral code traces in clear text

