Word 6.0/7.0 versus Template Problems ------------------------------------- One of the effects of an infection with WordMacro viruses under Word 6.0 or 7.0(a) is that documents only can be stored as templates. The reason is quite simple: only templates can become infected and therefore any document, which has been infected, will be changed to a template by the virus. Otherwise, the virus would never be executed. The distinction of a WordObject being a template or document is just one bit. Nevertheless, this bit is the cause of all the problems. What actually happens when you disinfect an infected Word 6.0 or Word 7.0(a) file? The macros disappear. So far, so good. The problem is what to do with the Template bit. Just resetting it will not do. Original templates will turn into a document and all template data (customizations, toolbars, usermacros, stylesheets, etc) will be lost. The database used by TbScan has been updated where possible to take care of this problem. For about 50 percent of the viruses, the difference between an infected document and an infected template can be spotted on the actual infection. When we encounter an infection where this is possible, we will reset the Template Bit if the infection was on a document (local infection), and if the infection was on a template (global infection), we will not touch the Template Bit. There is also the possibility that we can not see the difference. In those cases, we apply the following rule: if the extension of the file is .DOC (default document extension), we will reset the Template Bit, otherwise we will not touch it. Word 6.0/7.0 versus Word 8.0 ---------------------------- Many users are starting to use Word 8.0 now and our support people are getting the same question repeatedly: 'We had an infected Word 6.0 or Word 7.0(a) document which we disinfected with TbScan. When we load this document in Word 8.0, it claims that there are macros inside the document, which will be executed when the document is opened. Did we or didn't we disinfect the document?' To really understand this issue, let's explain a bit about the differences between Word 6.0 and Word 7.0(a) on the one hand and about Word 8.0 on the other. Word 6.0 and Word 7.0(a) make use of the macrolanguage WordBasic. Word 8.0 is using VBA5 (Visual Basic for Applications Version 5.0) and is much more powerful than WordBasic, and not downwards compatible with WordBasic. To insure maintenance for the users who have built their macros in Word 6.0 or Word 7.0(a), Microsoft has built in a WordBasic to VBA5 translator. It is a one-way translator and functionality of the macros after translation is not guaranteed. When a user loads a Word 6.0 or Word 7.0(a) document in Word 8.0, Word 8.0 will automatically translate the previous Word format into the new Word format. However, if it detects the presence of macros, Microsoft's anti-virus techniques jump in and Word 8.0 will present a box which informs the user the document has macro's and asks the user if the macro's should be skipped. We realize that the presence of this box may raise a few questions. TbScan did remove the macros from your infected document. Nevertheless, Word 8.0 does not know this. How is this possible? Our research team has discovered, after some research, that Word 8.0 is 'not that smart' handling older types of documents. When it opens a Word 6.0 or Word 7.0(a) document, it will look at the area where the Macro Table is stored. In addition, when there are macros listed in that section, it will present the box above. Microsoft does not check whether the file is a template or not and does not check if the macros 'present' are deleted or not. To prevent this box from popping up, we have added some functionality to the scanner when cleaning and erasing macros. In cases where, after cleaning a document, no further macros are present and no other Template Data are present, we will remove the Macro Table from the document. The user will not be bothered again by Word 8.0 when the user loads a previously infected Word 6.0 or Word 7.0(a) document. AllFiles versus AllExec ----------------------- Release 8.03 of TbScan will have two 'at first glance' similar switches: AllExec (AE) and AllFiles (AF). There is an important difference between the two switches though. With the appearance of macro viruses everybody has started to scan using the old AllFiles switch because documents and templates can have any extension. The scan process slowed down and scan times increased. TbScan is known, among other items, for its speed. The old AllFiles switch really was time consuming as All Files were scanned against All Viruses. Thus, any non-executable extension was scanned not only for macro viruses, the intention of the user, but also for all binary viruses. At that time the old AllFiles switch was appointed another function: Scan All Files for All Macro Viruses. Exactly what the users wanted and no redundant overhead in time. In version 8.03, the functionality Scan All Files for All Viruses was reinstated and has been put behind the command line switch AllExec (AE). By default, all executable files and OLE2 files (Word/Excel) are scanned. Additional option: When To Use What Switch? - To scan all files for macro viruses, use the AllFiles (AF) switch. In the Windows versions, this is the 'non executable scan', which can be found in "Options" - To scan all files for all viruses (macro and binary), use the AllExec Switch, which is called 'scan all (non-executable) files as executables' in "Advanced Options" We expect the AllFiles switch to be used most frequently, since macro viruses have become increasingly important. As the spread of macro viruses grows each day, we offer updates on macro virus detection at least once a week on our web-site (http://www.norman.nl) and ftp-site (ftp://ftp.norman.nl) with the file TbScan.Def to ensure the most secure solution possible. But remember: even when you have updated your product with the latest definition file, there are at least a dozen macro viruses out there which nobody has seen yet and which are thus undetected.