Macro Viruses: An Overview

Macro viruses are not a new concept - their development was theorized in the late 1980's. No longer a theory, macro viruses are a prolific reality. It is not uncommon for five new macro viruses to be reported daily.

A macro virus is a virus written in one of the many macro languages. Macro viruses spread via infected files, such as documents, spreadsheets, databases or any computer program that allows the use of macro languages.

Macro viruses are possible due to the nature of macros and macro languages. Macros are series of commands used to perform software application tasks, such as text formatting. Designed to automate tasks, macros are activated when an assigned keystroke combination, menu item or toolbar item are selected. Macro language allows macros to be modified and to use the power of the application to replicate. Macro viruses are self-replicating macros. Macro viruses are spread as the viral macro copies itself, infiltrating files that are opened. As these files are shared, so are the macro viruses. Macro viruses may change or delete file contents. Most macro viruses are written for Microsoft Word and Excel, however macro viruses exist for Lotus AmiPro.

Macro viruses are particularly prolific because people exchange documents and spreadsheets more frequently than program files and floppy disks, and macro viruses are very easy to create and modify.

Several trojans have been written in Word macro language. They typically delete data as soon as the trojanized document is open. Since they do not spread by themselves, they are not widespread and are not considered to be a significant threat.

Some known macro trojans are WordTrojan/Format C and Word/Trojan/WeideroffnenC.