March 12, 2014

The Terror of the Macro-Enabled Document

Filed under: Main — Tags: , , — admin @ 12:01 am

Word macros can be useful and it’s fun to explore the possibilities. Macros also have a sordid past, which is why creating Word documents that contain macros requires special care.

Like a lot of computing technology in the 1990s, Word’s macro abilities were never really checked for security concerns. Given the vast power that macros had, it was entirely possible for someone to craft a Word macro that worked as a computer virus. Not only was it possible, but it happened on many occasions.

The most well-known Word macro virus was perhaps the Melissa virus, which used Word’s connection to the Outlook email program to replicate itself and send copies to everyone in the computer’s address book. Nifty!

I kept a copy of a Melissa-infected document on my hard drive for years. I used it as an example in many of my books. One day, when I was testing Norton Anti-Virus, it found and automatically removed the file. That wasn’t my intention. So, regrettably, I no longer have a copy of the virus.

After a few years, Microsoft modified Word with macro security features. You may have even seen such warnings when you open a Word document, such as the one shown in Figure 1.

Figure 1. The Word document macro warning.

Figure 1. The Word document macro warning.

To allow the document’s macros to work, click the Enable Content button. You may then be asked whether you want to make the file a Trusted Document. If so, click the Yes button. That way you may not see the warning again.

Obviously the macro warning is an after-effect of the Melissa virus and other Word macro malware. Microsoft is just being very cautious, which is a good thing.

By the way, you can control the macro security level for your documents by using the Word Trust Center: In Word, click the Developer tab, then click the Macro Security button in the Code group.

The Trust Center window, Macro Settings category appears. Four levels of macro security are available:

  • Disable all macros without notification
  • Disable all macros with notification
  • Disable all macros except digitally signed macros
  • Enable all macros (not recommended; potentially dangerous code can run)

The second option, Disable all macros with notification, is the default and the one I recommend using. It’s what displays the warning shown in Figure 1.

If you create a macro in a document, then you must save the document in a special Word file format. When you don’t, Word gently reminds you, as shown in Figure 2.

Figure 2. The save file macro warning.

Figure 2. The save file macro warning.

Click the No button to try to save again. Otherwise, should you click the Yes button, the document is saved but not the macro.

When you use the Save As dialog box again, choose the Word Macro-Enabled Document (*.docm) file format from the Save As Type menu. That special file format allows macros in the document and provides for macro security. Opening the document displays the warning shown in Figure 1, which simply alerts the person editing the document to the presence of the macro — which they can safely disable or enable.

No Comments

No comments yet.

RSS feed for comments on this post.

Sorry, the comment form is closed at this time.


Powered by WordPress