I thougt it's good to know, how to find a macro virus, 'coz then you know where you have to be carefull if you write one.
The most virii use stealth techniques against the user, that means, you can't see the
code. The remove the ToolsMacro
from the command bar, or have a better stealth function. Well, because this is a Word97
virii writing tutorial, I'll list,
how to dedect Word97 virii.
The virus removes the locks Tools Macro and/or the Visual Basic Editor:
Open the Normal.dot with a hex editor and rename all what's like that: M O D U L E 1 .
T O O L S M A C R O
M
O D U L E 1 . V I E W V B C O D E
another good trick is to export all macros from the Normal.dot to a file. If you want to know more about, read on!