A macro virus is a word basic script (Word97 virii are written in Visual Basic) wich
copies itself to the Normal.dot.
The Normal.dot will be started if you open a document. If the virus is on the Normal.dot,
it copies itself to the document.
Let's have a look to the ASCII picture bellow:
INFECTED DOCUMENT-------(virus)---------->NORMAL.DOT the Normal.dor is now infected.
INFECTED NORMAL.DOT-----(virus)---------->DOCUMENT the Document is infected
The Basic Language is easy to learn, if you compare with the Assemble language. But
with Assembler you can do much more, than with Basic! Of course there are polymorph and
stealth macro virii, but they are easy to dedect, because the code is very
visible in the Normal.dot. In Word 95 it was very easy to encrypt macro virii, but in
Word97 it is more or less impossible
or senseless, because you have to leave a part of the macro unencrypted.