A macro virus is a word basic script (Word97 viriis are written in Visual Basic) wich
copies itself to the Normal.dot.
The Normal.dot will be started if you open a document. If the virus is on the Normal.dot,
it copies itself to the document.
Let's have a look to the ASCII picture bellow:
INFECTED DOCUMENT-------(virus)---------->NORMAL.DOT the Normal.dor is now infected.
INFECTED NORMAL.DOT-----(virus)---------->DOCUMENT the Document is infected
The Basic Language is easy to learn, if you look at the Assemble language. But with
Assembler you can do much more, than with Basic! Of course there are polymorph and stealth
macro virii, but they are easy to dedect, because the code is very
visible in the Normal.dot. In Word 97 it was very easy to encrypt macro virii, but in
Word97 it is more or less impossible
or senseless, because you have to leave a part of the macro unencrypted.