When in doubt use notepad to open the file. Macro's are still going to show up as plaintext should be fairly easy to then figure out if the file is kosher or not. If they're not showing up as ascii then I'd worry a bit. Of course you could also just install AVG and sandboxie to open the file and find out without worrying about if you're going to destroy your machine in the process (I love that about sandboxie).
Geoff Sent from my BlackBerry wireless handheld. -----Original Message----- From: "Kelly Robinson" <[EMAIL PROTECTED]> Date: Sun, 7 Oct 2007 16:05:33 To:full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] Question re: Macro Virus behaviour An MS Word file on your computer has a size of 356 KB and a modified date of 19 June 2007 3:37:51 PM. Moreover, the file has been certified clean (i.e., uninfected) at this point by an infallible AV scanner. After a highly-publicised virus outbreak, you examine this file's properties again and notice it is still 356 KB with the same modified date and time. Can you safely conclude it has not been infected without checking it with your AV scanner? Why or why not? _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
