Overview

In general, anti-virus programs use two techniques to detect malware:

Signatures: Scanning for known signatures that may identify an instance of a known malware.
Heuristics: Applying heuristics in an attempt to identify likely malware for which there may be no known signature.

An AV scan may result in the identification of a malware when none is present, or the identification of a risk when there is no risk. Such identifications are usually called false positives.

Microsoft Office

One of the options made available by at least one AV program is to offer an additional option for protecting Microsoft Office files from malware.

Although well-intended, such options:

Confuse most users as they will have no way of discerning whether a warning should be ignored or not.
Will be disabled by most experienced users as such options can be both a pain in the back rank, to use polite chess terminology, and may interfere with the running of valid software.
May prevent commonly used, and required, programming techniques from being used.
May be circumvented by most any competent programmer.

Demonstration

Installing OfficeStuffExamples.exe will result in three items being added to Start|Programs|Howard Kaikow. All three run identical code.

Office Stuff using Dll: Includes the code in a library that is run from a macro in Microsoft Word.
Office Stuff using EXE: Includes the code in a stand-alone program.
Office Stuff using Word Includes the code in a Microsoft Word template file, along with a macro to run the code.

Observations

Since all three executions use identical code, one would think that all three would have the same malware warnings. Code executed within Microsoft Office is no different than IDENTICAL code executed outside of Microsoft Office.

Actions

All three demonstrations give you an opportunity to select a directory, and then confirm the selected directory in a MsgBox. Not really useful, but a technique is used that raises a warning if used with at least one AV program that has its Microsoft Office option enabled.

Requirements

The demonstrations were compiled using Microsoft Visual Basic 6 (with SP 6) and Microsoft Office 97. The demonstrations should work with Microsoft Office 97, 2000, XP, and 2003.

For the DLL and EXE demonstrations, you will need to have the following installed:

Either Microsoft Visual Basic 6 or the Microsoft Visual Basic 6 run-time files: If you have neither, then you can download the Visual Basic 6 run-time files by following the instructions in VBRun60.exe Installs Visual Basic 6.0 Run-Time Files.

If you are running Microsoft Windows ME, NT, 2000, or XP, you should already have the Visual Basic 6 run-time files installed.

If you have Microsoft Office 2000, Office XP or Office 2003, I believe that you may already have the Visual Basic 6 run-time files installed.

Restrictions

I have developed the program using Microsoft Windows 2000, and I have not verified whether the demonstrations will work on operating systems older than Microsoft Windows 2000.

Installing the program

Run the program OfficeStuffExamples.exe.

The program will be installed in a directory of your choosing and will be assigned to the Howard Kaikow group in the Start menu.

The program may be uninstalled from Add/Remove Programs in the Control Panel.