
Ŀ
                                                                    
                        
                                    
                           
                                          
Ĵ
                                  5                           
ٰ



                         W97M.Lexar
                   by  મ (Eset, Slovakia)

                      Virus Bulletin, August 2003
                          (ࠣ )

    ************************ ॢ by DrMAD *************************

    ,    ஢  ஢        -ࠤ,
ᮬ, 諨.    ६  稭    1995      
WM.Concept.A.     1999    ஢ ஦  90%  
 樤⮢. ஥ ६   ᫠ 砫 㣠  
ᮮ⢥⢨   ⨪  ᭮ ⥭ 㯠  0.68%   
2003 .

    25  2003   稫 㬥 Word,  ,    
⨪,    ஢  ஢ᮬ.   
,    ⨪    ᮢࠫ.  ,  ⮡ࠦ  
᪨  ࠣ⮬,      ,    ᥣ 뫮  
  Relax,    ⮬    㦥    뫨  
  ᮢᥬ 㣮 ᥬ⢠ W97M.Relax. ⮬   
 W97M.Lexar.

    =  =

    室 W97M.Lexar.A ⮨   83  ப.  堭  ࠧ
⠭⥭  쬠 ਬ⨢...

    [...]

    ...⥬  ⠥  䠩, ᮤঠ騩 ⨢ 㬥,
 筮 ०.  ᫨    砥,    ⠭    
ᬥ饭 35Dh    1.    ⠫쭮  ᬮਬ    筮 ⢨
...

    [...]

    = ࠭  =

    ஡  .   뫮 ⭮⥫쭮     ਬ⨢,
᪫  : ࠭    1.

     ६  ⮢ ࠧ  ⨢᭮ ਨ  ⬥⨫
    䠪⮢.    砫    ⮬,    Word-  
⮡ࠦ   ।०    .  -,    த
⪠뢠  ࠦ 㬥,      ,    ଠ
㬥  ७.      ࠭ 뫨 易   ⮣
.

     筥   ⪮  ᠭ  ଠ  㬥  Word.  
㬥    ᭮ ࠭  ⠢ 䠩 OLE2,   
 ।⠢  ⢮ ⤥  䠩,  祭  
 䨧᪮ 䠩.  䨧᪨ 䠩  ᫮ ,
ᮤঠ 2--஢ FAT-⠡,  ⠫,  ࣠  
ॢ쥢  ..   砥,       ࠭頬
(⠫)  ⮪ (䠩),     ⠪   ᢮
⢥ ७ ଠ.

     ⠢  䠩  OLE2 -  ᫥⥫쭮 ᥪ஢,  
㬮砭      200h  ⮢.    ᥪ  (   䠩
ᬥ饭 0) 稭  .   ᮤন  ଠ 
ன⢮ 䠩,  ⠪  ࠧ ᥪ, 㪠⥫   ᥪ
୥  ⠫    ..  饭  ⠫ ᥪ஢  
ᮤন FAT-⠡     䠩  䠩.   䨣 
    ᬥ饭 35Dh ( ᬥ饭   ஬ ᥪ), 
஢, 㤠    ०  ⨬ ?

    ⢥ 砥  ᯮᮡ,  Word ࠭ ᢮ 㬥.
  ,    饬 設⢥ 砥  ᬥ饭
200h 稭  ⮪  WordDocument.      砥,    䠩
ᬥ饭 35Dh ᮮ⢥ ᬥ饭 15Dh  ⮪ WordDocument.

    = ⮪ WordDocument =

      ,         ⮪
WordDocument.    㭤⠫   ⮪     Word-㬥⮢.  
稭        FIB  (File  Information  Block).
   ᬥ饭 15Dh  㦨    fcCmds
 lcbCmds.

     ⥯ ᬮਬ  㬥  Microsoft.

   ------------------------------------------------
   0x015A fcCmds long     Offset in table stream of
                          The macro commands.
                          These commands are
                          private and undocumented.

   0x015E lcbCmds ulong   Undocument size of
                          undocument structure not
                          documented above.
   --------------------------------------------------

     ⠪ ,  -  Microsoft  ਪ뢠. ⭮,
     ᬥ饭 15Dh  ᠬ 訩  
fcCmds.    ⠡ ⮪   ᪮쪮 ⮢, 
fmds 㤥 㪠뢠 㤠-  । ⮪.

    ᪮  _macro commands_ 樠쭮  㬥஢, 
諮   堪  ,      ,     ᮤন
᭮⢮ ࠧ ᥩ.  ਬ,  ⠬      ᮢ  
VBA-஥, ଠ  짮⥫᪨ ன   㣮.
 ᥣ    0FFh  砥 ⮬ 40h.

    㬥,          ᮤঠ        ᮢ    
짮⥫᪨ ஥,   lcbCmds=2   fcCmds,  㪠뢠饥  
 0FFh 40.    த 㤠   ஢
㬥,     _macro commands_.

    ᪮ W97M.Lexar.A ⠭ fcCmds     ⠡,  
  ⪠뢠  ࠡ.    ⠫ ᬮ ᫥
 ,  祬  Word   론  ,   㬥
  ⥫ ?

    =   ஢ᮢ =

      Office  95  MIcrosoft  ᯮ짮    WordBasic  
ᠭ  Word᪨  ᮢ.         㬥⮬ 
饬 ⮪ WordDocument.  稭   Office  97  Microsoft  
WordBasic      VBA.    ࠭  ⮪
⠫ Macros.   祭 :  ᫨  ᮢ,     ⠪
⠫.

     ⥯ ᬮਬ,    ࠡ⠥ _macro  virus  protection_  
Word 97  SR-1.  㭪    -  㡮  winword.exe,  
ண 5 ,    堢,    .    
ProcessMacroCommands.  饭  룫廊 ⠪:

 ------------------------------------------------
    BOOL ProcessMacroCommands(STREAM_HANDLE
    TableStream, LONG fcCmds, ULONG lcbCmds ...)
    {

      BYTE RecordID;
      BOOL UserWarned=FALSE;

      if (lcbCmds == 1) return FALSE;
      ...
      Seek(TableStream, fcCmds);
      ...
      ReadByte(TableStream, &RecordID);
      lcbCmds--;
      if (RecordID != 0xff) return TRUE;
      ReadByte(TableStream, &RecordID);
      lcbCmds--;
      if (RecordID != 0x40)
      {
         PossibleMacros;
         if (!WarnUserAboutMacros()) return FALSE;
         UserWarned=TRUE;
      }

      if (!UserWarned && TestMacrosStorage())
      goto PossibleMacros;
      ...

    }
   --------------------------------------------------

     㬮砭  ࠧ襭.  ᫨ 㭪 頥 FALSE,  
Word  뢠  㬥.  㭪  ReadByte  ⠥      
㪠  樨 㪠 ⮪.    ⮪ ⠭
㭪樥 Seek.  ᫨   㪠    殬  ⮪,    㭪
ReadByte 뢠 0.

    㭪 WarnUserAboutMacros   ⮡ࠦ      
(᫨ ⠭  ᮮ⢥騩  䫠    Word-)      
짮⥫ -  ࠧ      ,     ⠪
(⠭ ᢮ ७ 䫠)   頥  FALSE, ᫨
짮⥫ 蠥   뢠 㬥.  ⥫쭮 㭪
TestMacrosStorage ⠥  ⮪ Macros  頥 TRUE, ᫨
㤠.

       ,  ᫨  fcCmds  㪠뢠      ⮪,  
ࠢ  0FFh   㭪 ୥ TRUE (..  Word  த
㧪 㬥)      ⮡ࠦ  ।०.  ,  
ࠧ. 㣮  ᯮᮡ  ⨦  ⮣    䥪      
⨣ ⠭  fcCmds  -  ⮪,   
ᮤন 0FFh  ࢮ ,    ࢮ   _macro
commands_.

    = 襭 =

     訥    娥 .  娥    ⮬,
   梨    ⠪    Word  2000    Word XP,   ᫨
⠭ Security Level=HIGH.  ᨨ Word for Macintosh ⮦  
 梨,      ஢﫨.  訥    ⮬,
 Microsoft   ⮩ ஡  21  2001 ,   ᠭ
 Microsoft Security Bulletin MS01-034.    ࠧ ᨩ Word-
室 ⠬ .

    ᫨  ᭮ (, ਬ, ) ,   ࠡ⠥ 
,  ࠢ  ProcessMacroCommands:

    ----------------------------------------------------

    BOOL ProcessMacroCommands(STREAM_HANDLE
    TableStream LONG fcCmds ULONG lcbCmds _)
    {
      BYTE RecordID;
      BOOL UserWarned=FALSE;
      if (lcbCmds == 1) return FALSE;
      ...
      Seek(TableStream fcCmds);
      ...
      if (TestMacrosStorage())
      {
         If (!WarnUserAboutMacros())
         return FALSE;
         UserWarned=TRUE;
      }
      ReadByte(TableStream &RecordID);
      lcbCmds--;
      If (RecordID != 0xff) return TRUE;
     ...
    }
    -------------------------------------------------

      ,  ஢ઠ  ⮪ Macros ⥯ ⠢
। ࠡ⪮    _macro  commands_.  ᪮      ⮪
   ᨬ    ⢨ ᮢ,    
  , ᯮ짮  W97.Lexar.A,   ࠡ⠥...


    [...]

