News for hackers. Stuff that matters.

A comment on Avoid Non-Microsoft Antivirus Software. Parent comment

Re:Avoid Non-Microsoft Antivirus Software by technion on Thursday January 26, 2017 @03:21AM (#13489679)
An extraordinary amount of Cryptolocker outbreaks were due to .docx files containing macros.

Yes, it has a default behaviour of "prompt to execute macros", but it happily shows the advice in the malicious document to "please click yes at this prompt to get a free iPhone", at which point the majority of users click "yes".

[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by floatboth on Thursday January 26, 2017 @08:01AM (#13490956)
I think Swift on Security posted a tweet about this a while ago, with a screenshot of completely banning all Office macros via group policy.
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by emodendroket on Thursday January 26, 2017 @09:22AM (#13491523)
Office macros are really useful, though.
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by mavhc on Thursday January 26, 2017 @04:54AM (#13490049)
.docx files can't contain macros
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by technion on Thursday January 26, 2017 @05:48AM (#13490311)
Correction: It's .doc files I've seen the majority of this behaviour in.
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by neko_koneko on Thursday January 26, 2017 @07:39AM (#13490820)
.docx files could contain macros just fine.
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by emodendroket on Thursday January 26, 2017 @09:23AM (#13491530)
They cannot. Anything that has macros has to be docm.
[ Parent | on HN ]
Re:Avoid Non-Microsoft Antivirus Software by neko_koneko on Thursday January 26, 2017 @09:45AM (#13491740)
Sorry, my bad. I meant files in OOXML format.
[ Parent | on HN ]