Author Topic: Avast and viruses in MSO and OpenOffice.org  (Read 8408 times)

0 Members and 1 Guest are viewing this topic.

Offline George Yves

  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 4095
  • Help you I can
Avast and viruses in MSO and OpenOffice.org
« on: June 26, 2007, 09:00:53 AM »
The main threat to my computer is the viruses that I can get with different office documents. So I've got a set of questions:

1) Can Avast Home detecte and cure Microsoft Office files of virus infections?

2) Can Avast Home detecte and cure OpenOffice.org files of virus infections?

3) Can Avast Home detecte and cure Microsoft Office files of macrovirus infections?

4) Can Avast Home detecte and cure OpenOffice.org files of macrovirus infections? (OpenOffice.org is using its own version of macro-language.)

Or it only can move infected files to the "Chest"?

Thanks

May the FOSS be with you!

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11850
    • AVAST Software
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #1 on: June 26, 2007, 10:17:49 AM »
The main threat to my computer is the viruses that I can get with different office documents.

I think that's not true for a long time already. The main threats are completely different these days.

1) Can Avast Home detect and cure Microsoft Office files of virus infections?
2) Can Avast Home detect and cure OpenOffice.org files of virus infections?

Don't know what this should mean; what's "virus infection" here?

3) Can Avast Home detect and cure Microsoft Office files of macrovirus infections?

Yes.

4) Can Avast Home detect and cure OpenOffice.org files of macrovirus infections? (OpenOffice.org is using its own version of macro-language.)

Don't know about detection, but I'm quite sure it can't cure them (but OpenOffice macroviruses are quite rare, aren't they? There were some proof-of-concept samples, but no wide-spread infections like in MS Office).


Offline George Yves

  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 4095
  • Help you I can
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #2 on: June 27, 2007, 09:40:44 AM »
The main threat to my computer is the viruses that I can get with different office documents.

I think that's not true for a long time already. The main threats are completely different these days.
I mean main but not single.  :)

Quote
1) Can Avast Home detect and cure Microsoft Office files of virus infections?
2) Can Avast Home detect and cure OpenOffice.org files of virus infections?

Don't know what this should mean; what's "virus infection" here?
I ask those questions because I never saw Avast curing infected files - usually it suggests to rename or move them.

Quote
4) Can Avast Home detect and cure OpenOffice.org files of macrovirus infections? (OpenOffice.org is using its own version of macro-language.)

Don't know about detection, but I'm quite sure it can't cure them [...].
Oh, I'm a member of one of OpenOffice.org Communities (Russian release; http://community.i-rs.ru ), and it's a very disappointing news for me.
May the FOSS be with you!

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #3 on: June 27, 2007, 10:27:45 AM »
OpenOffice documents are basically renamed ZIP archives (Deflate) with data content (mostly XML files) packed in it. So basically you just have to unpack the Deflated container to see it's content...
Visit my webpage Angry Sheep Blog

Offline George Yves

  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 4095
  • Help you I can
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #4 on: June 27, 2007, 12:05:29 PM »
OpenOffice documents are basically renamed ZIP archives (Deflate) with data content (mostly XML files) packed in it. So basically you just have to unpack the Deflated container to see it's content...

Don't you find it to be a long and annoying way?
May the FOSS be with you!

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11850
    • AVAST Software
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #5 on: June 27, 2007, 02:31:58 PM »
The main threat to my computer is the viruses that I can get with different office documents.

I think that's not true for a long time already. The main threats are completely different these days.
I mean main but not single.  :)

That's also what I meant - macroviruses are quite a marginal threat today, not one of the main ones (IMHO).

I ask those questions because I never saw Avast curing infected files - usually it suggests to rename or move them.

File infectors (i.e. viruses that modify files as their means of spreading) are quite rare today. Nearly all malware you see today are various backdoors/trojans/worms; there's no "curing" for their files - to get rid of them, their files are (more or less simply) deleted.

OpenOffice documents are basically renamed ZIP archives (Deflate) with data content (mostly XML files) packed in it. So basically you just have to unpack the Deflated container to see it's content...

Well, I admit I don't know anything about OpenOffice format... unpacking ZIP archives certainly isn't a problems (and avast! would do that, no matter if it's renamed or not). However, to remove macroviruses from them would probably mean understanding the particular XML format and modifying it somehow (but as I said, I don't know the format, so it's a pure speculation from me).
Right now, avast! certaily can remove files from those ZIP archives, but I'm not sure if it's the best way here.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #6 on: June 27, 2007, 11:16:47 PM »
Just use WinZIP/WinRAR/WinACE/7-zip on it and see the content ;)

http://mihd.net/6w2pv9
Visit my webpage Angry Sheep Blog

Offline George Yves

  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 4095
  • Help you I can
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #7 on: June 28, 2007, 08:56:59 AM »
Just use WinZIP/WinRAR/WinACE/7-zip on it and see the content ;)

http://mihd.net/6w2pv9

 ???
May the FOSS be with you!

Offline chocholo

  • Poster
  • *
  • Posts: 645
  • BSC, GSC, MCP
    • Avast
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #8 on: June 28, 2007, 10:02:41 AM »
Just use WinZIP/WinRAR/WinACE/7-zip on it and see the content ;)

http://mihd.net/6w2pv9

 ???
My guess is that it was meant for Igor...

Offline George Yves

  • Avast Überevangelist
  • Massive Poster
  • *****
  • Posts: 4095
  • Help you I can
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #9 on: June 28, 2007, 04:47:53 PM »
OpenOffice documents are basically renamed ZIP archives (Deflate) with data content (mostly XML files) packed in it. So basically you just have to unpack the Deflated container to see it's content...

And can "today's" Avast Home check files inside the OOo container? I ask this question not just to have fun: OpenOffice.org has almost 10% of the world market of office suits (it's a big quota!), and Avast could be a leader of antivirus software for OpenDocument Format.

May the FOSS be with you!

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #10 on: June 29, 2007, 12:32:03 AM »
On-access, probably not. But if you use right-click context menu scan option on selected OOo file or during on-demand scan (assuming Archive scanning is enabled), then yes. Though i'm not aware of any kind of malicious content that could (yet) hide into OOo documents. Until then, i don't think there is really any need to invest time and resources into protecting something (yet) not exploited (exploitable?).
When it'll be exploited, they'll certanly provide protection for that infection vector.
Visit my webpage Angry Sheep Blog

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #11 on: June 29, 2007, 02:57:15 PM »
And can "today's" Avast Home check files inside the OOo container?
If you use Standard Shield High sensitivity level, yes.
If you set Normal level and add the OpenOffice extensions to the list of the extensions to be scanned, yes again.
The best things in life are free.

Offline RejZoR

  • Polymorphic Sheep
  • Serious Graphoman
  • *****
  • Posts: 9406
  • We are supersheep, resistance is futile!
    • RejZoR's Flock of Sheep
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #12 on: June 29, 2007, 09:10:44 PM »
Well, avast! might scan them, but i'm not sure if it'll actually unpack them... Because by default it doesn't unpack on-accesss scanned files...
Visit my webpage Angry Sheep Blog

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: Avast and viruses in MSO and OpenOffice.org
« Reply #13 on: June 29, 2007, 09:49:34 PM »
Well, avast! might scan them, but i'm not sure if it'll actually unpack them... Because by default it doesn't unpack on-accesss scanned files...
You're right. I'm not thinking on unpacking and then scanning but just scanning.
The best things in life are free.