How can I find out what a macro does without exposing myself to it?

Question

I have been given two different Microsoft Word document that my virus scanner has warned me contains macros. These should be simple text files, and the person who sent them doesn't even know what a macro is; they may be a mistake on his part, but they might be signs of a malicious infection. My installation of OpenOffice.org is set not to load macros at all, as I rarely use them, so I am not concerned about the security of my system. What I would like to be able to do is find out what those macros do without exposing my system to any malicious intent from those macros, in order to tell the person who sent me the documents whether or not he is spreading an infection.

Answer 1

Just open the document without activating macros, then open the code editor to see what they do.

Answer 2

Two possibilities. Get yourself a free copy of VMWare player and install Windows and MS Office within it. Then load up the document and let the macros run.

The other possibility. I think you can load the doc into MS Word and automatically disable macros, but the macro is still there so you can view it with Word itself.

Answer 3

I just ran a test. I opened Word (2007) and:

1. created a simple macro and saved with the document as a "Word macro enabled document (.docm)"
2. went into the security settings (Office Button\Word Options\Trust Center\Trust Center Settings\Macros Settings) and clicked the "Disable all macros with notification" radio button which will prevent macros from running unless you click the button to allow them to run.
3. Opened the *.docm document anfd the macro didn't run, but I was able to go to the "View" tab on the ribbon control and click the Macros button and view Macros and then edit the macro to open a VBA IDE to see the macro code.

This all assumes you are using Word 2007, although I'd expect the same capability in the last version or two of Word. I don't have Open Office on this box, but, I'd also expect it to have the same functionality.

Good Luck!