| 摘要 |
A computer-implemented method, apparatus, and computer readable medium for detecting publicly identified and publicly unidentified macro viruses within code ( 15 ) adapted for use on a digital computer ( 1 ). A detection module ( 17 ) analyzes the code ( 15 ) to determine whether the code ( 15 ) contains instructions causing a macro ( 8 ) to be moved to a global environment ( 13 ), and whether said code ( 15 ) also contains instructions causing the same macro ( 8 ) to be copied to a local document ( 11 ). When these two conditions are satisfied, detection module ( 17 ) declares that a macro virus is present within the code ( 8 ). A repair module ( 19 ) can be coupled to the detection module ( 17 ) and to the code ( 15 ) for deleting the code ( 15 ) when the detection module ( 17 ) declares that the code ( 15 ) contains a macro virus. If the user of the detection module ( 17 ) is willing to accept a slight penalty in terms of increased detection time, detection module ( 17 ) can be made to handle string concatenation operators, proxied variable names, program calls, and/or substituted object names.
|
