Outlook Forms run VBScript even when macros are disabled

Topic

New Reply

My question, though, is whether this constitutes a security problem. I’m hoping one of you Office experts can help me out. This morning, Richard Chirg
[See the full post at: Outlook Forms run VBScript even when macros are disabled]

1 user thanked author for this post.

Reply | Quote

Replies

I remember that VBScript in forms used separate settings. The forms has to be published for VBScript to run by default. There used to be a separate macro warning for VBScript that was disabled by default in the “Outlook email security update” in 2000.

1 user thanked author for this post.

Reply | Quote

yuhong wrote:

The forms has to be published for VBScript to run by default.

That’s my recollection, too, although I never use Outlook these days – and rarely used forms, even back in my Outlook days.

If that’s the case, Microsoft’s right, this isn’t a big deal.

Reply | Quote

You would have to export the form, get another user to install both files (.frm and .frx) and generate a self signed certificate for themselves.

Or go to the expense of buying a cert, for distribution – which is not as hard for malware authors as it used to be.

Either way, I see no way for a drive by infection using this method.

~ Group "Weekend" ~

1 user thanked author for this post.

woody

Reply | Quote

Most good AV programs do a good job at scanning for potentially malicious code in vbscript programs, and many AV programs will ask you if you want to allow the vbscript to run.

Reply | Quote