OLE Documents - Standard Shield

Avast Free Antivirus / Premium Security
1

I have both MS Word and WordPerfect 10 Suite on my WinXP machine. I have the default Standand Shield configuration (sensitivity set on “High”), so “Scan OLE documents on open” is checked. Using the Advanced settings and checking “Show detailed info on performed action”, I can watch which files are scanned as I browse through files with Windows Explorer. I notice that while “.doc” (MS Word), “.qpw” (QuattroPro), and “.shw” (Corel Presentations) files are scanned, “.wpd” and “.wcm” files (WordPerfect) are NOT unless I manually add them to the “Scan files with these extensions” list. As far as I can tell, WordPerfect documents are registered as OLE objects on my machine.

Is there a problem here?

2

OLE documents are files containing other files in special ‘DOC’ format. WPD probably does not use such an format. You may check that with hex editor, the files start with D0CF11E0 (docfile, for hex geeks ;))

3

What about OpenOffice documents? They are renamed ZIP archives containing required data in them. Is avast! scanning these as ZIP archivs at all or they just don’t need to be scanned yet as they don’t pose any threat (yet)?

4

Thanks–I did not know that! I checked the file types I mentioned, and you’re right: only the “.wpd” and “.wcm” files did not start with D0CF11E0.