Back to Top

Macro Killer - Stop 100% of Cryptolocker Word viruses

Stop 100% of Ransomware Macro Viruses

Lockey. Cryotlocker. Ransomware. Sent via Word Macros and opened by unsuspecting users. The Ransomware makers are significantly cranking up the volume, to as much as 100 times normal volumes. 

Word Macro Killer removes 100% of Viruses from Word docs and converts them to harmless Word.docx formats which cannot contain a macro virus.

  • User training is almost worthless because users will open anything!
  • Anti-Virus solutions help, but all they need to do is miss one macro virus to create a disaster
  • Runs on Microsoft Exchange Servers or IBM Domino Servers

 

How it Works

  • Strips Macros out of Word and Excel documents
  • Users receive clean, virus free documents
  • Using the 100% safe Word.DOCX and Excel.XLSX formats
  • Users CANNOT infect themselves
  • Original Documents saved in Password protected ZIP file
  • Whitelists skip processing for trusted senders

 

Pricing

  • Protect 40 users for $450 annually.
  • Protect 100 users for $1,000 annually.
  • Protect 1,000 users for $6,500 annually.

Volume pricing available for 5,000 users or more.

Try It For Free

Setup time is 5 minutes per server.
Exchange Transport Agent
Domino Server Addin

To start a trial:

Contact Allison Cote   (978) 635-1335

 

 

Here is how we test it on your system

 

Here are two files, a Word .DOC and an Excel .XLS both containing a harmless macro that we use to test the installations:

 

When these files are sent to an Exchange server running MacroKiller transport agent, they arrive in the recipient mailbox stripped of their macros and converted to the harmless Word .DOCX and the harmless Excel .XLSX formats:

 

 

 

Other Features

Whitelist a Sender or Domain: This will never process messages from this Sender or Domain

Testing Configuration: You can set MacroKiller to run for selected users during a test by listing "Included Recipients".

In production, you can always exclude a recipient's messages from being converted via "Excluded Recipients".

 

 

Word and Excel Document Handling

The table below describes the various configuration options, as well as the default values that we use to set the initial configuration. It also shows optional settings. Our default settings is AlwaysConvertToMacroFree for valid Word documents, and to Reject or ZipWithPassword any Invalid Word documents, including those with no "words" (less than 50 characters).

 

File Extensions

.DOC, .DOCM, .DOCX, .RTF, .XLS, .XLSM, .XLSX

MacroRemoval

AlwaysConvertToMacroFree

[?, N, None, R, Remove, C, ConvertToMacroFree, A, AlwaysConvertToMacroFree, J, Reject]

PreserveOption 

ZipWithPassword 

This option allows you to save the original document in a password protected zip file.

[?, N, None, Z, ZipWithPassword, C, ConvertToMacroEnabled]

SafeViewingOption 

None

[?, N, None, P, ConvertToPdf, T, ConvertToTxt]

InvalidFileOption 

R

[?, E, ChangeExtension, D, Delete, Z, ZipWithPassword, R (R=Reject]

FilePassword 

Caution

 

ZipFileName 

PossibleMalware.zip

 

MinimumCharacters 

50

Word docs with no words will be handled as InvalidFileOption (Reject)

CustomRejectMessage 

Maysoft.com DOES NOT accept Word files with macros

This will be used only if messages are "Rejected"

ActivityToLog 

Errors, MacroRemoval, PreserveOption, SafeViewingOption, Zip, MinimumCharacters, InvalidFileOption, Reject

These are logged to the Event Viewer

Recipients

These options allow you to process for selected names, or to exclude selected names

RecipientLookup 

Disabled

[0ptions= ?, D, Disabled, I, Included, E, Excluded] 

IncludedRecipients

 # Included means MacroKiller only converts and processes Word and Excel docs for named individuals. 

ExcludedRecipients

 # Excluded means MacroKiller does NOT convert or process Word and Excel docs for named individuals. 

Enable WhiteList

Senders

[? D, Disabled, S, Senders]

WhiteListSenders

 

frank@maysoft.com">mailto:frank@maysoft.com">frank@maysoft.com, allison@maysoft.com

WhiteListDomains

 

maysoft.com, acme.com

 

For the Exchange Administrator

Below is a Powershell session where MacroKiller can be installed, uninstalled and reconfigured. We have added some new commands, like Get-MacroKiller which shows the current configuration. There is also a command to disable it, which is useful during testing:

Set-MacroKiller -Enabled $false

and to re-enable it:

Set-MacroKiller -Enabled $true

 

You can also run this command to disable the Transport Agent completely:

Disable-TransportAgent "MacroKiller"

 

When installed, it is always the last Priority in the list of Transport Agents:

 

 

Event Viewer

When MacroKiller processes a document, the action is recorded in the Event Viewer: