Didier Stevens (SANS ISC, Oct 14) found DWG files where the header pointer at offset 0x24 is zero but a brute-force search still finds an embedded OLE file with a VBA project. AutoCAD doesn't see orphaned VBA, so that code can't have executed when the drawing was opened (and AutoCAD needs a separate VBA install anyway). When oledump.py finds VBA in a DWG, also check the 0x24 pointer (or run his autocad.py with cut-bytes.py) before you treat the file as the infection vector. Update Oct 18: Stevens published the YARA rule he used (ISC diary 33434): $a = "AC10" at offset 0, uint32(0x24) == 0, the OLE header bytes D0 CF 11 E0 A1 B1 1A E1, and the ASCII string [Host Extender Info]. A VirusTotal retrohunt with it returned only 2 files: 09d4607941e458f6dbb6be17825641d863c0b37c185027984e137d8a67e919d8 and 3310c1a9bfe6115e49d8ac372cef5f460850da05138340107e66b958a6b5bca6.