A. Macro viruses
are computer viruses that use an application's own macro programming language
to distribute themselves. These macros have the potential to inflict damage to
the document or to other computer software. These macro viruses can infect Word
files, as well as any other application that uses a programming language.
Unlike previous viruses, macro viruses do not infect programs; they
infect documents and templates. Opening a document or template that contains a
macro virus will infect your system and the virus will spread to other
documents and templates you may have on your system. Some macro viruses are not
harmful, but they can be annoying. However, there are some macro viruses that
can be very destructive. Also, Word macro viruses can be spread across
platforms; for example, the macro virus can infect files on the Windows
platform, as well as files on the Macintosh platform.
Q. How can I determine whether I have a Word macro virus?
A. It is not always easy to determine whether you have a macro
virus. If you are familiar with the Word macros you have on your system, you
can look through the various macros for ones that you do not recognize. It is
possible that one, or more, of them are part of a macro virus that has infected
your system. Some examples of these type of macro names are: AAAZAO, AAAZFS,
AutoOpen, FileSaveAs, and PayLoad.
Some other things to look for
are:
Unexplainable behavior on your system; for example, you
may be prompted for a password on a file that you know does not contain a
password or your document may be unexpectedly saved as a template.
Unusual error messages, for example:
This one's for you, Bosco.
-or-
ROBERTA TI AMO!
-or-
Just to prove another point.
-or-
And finally I would like to say: STOP ALL FRENCH NUCLEAR TESTING
IN THE PACIFIC!
Unusual changes to your documents; for example, the
macro virus may randomly move three words then insert the word "WAZZU" at
random locations.
Q. How did I get the macro virus?
A. You worked
with a file that was infected with a Word macro virus. An infected file can be
obtained any of the following sources
disks
networks
email attachments
modems
the Internet
You may want to obtain a current macro virus detection program to
prevent obtaining future macro viruses and to get rid of your existing macro
viruses.
Q. If I have a Word macro virus on my system, can I
accidentally spread the macro virus to others?
A. Yes. You can
spread a virus if you share files with others. A macro virus embeds itself into
your file and can, most commonly, spread to others if you share files from a
disk, network drive, external drive media, or any of a number of other file
transfer methods. Files exchanged over the Internet can also spread the macro
virus to others.
Q. Can I get software that will prevent me from getting a
Word macro virus in the future?
A. Microsoft Technical Support
recommends that you use a third-party company that provides Word macro virus
detection and protection. There are many companies that provide this
service. For additional information about third-party vendors of
virus protection software, click the following article number to view the
article in the Microsoft Knowledge Base:
49500
(http://support.microsoft.com/kb/49500/
)
List of Antivirus Software Vendors
Q. Are there other ways that I can get a Word macro virus
off my system?
A. Yes, there are some temporary workarounds that you
can use to clean a macro virus off your system. These methods will not prevent
the future infection of your system.
Q. I have Word and it always prompts me about the file I am
opening containing macros. I don't share files or disks with others, I don't
even download files from the Internet. Can I prevent Word from prompting me all
the time with this warning?
A. Yes, you can disable the macro virus
warning, although Microsoft does not recommend it. To disable the macro virus
warning:
On the Tools menu, click
Options (Windows) or Preferences
(Macintosh)
Click the General tab.
Click to clear the Macro virus
protection check box.
Click OK.
This macro virus warning will not appear anymore.
Q. Word provides the macro virus warning when I open files
that may contain macros, except when I open files from my templates folder. Why
the difference?
A. Word assumes that you know the files that you
have saved to your templates folder. It also assumes that you know these files
are safe. With this assumption, Word does not provide the macro virus warning
when it detects macros contained in files from your template folders. The
template folders that Word uses are defined by the User Templates and Workgroup
Templates settings as specified in the File Locations tab in the Options dialog
box.
Q. My version of Word doesn't have the built-in macro virus
warning feature. Does Microsoft provide a tool that will give me that
functionality?
A. For Microsoft Word versions prior to Word 7.0a,
Microsoft provides the ScanProt tool for the following versions of Word:
Microsoft Word for Windows 6.0, 6.0a, 6.0c
Microsoft Word for Windows 95, version 7.0
Microsoft Word for Windows NT, version 6.0
Microsoft Word for the Macintosh, versions 6.0, 6.0.1,
6.0.1a
The Microsoft Virus Protection Tool (ScanProt) scans only
for the Concept virus and will remove it from your system. It does not detect
nor remove other macro viruses from your system. However, it does install its
own macros to warn you when you are opening a file that contains macros.
For
additional information about how to obtain the Word ScanProt tool, click the
following article numbers to view the articles in the Microsoft Knowledge Base:
133895
(http://support.microsoft.com/kb/133895/
)
WD6X: Macro Virus Protection Tool for the Macintosh (MW1222)
Note that Microsoft does not provide a ScanProt tool
for Word versions earlier than Word 6.0. For complete macro virus protection
for these versions of Word, contact a third-party Virus protection software
vendor.
Q. Are there macro viruses that affect other Microsoft
Office applications?
A. Yes. For more information on macro viruses
for the other Microsoft Office programs:
For additional information about macro
viruses in Microsoft Excel, click the following article number to view the
article in the Microsoft Knowledge Base:
154131
(http://support.microsoft.com/kb/154131/
)
XL: Q&A about Excel Macro/Laroux Macro Virus
This article was written about products for which Microsoft no longer offers support. Therefore, this article is offered "as is" and will no longer be updated.
Back to the top
