How to deal with a macro virus in Word 2000 or Word 2002

The first macro virus was discovered in the summer of 1995. Since that time, numerous other macro viruses have appeared. This article describes what to do if you think you have a Word macro virus.

The following are a few of the symptoms a Word macro virus may cause or exhibit.

NOTE: A macro virus may cause one or more of these symptoms (as well as other symptoms not listed).

• When you try to save a document, Word only lets you save the document as a Document Template (*.dot).
• The icon for a Word document looks like a template rather than a document.
• When you point to Macro on the Tools menu and then click Macros, nothing happens.
• The menu items of Macro or Customize no longer appear on the Tools menu.
• New macros appear in the list of macros (on the Tools menu, point to Macro and click Macros). For example, macros with names such as AutoOpen, AutoNew, AutoExec, or FileSaveAs may appear; if you already had macros by these names, their contents may have been changed by the macro virus, or your macro may have been renamed.
• Unusual or unexpected messages appear when you open a Word document or template.

For a long-term solution to macro viruses, install antivirus software that is specifically designed to detect macro viruses. For additional information about antivirus software, click the article number below to view the article in the Microsoft Knowledge Base:

For additional information about methods available to reduce the risks of infecting Microsoft Word documents or templates with a macro virus, please see the following article in the Microsoft Knowledge Base: Use the following workarounds as a temporary solution only.

Method 1: Press SHIFT When You Open a File

If you do not have any of the symptoms described in this article when you start Word, and you do not want to be affected by a macro virus, hold down the SHIFT key when you open a file that you suspect may be infected by a macro virus.

NOTE: Pressing and holding SHIFT when you open a document or template (or pressing SHIFT when you start Word) prevents any auto macros from being run; if a macro virus is present, it will not be loaded.

Method 2: Delete the Macro and Recover the Document

If you have experienced the symptoms listed in this article, or if you suspect that you have a macro virus that is not described here, use the following steps to remove the macros and correct the affected documents. (Remember, this is only a temporary solution; because new macros viruses are possible, these steps may not work.)

1. Close Word.
2. Rename Normal.dot. For example, rename Normal.dot to Normal.old.
3. Make a copy of the affected document or template.
4. Start Word.
5. On the File menu, click Open.
6. Go to the folder containing the affected file.
7. Click to select the affected file.
8. Press and hold the SHIFT key and click Open. Continue to hold the SHIFT key until the affected file is open in Word.
   
   NOTE: Holding the SHIFT key while opening a file prevents auto macros from running.
9. To remove a suspected macro virus, follow these steps:
   1. On the Tools menu, point to Macro, and then click Macros.
      
      NOTE: If nothing happens when you click Macros, try a different method listed in this article.
   2. In the Macros in list, click All active templates and documents.
   3. Click to select the suspected macro and click Delete. Click Yes when asked whether you want to delete the macro.
   4. Repeat step c for all suspect macros.
   5. Click Cancel to close the Macros dialog box.
10. To recover the text of an infected document, follow these steps:
    1. Press CTRL+END to move the insertion point to the bottom of the document.
    2. Press CTRL+SHIFT+HOME to select the entire document except the last paragraph mark.
    3. On the Edit menu, click Copy.
    4. On the File menu, click New. Select the template you want to use, and click OK.
    5. On the Edit menu, click Paste.
    6. Repeat step 9 to ensure that the virus-containing macros have not again replicated.
    7. Save your recovered document.
11. Repeat these steps for any document that you suspect might contain a macro virus.

Method 3: Use the Organizer

Use the Organizer to "clean up" a suspected macro virus. Remember that if other files are opened after you open the infected file, the other files most likely are infected, as well.

NOTE: Do not use this method if your global (Normal.dot) template contains macros that you may want to keep.

1. Close all documents except a new blank document.
   
   NOTE: If an infected document is open, it can easily re-infect your global (Normal.dot) template.
2. On the Tools menu, click Templates and Add-Ins, and then click Organizer.
3. On one side of the Organizer, open the global (Normal.dot) template.
4. Click the Macro Project Items tab, and then rename or delete each of the following macros.
   
   NOTE: If other macros are also listed, rename or delete them also.
   • NewMacros
   • AutoClose
   • AutoExec
   • AutoOpen
   • FileExit
   • FileNew
   • FileOpen
   • FileSave
   • FileSaveAs
   • Macros
   • ToolsMacro
   
   
5. Click Close File to close the global (Normal.dot) template. When you are prompted to save the changes to the file, click Yes.
6. Click Open File and open the document that contains the suspect virus macros.
7. Repeat step 4 and rename or delete each of the suspect virus macros.
8. Click Close File to close the document. When you are prompted to save the changes to the file, click Yes.
9. Click Close to close the Organizer.

Method 4: Insert the File into a New Document

NOTE: Before you use this method, rename your global (Normal.dot) template.

Follow these steps to insert a suspected macro-virus-infected document into a new file:

1. Start Word with a new blank document.
   
   NOTE: If Macro, Customize, or Templates and Add-ins is not on the Tools menu, then use a different method.
2. On the Insert menu, click File.
3. Go to the folder containing the affected file.
4. Click to select the affected file and then click Open.
5. To check for any macros in the new document (there should not be any listed), follow these steps:
   1. On the Tools menu, point to Macro and click Macros.
   2. In the Macros available box, select All active templates and documents.
   3. Under Macro name, there should not be any macros listed.
      
      NOTE: If macros are listed, use a different method.
   4. Click Cancel.
6. Save the new document with a different file name, and then delete the infected file.

A macro virus is a program that is written in the macro language of a application, for example, Microsoft Word. A macro virus propagates itself among files and can harm your Word documents and templates or your computer's operating system.

Word macro viruses do not travel independently over the Internet or any other media (for example, a disk or network connection); they can only be transferred when a document or template is opened that contains the macro virus.

Macro viruses also cannot be transferred by electronic mail (e-mail), unless an affected document is attached to the e-mail message, and the recipient opens the document (attachment).

To view frequently asked questions about Word macro viruses, please see the following article in the Microsoft Knowledge Base: