The first macro virus was discovered in the summer of 1995.
Since that time, numerous other macro viruses have appeared. This article
describes what to do if you think you have a Word macro virus.
following are a few of the symptoms a Word macro virus may cause or
: A macro virus may cause one or more of these symptoms (as well
as other symptoms not listed).
- When you try to save a document, Word only lets you save
the document as a Document Template (*.dot).
- The icon for a Word document looks like a template rather
than a document.
- When you point to Macro on the Tools menu and then click Macros, nothing happens.
- The menu items of Macro or Customize no longer appear on the Tools menu.
- New macros appear in the list of macros (on the Tools menu, point to Macro and click Macros). For example, macros with names such as AutoOpen, AutoNew,
AutoExec, or FileSaveAs may appear; if you already had macros by these names,
their contents may have been changed by the macro virus, or your macro may have
- Unusual or unexpected messages appear when you open a Word
document or template.
For a long-term solution to macro viruses, install
antivirus software that is specifically designed to detect macro viruses.
For additional information about antivirus software, click
the article number below to view the article in the Microsoft Knowledge Base:
List of Antivirus Software Vendors
For additional information about methods available to
reduce the risks of infecting Microsoft Word documents or templates with a
macro virus, please see the following article in the Microsoft Knowledge Base:
WD: How to Reduce the Chances of Macro Virus Infection
Use the following workarounds as a temporary solution only.
Method 1: Press SHIFT When You Open a File
If you do not have any of the symptoms described in this article
when you start Word, and you do not want to be affected by a macro virus, hold
down the SHIFT key when you open a file that you suspect may be infected by a
: Pressing and holding SHIFT when you open a document or template
(or pressing SHIFT when you start Word) prevents any auto macros from being
run; if a macro virus is present, it will not be loaded.
Method 2: Delete the Macro and Recover the Document
If you have experienced the symptoms listed in this article, or
if you suspect that you have a macro virus that is not described here, use the
following steps to remove the macros and correct the affected documents.
(Remember, this is only a temporary solution; because new macros viruses are
possible, these steps may not work.)
- Close Word.
- Rename Normal.dot. For example, rename Normal.dot to
- Make a copy of the affected document or
- Start Word.
- On the File menu, click Open.
- Go to the folder containing the affected file.
- Click to select the affected file.
- Press and hold the SHIFT key and click Open. Continue to hold the SHIFT key until the affected file is open
NOTE: Holding the SHIFT key while opening a file prevents auto macros
- To remove a suspected macro virus, follow these steps:
- On the Tools menu, point to Macro, and then click Macros.
NOTE: If nothing happens when you click Macros, try a different method listed in this article.
- In the Macros in list, click All active templates and documents.
- Click to select the suspected macro and click Delete. Click Yes when asked whether you want to delete the macro.
- Repeat step c for all suspect macros.
- Click Cancel to close the Macros dialog box.
- To recover the text of an infected document, follow these
- Press CTRL+END to move the insertion point to the
bottom of the document.
- Press CTRL+SHIFT+HOME to select the entire document
except the last paragraph mark.
- On the Edit menu, click Copy.
- On the File menu, click New. Select the template you want to use, and click OK.
- On the Edit menu, click Paste.
- Repeat step 9 to ensure that the virus-containing
macros have not again replicated.
- Save your recovered document.
- Repeat these steps for any document that you suspect might
contain a macro virus.
Method 3: Use the Organizer
Use the Organizer to "clean up" a suspected macro virus. Remember
that if other files are opened after you open the infected file, the other
files most likely are infected, as well.NOTE
: Do not use this method if your global (Normal.dot) template
contains macros that you may want to keep.
- Close all documents except a new blank document.
NOTE: If an infected document is open, it can easily re-infect your
global (Normal.dot) template.
- On the Tools menu, click Templates and Add-Ins, and then click Organizer.
- On one side of the Organizer, open the global (Normal.dot)
- Click the Macro Project Items tab, and then rename or delete each of the following
NOTE: If other macros are also listed, rename or delete them also.
- Click Close File to close the global (Normal.dot) template. When you are prompted
to save the changes to the file, click Yes.
- Click Open File and open the document that contains the suspect virus
- Repeat step 4 and rename or delete each of the suspect
- Click Close File to close the document. When you are prompted to save the changes
to the file, click Yes.
- Click Close to close the Organizer.
Method 4: Insert the File into a New DocumentNOTE
: Before you use this method, rename your global (Normal.dot)
Follow these steps to insert a suspected
macro-virus-infected document into a new file:
- Start Word with a new blank document.
NOTE: If Macro, Customize, or Templates and Add-ins is not on the Tools menu, then use a different method.
- On the Insert menu, click File.
- Go to the folder containing the affected file.
- Click to select the affected file and then click Open.
- To check for any macros in the new document (there should
not be any listed), follow these steps:
- On the Tools menu, point to Macro and click Macros.
- In the Macros available box, select All active templates and documents.
- Under Macro name, there should not be any macros listed.
NOTE: If macros are listed, use a different method.
- Click Cancel.
- Save the new document with a different file name, and then
delete the infected file.
A macro virus is a program that is written in the macro
language of a application, for example, Microsoft Word. A macro virus
propagates itself among files and can harm your Word documents and templates or
your computer's operating system.
Word macro viruses do not travel
independently over the Internet or any other media (for example, a disk or
network connection); they can only be transferred when a document or template
is opened that contains the macro virus.
Macro viruses also cannot be
transferred by electronic mail (e-mail), unless an affected document is
attached to the e-mail message, and the recipient opens the document
To view frequently asked questions about Word macro
viruses, please see the following article in the Microsoft Knowledge Base:
WD: Frequently Asked Questions About Word Macro Viruses
Article ID: 211800 - Last Review: September 1, 2006 - Revision: 3.1
- Microsoft Word 2002
- Microsoft Word 2000
|kbtshoot kbfaq kbprb kbvirus KB211800|