Article ID: 291824 - View products that this article applies to.
This article was previously published under Q291824
This article describes what macro viruses are, what to do if you think your computer might have a Word macro virus, and how to ensure that your documents do not become infected with a macro virus.
The first macro virus was discovered in the summer of 1995. Since that time, other macro viruses have appeared.
A macro virus is a malicious program that is written by using the macro language of a program such as Word. The virus propagates itself among data files and can harm your files or your computer's operating system.
Word macro viruses do not travel freely over the Internet or any other media; they can only be transferred when a user opens a document or template that contains the macro virus.
Macro viruses cannot be transferred by e-mail, unless an affected document is embedded in the e-mail message and the receiver opens the document.
Symptoms of a Macro VirusThe following are some symptoms of Word macro viruses that are known to affect Word and Word documents:
Install an antivirus programFor a long-term solution to macro viruses, install antivirus software that is specifically designed to detect macro viruses. For additional information about antivirus software vendors, including software capable of detecting and preventing macro viruses, click the following article number to view the article in the Microsoft Knowledge Base:
49500Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
(http://support.microsoft.com/kb/49500/ )List of antivirus software vendors
What to do when you think your computer might have a macro virusUse the following methods as temporary solutions only when you think your computer might have a macro virus.
Method 1: Disable the macros and copy the text into a new documentIf you do not experience any of the symptoms described earlier in this article, but you do not want to be affected by a macro virus, hold down the SHIFT key when you open a file that might be infected by a macro virus. Pressing SHIFT prevents any Word Auto macros from running; if a macro virus is present, it is not loaded.
Method 2: Delete the macro and recover the documentIf you experience the symptoms described earlier in this article, or if you suspect that you have a macro virus that is not described in this article, follow these steps to delete the suspect macro and to correct affected document.
Note This is only a temporary solution; because new macros are being created, these steps may not work on new macros.
Method 3: Use the Organizer to temporarily clean up a macro virusUse the Organizer to clean up the macro virus. Keep in mind that if you open other files after you open the infected file, these files most likely are infected as well.
To remove the virus from the Normal template, follow these steps:
If a file is infected, use the same method as in steps 1 through 5, but remove the macros from both the Normal template and also from the infected document (template) while in the Organizer. When you are finished, press and hold SHIFT while you click Save All on the File menu, and then move to the next file. Keep in mind that every time you open an infected file, it infects your Normal template, so you must repeatedly remove the macros from the Normal template.
Method 4: Insert the infected file into a new documentThis method is particularly useful with the "CAP" macro virus, which removes Macro and Customize from the Tools menu.
Note In this situation, Templates and Add-Ins on the Tools menu may not work.
Method 5: Use the RTF workaroundA. Delete the Normal (Global Template) file.
This is an issue with a macro being saved to your Normal template.
The following steps remove the Normal template. Be aware that any special formatting set in the Normal template will be removed, and the template will be reset to the default settings.
B. Disable the macros.
Open the virus files, and then disable the macros on each file as you receive the Macro warning. If you don't get a warning, you need to turn on macro warnings. To do this, follow these steps:
C. Resave the existing files.
After you have saved the file as an RTF file, save the document in the Word (.doc) format again and overwrite the file that has the Macro virus or save the document as a new file, and then delete the old file that contains the virus. After you resave the new file in .doc format, you can delete the RTF file. Keep in mind that some formatting elements may not be retained in the transition from the Word (.doc) format to RTF.
Article ID: 291824 - Last Review: October 6, 2011 - Revision: 9.0
Contact us for more help