OFF97: Macro Virus May Be Detected in WWINTL32.DLL

This article has been archived. It is offered "as is" and will no longer be updated.
Summary
When you use an anti-virus program to scan the files on the hard disk onyour computer or to intercept files that contain viruses, your anti-virusprogram may report that the Wwintl32.dll file is infected with a macrovirus. This article explains why the problem may occur.
More information

Macro Viruses vs. Traditional Viruses

In order to fully understand this situation, it is important to understandthe difference between a macro virus and a traditional virus.

What Is a Macro Virus?

A macro virus is written using a program's scripting or macro language. Itis designed to copy itself from one document to another, copying its codeinto new modules in each document it infects. A macro virus cannot infectfiles that are not documents because the macro virus requires a module inwhich to reside. For example, a macro virus can infect a Microsoft Worddocument or a Microsoft Excel workbook. It cannot infect a programexecutable or a .dll file, because modules cannot be created in these typesof files.

What Is a Traditional Virus?

A traditional virus is usually written in C, Assembler, or some other low-level programming language. It is designed to modify the code of otherprograms and executables (such as .dll files) that it encounters. Atraditional virus does not infect non-executable files such as documents(Microsoft Word documents, Microsoft Excel workbooks, bitmaps, and soforth).

Wwintl32.dll

When you install Microsoft Office 97 on your computer, Setup copies theWwintl32.dll file to the hard disk on the computer. The correct propertiesfor Wwintl32.dll are listed in the following tables.
   Microsoft Office 97 Standard Edition   --------------------------------------------------------   Location      : C:\Program Files\Microsoft Office\Office   File Size     : 1,157,904 bytes   Created Date  : Thursday, November 21, 1996   Modified Date : Thursday, November 21, 1996   Microsoft Office 97 Professional Edition   --------------------------------------------------------   Location      : C:\Program Files\Microsoft Office\Office   File Size     : 1,157,904 bytes   Created Date  : Sunday, November 17, 1996   Modified Date : Sunday, November 17, 1996   Microsoft Office 97, Service Release 1 (SR-1) Patch   --------------------------------------------------------   Location      : C:\Program Files\Microsoft Office\Office   File Size     : 1,158,416 bytes   Modified Date : Wednesday, August 13, 1997   Microsoft Office 97 Small Business Edition   --------------------------------------------------------   Location      : C:\Program Files\Microsoft Office\Office   File Size     : 1,157,904 bytes   Created Date  : Monday, December 09, 1996   Modified Date : Monday, December 09, 1996				

Anti-Virus Program Detected a Macro Virus in Wwintl32.dll.

An executable file such as a .dll file cannot be infected by a macro viruslike Bandung or Concept. If your anti-virus program reports thatWwintl32.dll is infected with a macro virus, you may safely ignore thewarning.

However, you may still want to compare the properties of the Wwintl32.dllfile in your C:\Program Files\Microsoft Office\Office folder with theproperties listed in the preceding table. If the properties match, yourWwintl32.dll file is clean; if the properties do not match, use the stepsin the "Method 2: Get a New Copy of the File" section to transfer a newcopy of the file from your Microsoft Office 97 compact disc to your harddisk.

My Anti-Virus Program Detected a Traditional Virus in Wwintl32.dll.

It is possible for a traditional virus to infect a .dll file such asWwintl32.dll. If your anti-virus program reports that Wwintl32.dll isinfected with such a virus, use either of the following methods:

Method 1: Disinfect the File

Use your anti-virus program to attempt to disinfect the infected file. Inaddition, you should scan your entire system for other infected files.

Method 2: Get a New Copy of the File

Transfer a new copy of the file from your Microsoft Office 97 compact discto the hard disk. To do this, follow these steps:
  1. On your desktop, double-click My Computer to start Windows Explorer.
  2. Go to the C:\Program Files\Microsoft Office\Office folder.
  3. Select the Wwintl32.dll file. On the File menu, click Delete. When you are prompted to confirm the deletion of the file, click Yes.
  4. Place your Microsoft Office 97 compact disc in the CD-ROM drive.
  5. In Windows Explorer, locate the Office folder on your Microsoft Office 97 compact disc.
  6. Select the Wwintl32.dll file. On the Edit menu, click Copy.
  7. Go to the C:\Program Files\Microsoft Office\Office folder.
  8. On the Edit menu, click Paste.
A new copy of the file will be copied from your Microsoft Office 97 compactdisc to your hard disk. Empty your Windows Recycle Bin to permanentlydelete the damaged (or infected) file.

When Might I Be Warned About a Macro Virus in Wwintl32.dll?

If your anti-virus program is designed to scan for macro viruses, you maybe warned of a macro virus in Wwintl32.dll in the following situations:
  • When you are running the Microsoft Office 97 Setup program

  • When you start Microsoft Word 97

  • When you open a document in Microsoft Word 97

Could I Have Received a Virus from my Microsoft Office 97 Compact Disc orFloppy Disks?

The compact disc and floppy disk editions of Microsoft Office 97 aremanufactured in a specially engineered and monitored environment thatguarantees that no viruses are present.

Why Anti-Virus Programs May Detect a Macro Virus in Wwintl32.dll

One of the functions of the Word 97 WordBasic to VBA converter is to scanand remove macro viruses, such as Bandung and Concept, from Microsoft Word7.0 documents when they are converted. As part of the virus recognitionsystem, a number of signatures (text strings) are built into Wwintl32.dll.These signatures are used to recognize macro viruses.

An anti-virus program designed to scan for macro viruses may detect thesesignatures inside the Wwintl32.dll file. If this occurs, the anti-virusprogram may incorrectly assume that Wwintl32.dll is infected with a macrovirus. You may safely ignore any warning that Wwintl32.dll is infected witha macro virus.

If other, nonmacro viruses are detected in Wwintl32.dll, the file may infact be infected with a virus. In this case, use the steps shown above toeither disinfect or remove and reinstall Wwintl32.dll. You should alsoallow your anti-virus program to disinfect any other infected files foundon your hard disk.
97 OFF97 WORD97 bandung concept macro virus "ibm antivirus" "norton mcafee f-prot dr. solomon sr1
Properties

Article ID: 163275 - Last Review: 01/09/2015 06:20:36 - Revision: 3.0

Microsoft Office 97 Standard Edition, Microsoft Word 97 Standard Edition

  • kbnosurvey kbarchive KB163275
Feedback