WD98: What to Do If You Have a Macro Virus

This article was previously published under Q181080
This article has been archived. It is offered "as is" and will no longer be updated.
The first macro virus was discovered in the summer of 1995. Since thattime, other macro viruses have appeared. This article describes what to doif you think you might have a Word macro virus, or if you want to ensurethat your documents never become infected with one.

The following are some symptoms of a Word macro virus that are known toaffect Word and Word documents:

  • When you try to save a document, Word only lets you save the document as a template.


  • The icon for the file looks like a template rather than a document.


  • When you open a document, a dialog box showing the number 1 appears.


  • The commands of Macro and Customize no longer appear on the Tools menu.


  • New macros appear in the list of macros. AutoOpen and FileSaveAs macros may also appear; if you already had macros by these names, their content may have been changed by the macro virus.


  • Unusual or unexpected messages appear when you open a Word document or template.

  • In Word 98 Macintosh Edition, there is a Macro Virus Protection option you can set (on the Tools menu, click Preferences and then click the General tab) that is designed to alert you if you open a file that contains macros, regardless of what the macros do. For a permanent solution, you must use anti-virus software that is specifically designed to detect and prevent macro viruses.
  • Word doesn't look for or remove any macro viruses from existing documents and templates. It will just warn you if the document you are opening contains macros. The warning lets you either open the document with the macros active or open it with the macros disabled. You should not open a document with the macros active unless you are absolutely sure that the document contains no harmful macro viruses.
  • Installing the Scanprot.dot protective macros is a good first step. However, it may not detect and eliminate newer viruses (and if it isn't installed or used correctly, it won't work). You should continue watching for symptoms and contact technical support again if the problems continue.
  • Commercial antivirus programs are also not guaranteed. You may think that because SAM or Virex doesn't find the virus, it's gone, and continue to suffer the infection. These programs are updated monthly, and you should contact the vendor to remain current (up-to-date).

For a long-term solution to macro viruses, install anti-virus software thatis specifically designed to detect macro viruses. For additional information about anti-virus software available from third-party vendors, click the article number below to view the article in the Microsoft Knowledge Base:
49500 List of Antivirus Software Vendors

The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.
Use the following workarounds as interim solutions only.

Method 1: Press SHIFT When You Open a File

If you do not have any of the symptoms described in this article, but youdo not want to be affected by a macro virus, hold down the SHIFT key whenyou open a file that might be affected by a macro virus. Pressing SHIFTwill prevent any Auto macros from being run; if a macro virus is present,it will not be loaded.

Method 2: Delete the Macro and Recover the Document

If you have experienced the symptoms listed in this article, or if yoususpect that you have a macro virus that is not described here, use thefollowing steps to remove the offending macros and correct affecteddocuments. (Remember, this is only a temporary solution; because newmacros are being created, these steps may not work):

  1. Close Word and move Normal to the Desktop.
  2. Make a back-up copy of an affected file.
  3. Open Word and on the File menu click Open.
  4. Navigate to the folder containing the affected file.
  5. Click to select the affected file.
  6. Press and hold the SHIFT key and click Open.

    Continue to hold the SHIFT key until the affected file is open in Word.

    NOTE: Holding the SHIFT key while opening a file keeps any of Words automatic macros from running.
  7. To remove suspect virus-containing macros, use the appropriate method for your version of Word:
    1. On the Tools menu, point to Macro, and then click Macros.
    2. In the Macros In list, click All Active Templates and documents.
    3. Select the suspect macro and click Delete. Click Yes when asked if you want to delete the macro.
    4. Repeat step c for all suspect macros.
    5. Click Cancel or x to close the Macro dialog box.
  8. To recover the text of an infected document:
    1. Select the entire document by pressing COMMAND+A, or by clicking Select All on the Edit menu.
    2. Delete the document's final paragraph mark from the selection by pressing SHIFT+LEFT ARROW.
    3. On the Edit menu, click Copy.
    4. On the File menu, click New. Select the template you want to use, and click OK.
    5. On the Edit menu, click Paste.
    6. Repeat step 7 to ensure that the virus containing macros have not again replicated.
    7. Save the document.
  9. Repeat these steps for any document suspect of containing a macro virus.
NOTE:If this method does not work, try Method 3.

Method 3: Use the Organizer to temporarily clean up macro viruses

Use the Organizer to clean up the macro virus. Keep in mind that ifother files were opened after the infected file, they most likely willbe infected as well.

To remove the virus from the Normal template:

  1. Close all documents. If an infected document is open, it can easily reinfect Normal.
  2. On the Tools menu, click Templates and Add-Ins, and click the Organizer button.
  3. Select the Macro Project Items tab and rename or delete all of the following macros:
          NewMacros      AutoClose      AutoExec      AutoOpen      FileExit      FileNew      FileOpen      FileSave      FileSaveAs      Macros      ToolsMacro
  4. Click Close.
  5. Press SHIFT and on the File menu, click Save All to save the template.
To remove the virus from infected documents:

If a file is infected, use the same method as above, but remove the macrosfrom both the Normal template and also from the infected document(template) while in the Organizer. When you are done, press SHIFT and onthe File menu and click Save All and move on to the next file. Keep inmind that every time you open an infected file it will infect your Normaltemplate, so you constantly need to remove the macros from the Normaltemplate.

Method 4: Insert It into a New Document

With this method, you will need to move Normal to the Desktop and then onthe Insert menu, click File to temporarily remove the macros. This methodis particularly useful with The macro virus called "CAP" that removesMacro and Customize from the Tools menu.

NOTE: In this situation, the Templates And Add-Ins on the Tools menucommand may not work.

  1. Close Word and move Normal to the Desktop.
  2. Open Word and verify that Macro and Customize are on the Tools menu.
  3. Open a new document and on the Insert menu, click File.
  4. Navigate to the folder containing the affected file.
  5. Click to select the affected file.
  6. Press and hold the SHIFT key and click Open.

    Continue to hold the SHIFT key until the affected file is open in Word.

    NOTE: Holding the SHIFT key while opening a file keeps any of Words automatic macros from running.
  7. To see if there are any macros in the new document (there should not be any listed), point to Macro on the Tools menu, and then click Macros. In the Macros In list, click "All active templates and documents." Under Macro Name, there should not be any macros listed. Click Cancel.
  8. Save the file with a different file name.
  9. Delete the infected file.
More information
A macro virus is a program written in the macro language of a program,like Word. It propagates itself among data files and can harm your filesor your computer's operating system.

Word macro viruses do not travel freely over the Internet or any othermedia; they can only be transferred when a user opens a document ortemplate that contains the virus macro.

Microsoft Internet Assistant and documents created or read by itcannot be affected by such macros. Internet Assistant, by design,blocks the mechanism that distributes the macro virus.

Macro viruses cannot be transferred by WordMail unless an affected documentis embedded in the e-mail message and the receiver opens the document.

NOTE: Disinfectant, which is a freeware anti-viral utility for theMacintosh does NOT protect against macro viruses. The current version,3.7.1, is the final version, as Disinfectant will not be updated forfuture viruses or worms.
disinfect protect protected corporate infect protection saving opening saveas nuclear DMV prank concept macword98

Article ID: 181080 - Last Review: 10/26/2013 18:07:00 - Revision: 2.0

Microsoft Word 98 for Macintosh

  • kbnosurvey kbarchive kbinfo kbvirus KB181080