WD2000: Frequently Asked Questions About Word Macro Viruses

• Microsoft Word 2000

SUMMARY

This article answers some of the more frequently asked questions concerning Word macro viruses.

MORE INFORMATION

1. Q. What are Word macro viruses?
   
   Macro viruses are computer viruses that use an application's own macro programming language to distribute themselves. These macros have the potential to inflict damage to the document or to other computer software. These macro viruses can infect Word files, as well as any other application that uses a programming language.
   
   Unlike operating system viruses, macro viruses do not infect programs; they infect documents and templates. When you open a document or template that contains a macro virus, the virus infects your system and spreads to other documents and templates on your system.
   
   Some macro viruses are annoying but not harmful; others can be very destructive. Also, Word macro viruses can spread across platforms; for example, the macro virus can infect files on the Windows platform as well as on the Macintosh platform.


For additional information about macro viruses, please see the following Web pages on the Microsoft Web site:

Microsoft Office 2000 Macro Security White Paper

http://officeupdate.microsoft.com/

Protect Your Microsoft Office Data from Viruses

http://officeupdate.microsoft.com/articles/antivirus.htm

2. Q. How can I determine whether I have a Word macro virus?
   
   It is not always easy to determine whether you have a macro virus. If you are familiar with the Word macros on your system, you can look through the various macros for ones that you do not recognize. One or more of them may be part of a macro virus that has infected your system. Some examples of this type of macro name are AAAZAO, AAAZFS, AutoOpen, FileSaveAs, and PayLoad.
   
   Some other things to look for include the following:



• Unexplainable behavior on your system; for example, you may be prompted for a password on a file that you know does not require a password, or your document may be unexpectedly saved as a template.
  
  
• Unusual or unexplainable messages that appear in a dialog box.
  
  
• Unusual changes to your documents; for example, the macro virus may randomly move three words and then insert the word "WAZZU" at random locations.
  
  
• Menu items missing from the Word menus.

For additional information about what to do if you think you have a Word macro virus, please see the following article in the Microsoft Knowledge Base:

Q211800 WD2000: What to Do If You Have a Macro Virus

3. Q. How did I get the macro virus?
   
   You have worked with a file (document or template) that was infected with a Word macro virus. An infected file can be obtained through any of the following ways:
   
   
   • sharing files on disk
     
     
   • sharing files on a network
     
     
   • opening a file that is an e-mail attachment
     
     
   • downloading a file via a modem and then opening the file
     
     
   • downloading a file via the Internet or an intranet and then opening the file
   
   To help prevent a macro virus from infecting your system or to clean a macro virus off your system, install an anti-virus software program.


For additional information about vendors of anti-virus software programs, please see the following article in the Microsoft Knowledge Base:

Q49500 List of Anti-Virus Software Vendors

4. Q. If I have a Word macro virus on my system, can I accidentally spread the macro virus to others?
   
   Yes. You can spread a virus if you share files with others. A macro virus embeds itself into your file and can, most commonly, spread to others if you share files from a disk, network drive, external drive media, or other file transfer method. Files exchanged over the Internet can also spread the macro virus.



5. Q. I have Word and it always prompts me about the file I am opening containing macros. I don't share files or disks with others, I don't even download files from the Internet. Can I prevent Word from prompting me all the time with this warning?
   
   Yes. You can change the security level in Microsoft Word so that Word does not prompt you to "enable" or "disable" macros. However, Microsoft does not recommend that you set the security level to Low.


For additional information about changing the security level in Microsoft Word, please see the following article in the Microsoft Knowledge Base:

Q233396 WD2000: How to Reduce the Chances of Macro Virus Infection

Additional query words: protect protection protection.doc protecting protects execute only executable

Keywords          : kbdta kbvirus wd2000 
Version           : WINDOWS:2000
Platform          : WINDOWS 
Issue type        : kbinfo 

Last Reviewed: June 7, 1999