WD2000: What to Do If You Have a Macro Virus

• Microsoft Word 2000

SYMPTOMS

The first macro virus was discovered in the summer of 1995. Since that time, numerous other macro viruses have appeared. This article describes what to do if you think you have a Word macro virus.

The following are a few of the symptoms a Word macro virus may cause or exhibit:

NOTE: A macro virus may cause one or more of these symptoms (as well as other symptoms not listed).

• When you try to save a document, Word only lets you save the document as a Document Template (*.dot).



• The icon for a Word document looks like a template rather than a document.



• When you point to Macro on the Tools menu and then click Macros, nothing happens.



• The menu items of Macro or Customize no longer appear on the Tools menu.



• New macros appear in the list of macros (on the Tools menu, point to Macro and click Macros). For example, macros with names such as AutoOpen, AutoNew, AutoExec, or FileSaveAs may appear; if you already had macros by these names, their contents may have been changed by the macro virus, or your macro may have been renamed.



• Unusual or unexpected messages appear when you open a Word document or template.

WORKAROUND

For additional information about methods available to reduce the risks of infecting Microsoft Word documents or templates with a macro virus, please see the following article in the Microsoft Knowledge Base:

Q233396 WD2000: How to Reduce the Chances of Macro Virus Infection

Method 1: Press SHIFT when you open a file.

Method 2: Delete the macro and recover the document.

1. Close Word.



2. Rename Normal.dot. For example, rename Normal.dot to Normal.old.



3. Make a copy of the affected document or template.



4. Start Word.



5. On the File menu, click Open.



6. Go to the folder containing the affected file.



7. Click to select the affected file.



8. Press and hold the SHIFT key and click Open. Continue to hold the SHIFT key until the affected file is open in Word.
   
   NOTE: Holding the SHIFT key while opening a file prevents auto macros from running.



9. To remove a suspected macro virus, do the following steps:



1. On the Tools menu, point to Macro, and then click Macros.
   
   NOTE: If nothing happens when you click Macros, try a different method listed in this article.



2. In the Macros in list, click All active templates and documents.



3. Click to select the suspected macro and click Delete. Click Yes when asked whether you want to delete the macro.



4. Repeat step c for all suspect macros.



5. Click Cancel to close the Macros dialog box.



10. To recover the text of an infected document, do the following steps:



1. Press CTRL+END to move the insertion point to the bottom of the document.



2. Press CTRL+SHIFT+HOME to select the entire document except the last paragraph mark.



3. On the Edit menu, click Copy.



4. On the File menu, click New. Select the template you want to use, and click OK.



5. On the Edit menu, click Paste.



6. Repeat step 9 to ensure that the virus-containing macros have not again replicated.



7. Save your recovered document.



11. Repeat these steps for any document you suspect of containing a macro virus.

Method 3: Use the Organizer.

1. Close all documents except a new blank document.
   
   NOTE: If an infected document is open, it can easily re-infect your global (Normal.dot) template.



2. On the Tools menu, click Templates and Add-Ins, and then click Organizer.



3. On one side of the Organizer, open the global (Normal.dot) template.



4. Select the Macro Project Items tab and rename or delete each of the following macros:
   
   NOTE: If other macros are also listed, rename or delete them also.



• NewMacros
• AutoClose
• AutoExec
• AutoOpen
• FileExit
• FileNew
• FileOpen
• FileSave
• FileSaveAs
• Macros
• ToolsMacro


5. Click Close File to close the global (Normal.dot) template. When you are prompted to save the changes to the file, click Yes.



6. Click Open File and open the document that contains the suspect virus macros.



7. Repeat step 4 and rename or delete each of the suspect virus macros.



8. Click Close File to close the document. When you are prompted to save the changes to the file, click Yes.



9. Click Close to close the Organizer.

Method 4: Insert the file into a new document.

1. Start Word with a new blank document.
   
   NOTE: If Macro, Customize, or Templates and Add-ins is not on the Tools menu, then use a different method.



2. On the Insert menu, click File.



3. Go to the folder containing the affected file.



4. Click to select the affected file and then click Open.



5. To check for any macros in the new document (there should not be any listed), do the following steps:



1. On the Tools menu, point to Macro and click Macros.



2. In the Macros available box, select All active templates and documents.



3. Under Macro name, there should not be any macros listed.
   
   NOTE: If macros are listed, use a different method.



4. Click Cancel.



6. Save the new document with a different file name, and then delete the infected file.

RESOLUTION

For a long-term solution to macro viruses, install anti-virus software that is specifically designed to detect macro viruses.

For additional information about anti-virus software vendors, including software capable of detecting and preventing macro viruses, please see the following article in the Microsoft Knowledge Base:

Q49500 Anti-Virus Software Vendors

MORE INFORMATION

A macro virus is a program written in the macro language of a application; for example, Microsoft Word. A macro virus propagates itself among files and can harm your Word documents and templates or your computer's operating system.

Word macro viruses do not travel independently over the Internet or any other media (for example, a disk or network connection); they can only be transferred when a document or template is opened that contains the macro virus.

Macro viruses also cannot be transferred by electronic mail (e-mail) unless an affected document is attached to the e-mail message and the recipient opens the document (attachment).

To view frequently asked questions about Word macro viruses, please see the following article in the Microsoft Knowledge Base:

Q211607 WD2000: Frequently Asked Questions About Word Macro Viruses

Additional query words: disinfect protect protected corporate infect saving opening saveas nuclear dmv prank concept

Keywords          : kbdta kbvirus wd2000 
Version           : WINDOWS:2000
Platform          : WINDOWS 
Issue type        : kbprb 

Last Reviewed: June 1, 1999