OFF97: Macro Virus May Be Detected in WWINTL32.DLL

ID: Q163275

The information in this article applies to:

Microsoft Office 97 for Windows
Microsoft Word 97 for Windows

SUMMARY

When you use an anti-virus program to scan the files on the hard disk on your computer or to intercept files that contain viruses, your anti-virus program may report that the Wwintl32.dll file is infected with a macro virus. This article explains why the problem may occur.

MORE INFORMATION

Macro Viruses vs. Traditional Viruses

In order to fully understand this situation, it is important to understand the difference between a macro virus and a traditional virus.

What Is a Macro Virus?

A macro virus is written using a program's scripting or macro language. It is designed to copy itself from one document to another, copying its code into new modules in each document it infects. A macro virus cannot infect files that are not documents because the macro virus requires a module in which to reside. For example, a macro virus can infect a Microsoft Word document or a Microsoft Excel workbook. It cannot infect a program executable or a .dll file, because modules cannot be created in these types of files.

What Is a Traditional Virus?

A traditional virus is usually written in C, Assembler, or some other low- level programming language. It is designed to modify the code of other programs and executables (such as .dll files) that it encounters. A traditional virus does not infect non-executable files such as documents (Microsoft Word documents, Microsoft Excel workbooks, bitmaps, and so forth).

Wwintl32.dll

When you install Microsoft Office 97 on your computer, Setup copies the Wwintl32.dll file to the hard disk on the computer. The correct properties for Wwintl32.dll are listed in the following tables.


   Microsoft Office 97 Standard Edition
   --------------------------------------------------------

   Location      : C:\Program Files\Microsoft Office\Office
   File Size     : 1,157,904 bytes
   Created Date  : Thursday, November 21, 1996
   Modified Date : Thursday, November 21, 1996

   Microsoft Office 97 Professional Edition
   --------------------------------------------------------

   Location      : C:\Program Files\Microsoft Office\Office
   File Size     : 1,157,904 bytes
   Created Date  : Sunday, November 17, 1996
   Modified Date : Sunday, November 17, 1996

   Microsoft Office 97, Service Release 1 (SR-1) Patch
   --------------------------------------------------------

   Location      : C:\Program Files\Microsoft Office\Office
   File Size     : 1,158,416 bytes
   Modified Date : Wednesday, August 13, 1997

   Microsoft Office 97 Small Business Edition
   --------------------------------------------------------

   Location      : C:\Program Files\Microsoft Office\Office
   File Size     : 1,157,904 bytes
   Created Date  : Monday, December 09, 1996
   Modified Date : Monday, December 09, 1996

Anti-Virus Program Detected a Macro Virus in Wwintl32.dll.

An executable file such as a .dll file cannot be infected by a macro virus like Bandung or Concept. If your anti-virus program reports that Wwintl32.dll is infected with a macro virus, you may safely ignore the warning.

However, you may still want to compare the properties of the Wwintl32.dll file in your C:\Program Files\Microsoft Office\Office folder with the properties listed in the preceding table. If the properties match, your Wwintl32.dll file is clean; if the properties do not match, use the steps in the "Method 2: Get a New Copy of the File" section to transfer a new copy of the file from your Microsoft Office 97 compact disc to your hard disk.

My Anti-Virus Program Detected a Traditional Virus in Wwintl32.dll.

It is possible for a traditional virus to infect a .dll file such as Wwintl32.dll. If your anti-virus program reports that Wwintl32.dll is infected with such a virus, use either of the following methods:

Method 1: Disinfect the File

Use your anti-virus program to attempt to disinfect the infected file. In addition, you should scan your entire system for other infected files.

Method 2: Get a New Copy of the File

Transfer a new copy of the file from your Microsoft Office 97 compact disc to the hard disk. To do this, follow these steps:

On your desktop, double-click My Computer to start Windows Explorer.

Go to the C:\Program Files\Microsoft Office\Office folder.

Select the Wwintl32.dll file. On the File menu, click Delete. When you are prompted to confirm the deletion of the file, click Yes.

Place your Microsoft Office 97 compact disc in the CD-ROM drive.

In Windows Explorer, locate the Office folder on your Microsoft Office 97 compact disc.

Select the Wwintl32.dll file. On the Edit menu, click Copy.

Go to the C:\Program Files\Microsoft Office\Office folder.

On the Edit menu, click Paste.

A new copy of the file will be copied from your Microsoft Office 97 compact disc to your hard disk. Empty your Windows Recycle Bin to permanently delete the damaged (or infected) file.

When Might I Be Warned About a Macro Virus in Wwintl32.dll?

If your anti-virus program is designed to scan for macro viruses, you may be warned of a macro virus in Wwintl32.dll in the following situations:

When you are running the Microsoft Office 97 Setup program

When you start Microsoft Word 97

When you open a document in Microsoft Word 97

Could I Have Received a Virus from my Microsoft Office 97 Compact Disc or Floppy Disks?

The compact disc and floppy disk editions of Microsoft Office 97 are manufactured in a specially engineered and monitored environment that guarantees that no viruses are present. For more information about how Microsoft ensures virus-free software, please see the following article in the Microsoft Knowledge Base:

Q80520 How Microsoft Ensures Virus-Free Software

Why Anti-Virus Programs May Detect a Macro Virus in Wwintl32.dll

One of the functions of the Word 97 WordBasic to VBA converter is to scan and remove macro viruses, such as Bandung and Concept, from Microsoft Word 7.0 documents when they are converted. As part of the virus recognition system, a number of signatures (text strings) are built into Wwintl32.dll. These signatures are used to recognize macro viruses.

An anti-virus program designed to scan for macro viruses may detect these signatures inside the Wwintl32.dll file. If this occurs, the anti-virus program may incorrectly assume that Wwintl32.dll is infected with a macro virus. You may safely ignore any warning that Wwintl32.dll is infected with a macro virus.

If other, nonmacro viruses are detected in Wwintl32.dll, the file may in fact be infected with a virus. In this case, use the steps shown above to either disinfect or remove and reinstall Wwintl32.dll. You should also allow your anti-virus program to disinfect any other infected files found on your hard disk.

Additional query words: 97 OFF97 WORD97 bandung concept macro virus "ibm antivirus" "norton mcafee f-prot dr. solomon sr1


Keywords          : offwinsetup 
Version           : WINDOWS:97
Platform          : WINDOWS 
Issue type        :

Last Reviewed: May 25, 1999