Microsoft KB Archive/291824

Knowledge Base

What to do if your computer with an Office for Mac program installed has a macro virus

Article ID: 291824

Article Last Modified on 1/31/2007

---

APPLIES TO

• Microsoft Office 2004 for Mac Standard Edition
• Microsoft Office X for Mac Standard Edition
• Microsoft Office 2001 for Mac
• Microsoft Word 2004 for Mac
• Microsoft Word X for Mac
• Microsoft Word 2001 for Mac

---

This article was previously published under Q291824

For a Microsoft Word 98 version of this article, see 181080.

SUMMARY

This article describes what macro viruses are, what to do if you think your computer might have a Word macro virus, and how to ensure that your documents do not become infected with a macro virus.

MORE INFORMATION

The first macro virus was discovered in the summer of 1995. Since that time, other macro viruses have appeared.

A macro virus is a malicious program that is written by using the macro language of a program such as Word. The virus propagates itself among data files and can harm your files or your computer's operating system.

Word macro viruses do not travel freely over the Internet or any other media; they can only be transferred when a user opens a document or template that contains the virus macro.

Macro viruses cannot be transferred by e-mail, unless an affected document is embedded in the e-mail message and the receiver opens the document.

Symptoms of a Macro Virus

The following are some symptoms of Word macro viruses that are known to affect Word and Word documents:

• When you try to save a document, Word only lets you save the document as a template.
  

-or-

• The icon for the file looks like a template rather than a document.
  

-or-

• When you open a document, a dialog box showing the number 1 appears.
  

-or-

• The Macro and Customize commands no longer appear on the Tools menu.
  

-or-

• New macros appear in the list of macros. AutoOpen and FileSaveAs macros may also appear; if you already had macros by these names, their content may be modified by the macro virus.
  

-or-

• Unusual or unexpected messages appear when you open a Word document or template.

Notes

• In Word 2001 for Mac, you can set the Macro Virus Protection option (on the Edit menu, click Preferences and then click the General tab) that is designed to notify you if you open a file that contains macros, regardless of what the macros do. In Word X for Mac, you can set the Macro Virus Protection option by clicking Preferences on the Word menu, clicking the General tab, and then clicking the Macro Virus Protection option to turn it on or off. In Word 2004 for Mac, you can set the Macro Virus Protection option by clicking Preferences on the Word menu, clicking the Security tab, and then clicking the Macro Virus Protection option to turn it on or off. For a permanent solution, you must use antivirus software that is specifically designed to detect and prevent macro viruses.
• Word does not look for macro viruses or remove any macro viruses from existing documents and templates. It only warns you if the document that you are opening contains macros. Then you can either open the document with the macros active or open it with the macros disabled. You should not open a document with the macros active, unless you are absolutely sure that the document contains no harmful macro viruses.
• Third-party antivirus programs must be updated frequently to remain effective. Contact the vendor for update information.
• Disinfectant, a freeware antivirus utility for Mac OS 9 and earlier versions, does not help protect against macro viruses. Development on the Disinfectant program has been discontinued. The final version of Disinfectant is version 3.7.1.
  

For links to current antivirus software, visit the links that are in the next section. Norton’s Antivirus, by Symantec, and Sophos, both built for Mac OS X, will both scan for macro viruses.

Install an antivirus program

For a long-term solution to macro viruses, install antivirus software that is specifically designed to detect macro viruses. For additional information about antivirus software vendors, including software capable of detecting and preventing macro viruses, click the following article number to view the article in the Microsoft Knowledge Base:

49500 List of antivirus software vendors

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

What to do when you think your computer might have a macro virus

Use the following methods as temporary solutions only when you think your computer might have a macro virus.

Method 1: Disable the macros and copy the text into a new document

If you do not experience any of the symptoms described earlier in this article, but you do not want to be affected by a macro virus, hold down the SHIFT key when you open a file that might be infected by a macro virus. Pressing SHIFT prevents any Word Auto macros from running; if a macro virus is present, it is not loaded.

Method 2: Delete the macro and recover the document

If you experience the symptoms described earlier in this article, or if you suspect that you have a macro virus that is not described in this article, follow these steps to delete the suspect macro and to correct affected document.

Note This is only a temporary solution; because new macros are being created, these steps may not work on new macros.

1. Close Word and move the Normal Template to the desktop.
2. Make a backup copy of an affected file.
3. Open Word. On the File menu, click Open.
4. Navigate to the folder that contains the affected file.
5. Click to select the affected file.
6. Press and hold the SHIFT key and then click Open. Continue holding the SHIFT key until the affected file is open in Word.
   
   Note Holding the SHIFT key while opening a file prevents any Word Auto macros from running.
7. To delete a suspect macro, use the following steps:
   1. On the Tools menu, point to Macro, and then click Macros.
   2. In the Macros In pop-up menu, select All Active Templates and Documents.
   3. Select the suspect macro, and then click Delete. Click Yes when prompted whether you want to delete the macro.
   4. Repeat step c for all suspect macros.
   5. Click Cancel to close the Macro dialog box.
8. To recover the text of an infected document, follow these steps:
   1. Select the entire document by pressing COMMAND+A or by clicking Select All on the Edit menu.
   2. Delete the last paragraph mark of the document from the selection by pressing SHIFT+LEFT ARROW.
   3. On the Edit menu, click Copy.
   4. On the File menu, click New. Select the template that you want to use, and then click OK.
   5. On the Edit menu, click Paste.
   6. Repeat step 7 to ensure that the virus-containing macro has not replicated.
   7. Save the document.
9. Repeat these steps for any document that you suspect might contain a macro virus.

Note If method 2 does not work, try method 3.

Method 3: Use the Organizer to temporarily clean up a macro virus

Use the Organizer to clean up the macro virus. Keep in mind that if you open other files after you open the infected file, these files most likely are infected as well.

To remove the virus from the Normal template, follow these steps:

1. Close all documents. If an infected document is open, it can easily re-infect the Normal template.
2. On the Tools menu, click Templates and Add-Ins, and then click the Organizer button.
3. Click the Macro Project Items tab, and then rename or delete all of the following macros:
   • NewMacros
   • AutoClose
   • AutoExec
   • AutoOpen
   • FileExit
   • FileNew
   • FileOpen
   • FileSave
   • FileSaveAs
   • Macros
   • ToolsMacro
4. Click Close.
5. Press and hold SHIFT while you click Save All on the File menu to save the template.

To remove a macro virus from an infected document:

If a file is infected, use the same method as in steps 1 through 5, but remove the macros from both the Normal template and also from the infected document (template) while in the Organizer. When you are finished, press and hold SHIFT while you click Save All on the File menu, and then move to the next file. Keep in mind that every time you open an infected file, it infects your Normal template, so you must repeatedly remove the macros from the Normal template.

Method 4: Insert the infected file into a new document

This method is particularly useful with the "CAP" macro virus, which removes Macro and Customize from the Tools menu.

Note In this situation, Templates and Add-Ins on the Tools menu may not work.

1. Close Word and then move the Normal template to the desktop.
2. Open Word and then verify that Macro' and Customize' appear on the Tools menu.
3. Open a new document. On the Insert menu, click File.
4. Navigate to the folder containing the affected file.
5. Click to select the affected file.
6. Press and hold the SHIFT key and then click Open. Continue to hold the SHIFT key until the affected file is open in Word.
   

Note Holding the SHIFT key while opening a file prevents Word Auto macros from running.

1. To verify whether any macros exist in the new document (none should be listed), point to Macro on the Tools menu, and then click Macros. In the Macros In pop-up list, click All active templates and documents. Under Macro Name, no macros should be listed. Click Cancel.
2. Save the file with a different file name.
3. Delete the infected file.

Additional query words: OFF2001 mac OFF2001KB macword WD2001KB Template how to error message unknown macros visual basic recover organizer clean up infected customize tools icon wrong incorrect save CAP open new autoexec execute launch boot start alert VBA editor if you have a macro virus OFF2004 WD2004 OFFX WDX

Keywords: kbinfo KB291824

---

Send feedback to Microsoft

© Microsoft Corporation. All rights reserved.