OFF97: Macro Virus May Be Detected in WWINTL32.DLL

• Microsoft Office 97 for Windows
• Microsoft Word 97 for Windows

SUMMARY

When you use an anti-virus program to scan the files on your computer's hard disk or to intercept files that contain viruses, your anti-virus program may report that the Wwintl32.dll file is infected with a macro virus. This article explains why the problem may occur.

MORE INFORMATION

Macro Viruses vs. Traditional Viruses

In order to fully understand this situation, it is important to understand the difference between a macro virus and a traditional virus.

What Is a Macro Virus?

A macro virus is written using a program's scripting or macro language. It is designed to copy itself from one document to the next, copying its code into new modules in each document it infects. A macro virus cannot infect files that are not documents, because the macro virus requires a module in which to reside. For example, a macro virus can infect a Microsoft Word document or a Microsoft Excel workbook. It cannot infect a program executable or a .dll file, because modules cannot be created in these types of files.

What Is a Traditional Virus?

A traditional virus is usually written in C, Assembler, or some other low- level programming language. It is designed to modify the code of other programs and executables (such as .dll files) that it encounters. A traditional virus does not infect non-executable files such as documents (Microsoft Word documents, Microsoft Excel workbooks, bitmaps, and so forth).

Wwintl32.dll

When you install Microsoft Office 97 on your computer, Setup copies the Wwintl32.dll file to the computer's hard disk. The correct properties for Wwintl32.dll are included in the following tables:

   Microsoft Office 97, Standard Edition
   --------------------------------------------------------

   Location      : C:\Program Files\Microsoft Office\Office
   File Size     : 1,157,904 bytes
   Created Date  : Thursday, November 21, 1996
   Modified Date : Thursday, November 21, 1996


   Microsoft Office 97, Professional Edition
   --------------------------------------------------------

   Location      : C:\Program Files\Microsoft Office\Office
   File Size     : 1,157,904 bytes
   Created Date  : Sunday, November 17, 1996
   Modified Date : Sunday, November 17, 1996

   Microsoft Office 97, Service Release 1 (SR-1) Patch
   --------------------------------------------------------

   Location      : C:\Program Files\Microsoft Office\Office
   File Size     : 1,158,416 bytes
   Modified Date : Wednesday, August 13, 1997

Macro Virus in Wwintl32.dll. What Should I Do?

An executable file such as a .dll file cannot be infected by a macro virus like Bandung or Concept. If your anti-virus program reports that Wwintl32.dll is infected with a macro virus, you may safely ignore the warning.

However, you may still want to compare the properties of the Wwintl32.dll file in your C:\Program Files\Microsoft Office\Office folder with the properties listed in the preceding table. If the properties match, your Wwintl32.dll file is clean; if the properties do not match, use the steps in the "Method 2: Get a New Copy of the File" section to transfer a new copy of the file from your Microsoft Office 97 compact disc to your hard disk.

My Anti-Virus Program Detected a

Traditional Virus in Wwintl32.dll. What Should I Do?

It is possible for a traditional virus to infect a .dll file such as Wwintl32.dll. If your anti-virus program reports that Wwintl32.dll is infected with such a virus, use either of the following methods:

Method 1: Disinfect the File

Use your anti-virus program to attempt to disinfect the infected file. In addition, you should scan your entire system for other infected files.

Method 2: Get a New Copy of the File

Transfer a new copy of the file from your Microsoft Office 97 compact disc to the computer's hard disk. To do this:

1. On your desktop, double-click My Computer to start Windows Explorer.

2. Go to the C:\Program Files\Microsoft Office\Office folder.

3. Select the Wwintl32.dll file. On the File menu, click Delete. When you are prompted to confirm the deletion of the file, click Yes.

4. Place your Microsoft Office 97 compact disc in the CD-ROM drive.

5. In Windows Explorer, locate the Office folder on your Microsoft Office 97 compact disc.

6. Select the Wwintl32.dll file. On the Edit menu, click Copy.

7. Go to the C:\Program Files\Microsoft Office\Office folder.

8. On the Edit menu, click Paste.

When Might I Be Warned About a Macro Virus in Wwintl32.dll?

If your anti-virus program is designed to scan for macro viruses, you may be warned of a macro virus in Wwintl32.dll in the following situations:

• When you are running the Microsoft Office 97 Setup program.
• When you start Microsoft Word 97.
• When you open a document in Microsoft Word 97.

Microsoft Office 97 Compact Disc or Floppy Disks?

The compact disc and floppy disk editions of Microsoft Office 97 are manufactured in a specially engineered and monitored environment that guarantees that no viruses are present. For more information on how Microsoft ensures virus-free software, please see the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q80520
   TITLE     : How Microsoft Ensures Virus-Free Software

Why Anti-Virus Programs May Detect a Macro Virus in Wwintl32.dll

One of the functions of the Word 97 WordBasic to VBA converter is to scan and remove macro viruses, such as Bandung and Concept, from Microsoft Word 95 documents when they are converted. As part of the virus recognition system, a number of signatures (text strings) are built into Wwintl32.dll. These signatures are used to recognize macro viruses.

An anti-virus program designed to scan for macro viruses may detect these signatures inside the Wwintl32.dll file. If this occurs, the anti-virus program may incorrectly assume that Wwintl32.dll is infected with a macro virus. You may safely ignore any warning that Wwintl32.dll is infected with a macro virus.

If other, non-macro viruses are detected in Wwintl32.dll, the file may in fact be infected with a virus. In this case, use the steps shown above to either disinfect or remove and reinstall Wwintl32.dll. You should also allow your anti-virus program to disinfect any other infected files found on your hard disk.