WD: Frequently Asked Questions About Word Macro Viruses

• Microsoft Word for Windows, versions 6.0, 6.0a, 6.0c
• Microsoft Word for Windows 95, versions 7.0, 7.0a
• Microsoft Word 97 for Windows
• Microsoft Word for Windows NT, version 6.0
• Microsoft Word for the Macintosh, versions 6.0, 6.0.1, 6.0.1a
• Microsoft Word 98 Macintosh Edition

SUMMARY

This article answers some of the more frequently asked questions concerning Word macro viruses.

MORE INFORMATION

1. Q. What are Word macro viruses?

   A. Macro viruses are computer viruses that use an application's own
      macro programming language to distribute themselves. These macros
      have the potential to inflict damage to the document or to other
      computer software. These macro viruses can infect Word files, as
      well as any other application that uses a programming language.

      Unlike previous viruses, macro viruses do not infect programs; they
      infect documents and templates. Opening a document or template that
      contains a macro virus will infect your system and the virus will
      spread to other documents and templates you may have on your system.
      Some macro viruses are not harmful, but they can be annoying.
      However, there are some macro viruses that can be very destructive.
      Also, Word macro viruses can be spread across platforms; for
      example, the macro virus can infect files on the Windows platform,
      as well as files on the Macintosh platform.

2. Q. How can I determine whether I have a Word macro virus?

   A. It is not always easy to determine whether you have a macro virus.
      If you are familiar with the Word macros you have on your system,
      you can look through the various macros for ones that you do not
      recognize. It is possible that one, or more, of them are part of a
      macro virus that has infected your system. Some examples of these
      type of macro names are: AAAZAO, AAAZFS, AutoOpen, FileSaveAs, and
      PayLoad.

      Some other things to look for are:

      - Unexplainable behavior on your system; for example, you may be
        prompted for a password on a file that you know does not contain a
        password or your document may be unexpectedly saved as a template.

      - Unusual error messages, for example:

           This one's for you, Bosco.

            -or-

           ROBERTA TI AMO!

            -or-

           Just to prove another point.

            -or-

           And finally I would like to say: STOP ALL FRENCH NUCLEAR
           TESTING IN THE PACIFIC!

      - Unusual changes to your documents; for example, the macro virus
        may randomly move three words then insert the word "WAZZU" at
        random locations.

3. Q. How did I get the macro virus?

   A. You worked with a file that was infected with a Word macro virus. An
      infected file can be obtained any of the following sources

         disks
         networks
         email attachments
         modems
         the Internet

      You may want to obtain a current macro virus detection program to
      prevent obtaining future macro viruses and to get rid of your
      existing macro viruses.

4. Q. If I have a Word macro virus on my system, can I accidentally spread
      the macro virus to others?

   A. Yes. You can spread a virus if you share files with others. A macro
      virus embeds itself into your file and can, most commonly, spread to
      others if you share files from a disk, network drive, external drive
      media, or any of a number of other file transfer methods. Files
      exchanged over the Internet can also spread the macro virus to
      others.

5. Q. Can I get software that will prevent me from getting a Word macro
      virus in the future?

   A. Microsoft Technical Support recommends that you use a third-party
      company that provides Word macro virus detection and protection.
      There are many companies that provide this service, as listed in the
      following Microsoft Knowledge Base article:

         ARTICLE-ID: Q49500
         TITLE     : List of Anti-Virus Software Vendors

6. Q. Are there other ways that I can get a Word macro virus off my
      system?

   A. Yes, there are some temporary workarounds that you can use to clean
      a macro virus off your system. These methods will not prevent the
      future infection of your system. Please refer to the following
      Microsoft Knowledge Base article:

         ARTICLE-ID: Q134727
         TITLE     : What to Do If You Have a Macro Virus

7. Q. Where can I obtain additional information about Word macro viruses?

   A. Microsoft maintains several Internet pages about macro viruses. You
      can connect to any of the following Microsoft World Wide Web sites
      for more information:

      "Microsoft Word Macro Virus Protection Information" can be found at:

         http://www.microsoft.com/word/freestuff/mvtool/virusinfo.htm

      "Watch out! Macro viruses are making many PCs sick" can be found at:

         http://www.microsoft.com/athome/yourpc/virus/virus.htm

      NOTE: Because the Microsoft Web site is constantly updated, the site
      address may change without notice. If this occurs, link to the
      Microsoft home page at the following address:

         http://www.microsoft.com/

8. Q. I have Word and it always prompts me about the file I am opening
      containing macros. I don't share files or disks with others, I don't
      even download files from the Internet. Can I prevent Word from
      prompting me all the time with this warning?

   A. Yes, you can disable the macro virus warning, although Microsoft
      does not recommend it. To disable the macro virus warning:

      a) On the Tools menu, click Options (Windows) or Preferences
         (Macintosh)

      b) Click the General tab.

      c) Click to clear the "Macro virus protection" check box.

      d) Click OK.

      This macro virus warning will not appear anymore.

9. Q. Word provides the macro virus warning when I open files that may
      contain macros, except when I open files from my templates folder.
      Why the difference?

   A. Word assumes that you know which files you have saved to your
      templates folder. It also assumes that you know these files are
      safe. With this assumption, Word does not provide the macro virus
      warning when it detects macros contained in files from your template
      folders. The template folders that Word uses are defined by the User
      Templates and Workgroup Templates settings as specified in the File
      Locations tab in the Options dialog box.

10. Q. My version of Word doesn't have the built-in macro virus warning
       feature. Does Microsoft provide a tool that will give me that
       functionality?

    A. For Microsoft Word versions prior to Word 7.0a, Microsoft provides
       the ScanProt tool for the following versions of Word:

       - Microsoft Word for Windows 6.0, 6.0a, 6.0c
       - Microsoft Word for Windows 95, version 7.0
       - Microsoft Word for Windows NT, version 6.0
       - Microsoft Word for the Macintosh, versions 6.0, 6.0.1, 6.0.1a

      The Microsoft Virus Protection Tool (ScanProt) scans only for the
      Concept virus and will remove it from your system. It does not
      detect nor remove other macro viruses from your system. However, it
      does install its own macros to warn you when you are opening a file
      that contains macros.

      For information on obtaining the Word ScanProt tool, please refer to
      the following Microsoft Knowledge Base articles:

         ARTICLE-ID: Q134728
         TITLE     : WD1215: Macro Virus Protection Tool (Windows)

         ARTICLE-ID: Q133895
         TITLE     : WD1222: Macro Virus Protection Tool (Macintosh)

      Please note that Microsoft does not provide a ScanProt tool for Word
      versions earlier than Word 6.0. For complete macro virus protection
      for these versions of Word, please contact a third-party Virus
      protection software vendor.

11. Q. Are there macro viruses that affect other Microsoft Office
      applications?

    A. Yes. For more information on macro viruses for the other Microsoft
       Office applications:

       - For Microsoft Excel, please refer to the following Microsoft
         Knowledge Base article:

           ARTICLE-ID: Q154131
           TITLE     : XL: Q&A about Excel Macro/Laroux Macro Virus

        or see the Microsoft Excel World Wide Web Site:

           http://www.microsoft.com/excel/productinfo/vbavirus/emvolc.htm