WD2000: What to Do If You Have a Macro Virus

ID: Q211800

The information in this article applies to:
  • Microsoft Word 2000

SYMPTOMS

The first macro virus was discovered in the summer of 1995. Since that time, numerous other macro viruses have appeared. This article describes what to do if you think you have a Word macro virus.

The following are a few of the symptoms a Word macro virus may cause or exhibit:

NOTE: A macro virus may cause one or more of these symptoms (as well as other symptoms not listed).


  • When you try to save a document, Word only lets you save the document as a Document Template (*.dot).


  • The icon for a Word document looks like a template rather than a document.


  • When you point to Macro on the Tools menu and then click Macros, nothing happens.


  • The menu items of Macro or Customize no longer appear on the Tools menu.


  • New macros appear in the list of macros (on the Tools menu, point to Macro and click Macros). For example, macros with names such as AutoOpen, AutoNew, AutoExec, or FileSaveAs may appear; if you already had macros by these names, their contents may have been changed by the macro virus, or your macro may have been renamed.


  • Unusual or unexpected messages appear when you open a Word document or template.



WORKAROUND

For additional information about methods available to reduce the risks of infecting Microsoft Word documents or templates with a macro virus, please see the following article in the Microsoft Knowledge Base:

Q233396 WD2000: How to Reduce the Chances of Macro Virus Infection
Use the following workarounds as a temporary solution only.

Method 1: Press SHIFT when you open a file.

If you do not have any of the symptoms described in this article when you start Word, and you do not want to be affected by a macro virus, hold down the SHIFT key when you open a file that you suspect may be infected by a macro virus.

NOTE: Pressing and holding SHIFT when you open a document or template (or pressing SHIFT when you start Word) prevents any auto macros from being run; if a macro virus is present, it will not be loaded.

Method 2: Delete the macro and recover the document.

If you have experienced the symptoms listed in this article, or if you suspect that you have a macro virus that is not described here, use the following steps to remove the macros and correct the affected documents. (Remember, this is only a temporary solution; because new macros viruses are possible, these steps may not work.):
  1. Close Word.


  2. Rename Normal.dot. For example, rename Normal.dot to Normal.old.


  3. Make a copy of the affected document or template.


  4. Start Word.


  5. On the File menu, click Open.


  6. Go to the folder containing the affected file.


  7. Click to select the affected file.


  8. Press and hold the SHIFT key and click Open. Continue to hold the SHIFT key until the affected file is open in Word.

    NOTE: Holding the SHIFT key while opening a file prevents auto macros from running.


  9. To remove a suspected macro virus, do the following steps:


    1. On the Tools menu, point to Macro, and then click Macros.

      NOTE: If nothing happens when you click Macros, try a different method listed in this article.


    2. In the Macros in list, click All active templates and documents.


    3. Click to select the suspected macro and click Delete. Click Yes when asked whether you want to delete the macro.


    4. Repeat step c for all suspect macros.


    5. Click Cancel to close the Macros dialog box.


  10. To recover the text of an infected document, do the following steps:


    1. Press CTRL+END to move the insertion point to the bottom of the document.


    2. Press CTRL+SHIFT+HOME to select the entire document except the last paragraph mark.


    3. On the Edit menu, click Copy.


    4. On the File menu, click New. Select the template you want to use, and click OK.


    5. On the Edit menu, click Paste.


    6. Repeat step 9 to ensure that the virus-containing macros have not again replicated.


    7. Save your recovered document.


  11. Repeat these steps for any document you suspect of containing a macro virus.


Method 3: Use the Organizer.

Use the Organizer to "clean up" a suspected macro virus. Keep in mind that if other files were opened after the infected file, they most likely are infected as well.

NOTE: Do not use this method if your global (Normal.dot) template contains macros that you may want to keep.
  1. Close all documents except a new blank document.

    NOTE: If an infected document is open, it can easily re-infect your global (Normal.dot) template.


  2. On the Tools menu, click Templates and Add-Ins, and then click Organizer.


  3. On one side of the Organizer, open the global (Normal.dot) template.


  4. Select the Macro Project Items tab and rename or delete each of the following macros:

    NOTE: If other macros are also listed, rename or delete them also.


    • NewMacros
    • AutoClose
    • AutoExec
    • AutoOpen
    • FileExit
    • FileNew
    • FileOpen
    • FileSave
    • FileSaveAs
    • Macros
    • ToolsMacro

  5. Click Close File to close the global (Normal.dot) template. When you are prompted to save the changes to the file, click Yes.


  6. Click Open File and open the document that contains the suspect virus macros.


  7. Repeat step 4 and rename or delete each of the suspect virus macros.


  8. Click Close File to close the document. When you are prompted to save the changes to the file, click Yes.


  9. Click Close to close the Organizer.


Method 4: Insert the file into a new document.

NOTE: Before you use this method, rename your global (Normal.dot) template.

Use the following steps to insert a suspected macro-virus-infected document into a new file:
  1. Start Word with a new blank document.

    NOTE: If Macro, Customize, or Templates and Add-ins is not on the Tools menu, then use a different method.


  2. On the Insert menu, click File.


  3. Go to the folder containing the affected file.


  4. Click to select the affected file and then click Open.


  5. To check for any macros in the new document (there should not be any listed), do the following steps:


    1. On the Tools menu, point to Macro and click Macros.


    2. In the Macros available box, select All active templates and documents.


    3. Under Macro name, there should not be any macros listed.

      NOTE: If macros are listed, use a different method.


    4. Click Cancel.


  6. Save the new document with a different file name, and then delete the infected file.



RESOLUTION

For a long-term solution to macro viruses, install anti-virus software that is specifically designed to detect macro viruses.

For additional information about anti-virus software vendors, including software capable of detecting and preventing macro viruses, please see the following article in the Microsoft Knowledge Base:

Q49500 Anti-Virus Software Vendors


MORE INFORMATION

A macro virus is a program written in the macro language of a application; for example, Microsoft Word. A macro virus propagates itself among files and can harm your Word documents and templates or your computer's operating system.

Word macro viruses do not travel independently over the Internet or any other media (for example, a disk or network connection); they can only be transferred when a document or template is opened that contains the macro virus.

Macro viruses also cannot be transferred by electronic mail (e-mail) unless an affected document is attached to the e-mail message and the recipient opens the document (attachment).

To view frequently asked questions about Word macro viruses, please see the following article in the Microsoft Knowledge Base:

Q211607 WD2000: Frequently Asked Questions About Word Macro Viruses

Additional query words: disinfect protect protected corporate infect saving opening saveas nuclear dmv prank concept

Keywords : kbdta kbvirus wd2000
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbprb


Last Reviewed: June 1, 1999
© 2000 Microsoft Corporation. All rights reserved. Terms of Use.