KnowledgeBase Archive

An Archive of Early Microsoft KnowledgeBase Articles

View on GitHub

Q163932: WD97: Frequently Asked Questions About Word Macro Viruses

Article: Q163932
Product(s): Word 97 for Windows
Version(s): 
Operating System(s): 
Keyword(s): kbdta kbvirus word97kbfaq
Last Modified: 18-MAY-2001

-------------------------------------------------------------------------------
The information in this article applies to:

- Microsoft Word 97 for Windows 
-------------------------------------------------------------------------------


SUMMARY
=======

This article answers some of the more frequently asked questions concerning Word
macro viruses.

MORE INFORMATION
================

1. Q. What are Word macro viruses?

  A. Macro viruses are computer viruses that use an application's own macro
  programming language to distribute themselves. These macros have the
  potential to inflict damage to the document or to other computer software.
  These macro viruses can infect Word files, as well as any other application
  that uses a programming language.

  Unlike previous viruses, macro viruses do not infect programs; they infect
  documents and templates. Opening a document or template that contains a macro
  virus will infect your system and the virus will spread to other documents
  and templates you may have on your system. Some macro viruses are not
  harmful, but they can be annoying. However, there are some macro viruses that
  can be very destructive. Also, Word macro viruses can be spread across
  platforms; for example, the macro virus can infect files on the Windows
  platform, as well as files on the Macintosh platform.

2. Q. How can I determine whether I have a Word macro virus?

  A. It is not always easy to determine whether you have a macro virus. If you
  are familiar with the Word macros you have on your system, you can look
  through the various macros for ones that you do not recognize. It is possible
  that one, or more, of them are part of a macro virus that has infected your
  system. Some examples of these type of macro names are: AAAZAO, AAAZFS,
  AutoOpen, FileSaveAs, and PayLoad.

  Some other things to look for are:

   - Unexplainable behavior on your system; for example, you may be prompted
     for a password on a file that you know does not contain a password or your
     document may be unexpectedly saved as a template.

   - Unusual error messages, for example:

  This one's for you, Bosco.

  -or-

  ROBERTA TI AMO!

  -or-

  Just to prove another point.

  -or-

  And finally I would like to say: STOP ALL FRENCH NUCLEAR TESTING IN THE
  PACIFIC!

   - Unusual changes to your documents; for example, the macro virus may
     randomly move three words then insert the word "WAZZU" at random
     locations.

3. Q. How did I get the macro virus?

  A. You worked with a file that was infected with a Word macro virus. An
  infected file can be obtained any of the following sources

  disks
  networks
  email attachments
  modems
  the Internet

  You may want to obtain a current macro virus detection program to prevent
  obtaining future macro viruses and to get rid of your existing macro viruses.

4. Q. If I have a Word macro virus on my system, can I accidentally spread the
  macro virus to others?

  A. Yes. You can spread a virus if you share files with others. A macro virus
  embeds itself into your file and can, most commonly, spread to others if you
  share files from a disk, network drive, external drive media, or any of a
  number of other file transfer methods. Files exchanged over the Internet can
  also spread the macro virus to others.

5. Q. Can I get software that will prevent me from getting a Word macro virus in
  the future?

  A. Microsoft Technical Support recommends that you use a third-party company
  that provides Word macro virus detection and protection. There are many
  companies that provide this service.

For additional information companies that provide Word macro virus protection,
click the article number below to view the article in the Microsoft Knowledge
Base:

  Q49500 List of Antivirus Software Vendors

6. Q. Are there other ways that I can get a Word macro virus off my system?

  A. Yes, there are some temporary workarounds that you can use to clean a macro
  virus off your system. These methods will not prevent the future infection of
  your system. Please refer to the following Microsoft Knowledge Base article:

  Q181079 WD97: What to Do If You Have a Macro Virus

7. Q. I have Word and it always prompts me about the file I am opening
  containing macros. I don't share files or disks with others, I don't even
  download files from the Internet. Can I prevent Word from prompting me all
  the time with this warning?

  A. Yes, you can disable the macro virus warning, although Microsoft does not
  recommend it. To disable the macro virus warning:

  a. On the Tools menu, click Options

  b. Click the General tab.

  c. Click to clear the "Macro virus protection" check box.

  d. Click OK.

  This macro virus warning will not appear anymore.

8. Q. Word provides the macro virus warning when I open files that may contain
  macros, except when I open files from my templates folder. Why the
  difference?

  A. Word assumes that you know which files you have saved to your templates
  folder. It also assumes that you know these files are safe. With this
  assumption, Word does not provide the macro virus warning when it detects
  macros contained in files from your template folders. The template folders
  that Word uses are defined by the User Templates and Workgroup Templates
  settings as specified in the File Locations tab in the Options dialog box.

9. Q. Are there macro viruses that affect other Microsoft Office applications?

  A. Yes. For more information on macro viruses for the other Microsoft Office
  applications:

   - For Microsoft Excel, please refer to the following Microsoft Knowledge
     Base articles:

  Q154131 XL: Q&A about Excel Macro/Laroux Macro Virus

  Q176807 XL: How to Identify and Remove PLDT/CAR/SGV Macro Viruses

   - For Microsoft Access, please see the Microsoft Access Assistance Web site:

  http://support.microsoft.com/support/kb/articles/q163/9/32.asp

Additional query words: 8.0 8.00

======================================================================
Keywords          : kbdta kbvirus word97 kbfaq
Technology        : kbWordSearch kbWord97 kbWord97Search kbZNotKeyword2
Version           : :

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.