WD98: What to Do If You Have a Macro Virus (181080)

WORKAROUND

Use the following workarounds as interim solutions only.

Method 1: Press SHIFT When You Open a File

If you do not have any of the symptoms described in this article, but you do not want to be affected by a macro virus, hold down the SHIFT key when you open a file that might be affected by a macro virus. Pressing SHIFT will prevent any Auto macros from being run; if a macro virus is present, it will not be loaded.

Method 2: Delete the Macro and Recover the Document

If you have experienced the symptoms listed in this article, or if you suspect that you have a macro virus that is not described here, use the following steps to remove the offending macros and correct affected documents. (Remember, this is only a temporary solution; because new macros are being created, these steps may not work):

1. Close Word and move Normal to the Desktop.
2. Make a back-up copy of an affected file.
3. Open Word and on the File menu click Open.
4. Navigate to the folder containing the affected file.
5. Click to select the affected file.
6. Press and hold the SHIFT key and click Open.
   
   Continue to hold the SHIFT key until the affected file is open in Word.
   
   NOTE: Holding the SHIFT key while opening a file keeps any of Words automatic macros from running.
7. To remove suspect virus-containing macros, use the appropriate method for your version of Word:
   1. On the Tools menu, point to Macro, and then click Macros.
   2. In the Macros In list, click All Active Templates and documents.
   3. Select the suspect macro and click Delete. Click Yes when asked if you want to delete the macro.
   4. Repeat step c for all suspect macros.
   5. Click Cancel or x to close the Macro dialog box.
8. To recover the text of an infected document:
   1. Select the entire document by pressing COMMAND+A, or by clicking Select All on the Edit menu.
   2. Delete the document's final paragraph mark from the selection by pressing SHIFT+LEFT ARROW.
   3. On the Edit menu, click Copy.
   4. On the File menu, click New. Select the template you want to use, and click OK.
   5. On the Edit menu, click Paste.
   6. Repeat step 7 to ensure that the virus containing macros have not again replicated.
   7. Save the document.
9. Repeat these steps for any document suspect of containing a macro virus.

NOTE:If this method does not work, try Method 3.

Method 3: Use the Organizer to temporarily clean up macro viruses

Use the Organizer to clean up the macro virus. Keep in mind that if other files were opened after the infected file, they most likely will be infected as well.

To remove the virus from the Normal template:

1. Close all documents. If an infected document is open, it can easily reinfect Normal.
2. On the Tools menu, click Templates and Add-Ins, and click the Organizer button.
3. Select the Macro Project Items tab and rename or delete all of the following macros:

         NewMacros
         AutoClose
         AutoExec
         AutoOpen
         FileExit
         FileNew
         FileOpen
         FileSave
         FileSaveAs
         Macros
         ToolsMacro

4. Click Close.
5. Press SHIFT and on the File menu, click Save All to save the template.

To remove the virus from infected documents:

If a file is infected, use the same method as above, but remove the macros from both the Normal template and also from the infected document (template) while in the Organizer. When you are done, press SHIFT and on the File menu and click Save All and move on to the next file. Keep in mind that every time you open an infected file it will infect your Normal template, so you constantly need to remove the macros from the Normal template.

Method 4: Insert It into a New Document

With this method, you will need to move Normal to the Desktop and then on the Insert menu, click File to temporarily remove the macros. This method is particularly useful with The macro virus called "CAP" that removes Macro and Customize from the Tools menu.

NOTE: In this situation, the Templates And Add-Ins on the Tools menu command may not work.

1. Close Word and move Normal to the Desktop.
2. Open Word and verify that Macro and Customize are on the Tools menu.
3. Open a new document and on the Insert menu, click File.
4. Navigate to the folder containing the affected file.
5. Click to select the affected file.
6. Press and hold the SHIFT key and click Open.
   
   Continue to hold the SHIFT key until the affected file is open in Word.
   
   NOTE: Holding the SHIFT key while opening a file keeps any of Words automatic macros from running.
7. To see if there are any macros in the new document (there should not be any listed), point to Macro on the Tools menu, and then click Macros. In the Macros In list, click "All active templates and documents." Under Macro Name, there should not be any macros listed. Click Cancel.
8. Save the file with a different file name.
9. Delete the infected file.