Word Macro virus info

Important information! Please distribute this URL freely!


Contents of this Page

It has come to my attention that there are repeated "infections" of computers throughout the Medical School (and the rest of campus) of the infamous Word Macro virus. There are major outbreaks of this virus at least once a month in one department or another. There are some simple (and not so simple) steps you can take to make sure that your computers are innoculated against this virus.

What is a Macro virus?

The Word (and the less common Excel) macro virus strains are small programs written to use the version of Visual Basic that is included in Word 6 and all subsequent versions of Word for Windows and the Macintosh. This includes Word and Excel shipped with any version of Microsoft Office.

What do they do?

The most common symptom of a Macro virus infection is not being able to save your files, and having all infected files turn into "template" files. An infected document icon under Windows or the Macintosh will have an arrow on it, signifying that it is a template file. Depending on the strain of Macro virus, they may take other actions as well. See the CIAC database referenced at the end of this note for more details.

How do I stop the Macro Virus?

   1. Scan your disk with a virus checking program regularly.
   2. Lock your "Normal" Word template file when you know if is NOT infected.
      This will stop all known macro virii from spreading. This will not
      "uninfect" infected documents, but it will stop them from spreading.

How do I scan for the Macro Virus?

   PCs:  Download the latest FPROT version from ftp://nuns.acns.nwu.edu/ 
         Versions for DOS, Win 3.1, Win95, and WinNT are available.
   Macs: purchase a commercial program such as SAM (Symantec Antivirus for Mac)
         Versions of SAM from 4.07 on will find at least some strains of the
         Word Macro virus.
         Install Disinfectant (will not check for macro virii). Available on
         Plato on the Plato AppleTalk Zone.

How do I lock the Normal file?

   PCs:  AFTER you are certain that you do not have a macro virus, look 
         for a file called "Normal.dot". In Office 95, it is kept in
         the Microsoft Office directory, inside "Templates". Select the file
         and get the "Properties" of the file. Make it "read-only". 
         The file can no longer be changed and will not be infected 
         when you open an infected file in the future.
   Macs: AFTER you are certain that you do not have a macro virus, look 
         for a file called "Normal". In Office 95, it is kept in
         the Microsoft Office directory, inside "Templates". Select the file
         and select "Get Info" from the file menu. Check the "locked" 
         box and close the window. The file is now locked and will not be
         infected when you open an infected file in the future.

What other sources of information on the Macro virus are available?

You can go to the CERT (Computer Emergency Response Team), NCSA (National Computer Security Association), and the CIAC (Computer Incident Advisory Capability) web pages for information on the latest Macro virus strains and much more.

CIAC has an easy-to-use computer virus database at: http://ciac.llnl.gov/ciac/CIACVirusDatabase.html

How do I get more help?

For more help and support, see: http://www.basic.nwu.edu/help.html


Disclaimer

last modified 03/23/98, WAKibbe@nwu.edu