Macro Viruses and How to Protect Your Computer
mac and windows virus protection
On this page:
- About macros and macro viruses
(How does a computer get a macro virus? | Identifying the symptoms of a macro virus)
- Remove a macro virus: Mac | Windows
- Prevent getting a macro virus in the future
A macro is a series of program commands or instructions designed to simplify repetitive tasks within a program in the Microsoft Office suite (such as Microsoft Word, Excel, PowerPoint, etc.). Any operating system can receive a macro virus, even Macs, as long as you have Microsoft Office installed on it. A macro virus is a virus that is created by using the built-in macro programming language, designed to execute as soon as the file is opened. It attaches itself to a document file and waits until an application like Microsoft Word opens it.
Your computer gets a macro virus when you open any document or template that has a macro virus attached to it. As soon as the document is opened, the virus runs, corrupts files, and copies itself into other documents. It is possible to get a macro virus by opening attachments in emails that you are not expecting.
- Receiving unusual or unexpected messages when you open a document or template. For example: "This one's for you, Bosco."
- The file type of the document changes to the template format without your knowledge. For example: instead of saving your file as a .doc it changes to a .dot format.
- When going to the "Save As" command in the application, the only available option is the ".dot" format.
- Under the Tools menu, the Macro or Customize commands are no longer available. There may be strange macro names listed under the Normal Template such as "Payload," "AutoOpen," or "AAAZFS."
- You are prompted to enter a password for a document that you never password protected.
- Unusual changes in your document. The macro virus may insert the word "WAZZU" at random locations.
- Receiving a virus rejection message from the email server when you try to send a Word document.
- Enable Macro virus protection in Microsoft Word.
- Open Microsoft Word, go to Preferences under the Microsoft Word menu.
- Click on General tab, then ensure that the option Macro virus protection is checked.
- Exit Microsoft Word.
- Find and remove infected Microsoft Word files.
- Double click on Macintosh HD, go to Users > [your account name] > Library > Preferences.
- Scroll down the list to find a file named com.microsoft.Word.plist.
- Click on this file and delete it.
- Go back to Macintosh HD, go to Applications > Microsoft Office X > Templates and select the file named Normal.
- Click on this file and delete it.
- Empty your trash to permanently delete those files.
- If you have anti-virus installed on your Mac, run it.
- Open up Microsoft Word again. Create any changes that you wish to make to the default template, such as margins, font size, etc., and then exit the application.
- Lock the Normal Template. By locking the normal template, it will protect you from future macro virus infections. If you want to change the default settings in Microsoft Word, you will have to unlock the normal template and reset your settings.
- Double click on Microsoft HD, go to Applications > Microsoft Office X > Templates.
- Click once on the filed called Normal to highlight it.
- Hold down the control key and click once on the file.
- Select Get Info from the menu. In the Get Info box, select the option of locking the filed called Lock.
- Your Normal Template should now be locked.
- Making a copy of the infected Microsoft Word document.
- Make sure Microsoft Word is closed.
- In My Computer locate the file named Normal.dot. Once you find it, rename it from Normal.dot to Normal.old.
- Make a copy of that infected document or template and then start Microsoft Word.
- Deleting the macros from the document.
- Go to File > Open and select the infected file. When you click on Open, make sure you are holding down the Shift key until the file is fully loaded to prevent macros from starting.
- Under the Tools menu, select Macro, then Macros. The Macros window should appear.
- Select All active templates from the Macros in field.
- Click on the suspected macro and then click Delete. When asked if you want to delete the macro, select Yes. Repeat this step for all the macros you suspect are infected.
- Close Macros dialog box.
- Recovering your infected document.
- In the document, press control+end to go to the bottom of the document. Then press control+shift+home to select the entire document except for the last paragraph mark.
- Under the Edit menu, select Copy.
- Under the File menu, select New.
- In the new document, paste the contents of your old document.
- Repeat step 2 to see if ensure that you did not copy any macro viruses into your new recovered document.
- Save your recovered document.
To prevent getting macro viruses in the future, here are a few helpful tips:
- Do not open file attachments if you are not expecting to receive them.
- Make sure macros is disabled in your office programs. Learn how to disable macros.
- Hold down the Shift key every time you open a file that you suspect may be infected by a macro virus. This prevents any auto macros from being run, therefore the virus will not affect your computer.
- For Windows, set the macro security level for Microsoft Office programs.
- In your application, select Options from the Tools menu.
- Click the Security tab, then the Macro Security button.
- In the Security Level tab, select the level.
- For Macs, set up a notification for when a file contains macros.
- In your application, select Preferences from the menu.
- Select the Security or General option (depending on which version of the application you are using) and check Warn before opening a file that contains macros or Macro virus protection button (depending on the version).
- When asked if you want to Enable Macros or Disable Macros when you open a file with macros present, it is safer to disable the macro. If after you disable the macro and realize you need it, you can save the file (saving all the macros) and reopen it.
- Make sure your virus protection is up-to-date and do regular virus scans.