Macro Virus - How to address - HELP!!!

[ColibriNY]

Version: 2004
Operating System: Mac OS X 10.4 (Tiger)
Processor: Power PC

Several users at a client of mine run Word 2004 on a combination of PPC and Intel Macs all running OS X 10.4.11 and Word version 11.5.0 or higher. Recently, they started using a word document (.doc) as a report template. The document has a JPEG graphic in it and originated on a PC.

Now whenever they open any Word file, they are getting the warning dialog to disable macros. If they enable macros, the files will crash most of the time. If they disable, the file goes to read only - if they try to Save As... another name, that file is also read only.

In addition, if they create a new file and try to save it, they will get a warning dialog that Word 2004 shares the same file format as Word 97-2003 and do they want to append the .doc extension? After they save the file, the disable macro behavior above occurs next time they try to open the file.

(BTW, for now I am asking them to print any new files to PDF format if they need to make them available to others. I have also asked them to create a new document to use as the template.)

What is the culprit? PC Word macro virus?
How do I address this problem most expeditiously?
Will a normal anti-virus program clear out the virus?
Will I have to reinstall Office? Since I have no idea where a macro virus "hangs out", I started by trying to clear out all preference files. No luck.

Any help will be GREATLY appreciated!

 

[John_T]

I am experiencing a similar problem. My Hardware and software config. is similar to yours - Mac OS X 10.4 (Tiger) PPC Processor. Every time I create a document in Word 2004 and attempt to modify it, the document opens as a "Read Only" and I receive the warning dialog about Macros. I disable the macros, rename the file but the behavior persists each time the file is opened. I have run Norton Anti-Virus but to no avail.

Help!!
Irritated.

 

[John McGhie]

This reply is for ColibriNY: John_T, ignore this response, or you will be
sorry!! This one does not apply to your situation.

OK, this could get quite complex. You may care to hire a security
consultant to do this for you: removing a virus infestation from a networked
group of users can require quite a lot of work and some detailed technical
knowledge.

1) Generally, virus files do not infect components of Mac Office software.
They could in theory, but we have never seen one that has. So
Uninstalling/re-installing must be avoided because it is likely to give you
extra problems and will have no effect on the virus.

2) The first thing to do is to do a full scan of those Macs with a
reputable antivirus program. I would recommend ClamX AV
http://www.clamxav.com/ but McAfee is also very good.

3) Most viruses these days are files in their own right. But there is a
class of viruses that can hide in Word templates and documents.

I think you have one of those, and I suspect that it is in each user's
Normal template.

Sadly, it sounds as though it may be "active" or at least partially so. If
it is, then it is copying itself to each document each user opens. That's
why you need to scan all of their computers, and the network file server as
well.

Once you get an infestation, it's like the plague, it infects everything it
touches. The antivirus scan will "Quarantine" any file that really does
have a virus in it.

A) If it is a macro virus, the antivirus should find each user's Normal
template and quarantine it. You can delete that: Word will create a new
one when it restarts.

B) However: It is entirely possible that the files simply contain a
Windows macro that is designed to do something such as intercept the Save
command and steer the document to a document management system.

In which case, the Virus scan will come back clean, because what you have is
simply a macro - a program designed to run within Word.

Such a macro will crash Word 2004 if it were written containing Windows
commands.

That leaves you trying to remove the macros from Word files, which is a pain
of a job. Probably the easiest thing to do is to open the document
one-by-one in Word 2008. Word 2008 will prompt you if it finds macros in a
document and give you the option to "Open and Remove".

Click that and then save the document to save it back without its macros.

C) It is possible that the documents in question do not contain any macro
code at all: it may be that they simply contain a "customisation" such as a
toolbar or a keystroke assignment.

That's more difficult to get rid of. You can try saving each document as a
"Web Page" (which will strip the customisations). Close and re-open the
web-page version then save back as a Document. It's a lot of work.

Hope this helps

Version: 2004
Operating System: Mac OS X 10.4 (Tiger)
Processor: Power PC

Several users at a client of mine run Word 2004 on a combination of PPC and
Intel Macs all running OS X 10.4.11 and Word version 11.5.0 or higher.
Recently, they started using a word document (.doc) as a report template. The
document has a JPEG graphic in it and originated on a PC.

Now whenever they open any Word file, they are getting the warning dialog to
disable macros. If they enable macros, the files will crash most of the time.
If they disable, the file goes to read only - if they try to Save As...
another name, that file is also read only.

In addition, if they create a new file and try to save it, they will get a
warning dialog that Word 2004 shares the same file format as Word 97-2003 and
do they want to append the .doc extension? After they save the file, the
disable macro behavior above occurs next time they try to open the file.

(BTW, for now I am asking them to print any new files to PDF format if they
need to make them available to others. I have also asked them to create a new
document to use as the template.)

What is the culprit? PC Word macro virus?
How do I address this problem most expeditiously?
Will a normal anti-virus program clear out the virus?
Will I have to reinstall Office? Since I have no idea where a macro virus
"hangs out", I started by trying to clear out all preference files. No luck.

Any help will be GREATLY appreciated!

--

Don't wait for your answer, click here: http://www.word.mvps.org/

Please reply in the group. Please do NOT email me unless I ask you to.

John McGhie, Microsoft MVP, Word and Word:Mac
Nhulunbuy, NT, Australia. mailto:[email protected]

 

[John McGhie]

Hi John:

Your problem is a lot simpler: You do not have a "Virus", you have a
"Macro" or a "Customisation" in your Normal template, and it is being copied
into each new document you open.

If Norton AV is up to date, and it did not find it, then it's not a virus:
simply a macro or customisation. It is perfectly legitimate to have macros
in a Word document, although I strongly recommend against doing this to
avoid the problem you are now having.

I am not entirely sure what you have, so let's find out. Quit Word (must be
not running not minimised) and drag your Normal template to your desktop.

Now restart and see if you have cured your problem. If you have, trash that
old Normal template, because Word has now created a new one.

If that doesn't fix it, come back here with more information on what you
have tried and the exact text of the warning you are getting.

Cheers

I am experiencing a similar problem. My Hardware and software config. is
similar to yours - Mac OS X 10.4 (Tiger) PPC Processor. Every time I create a
document in Word 2004 and attempt to modify it, the document opens as a "Read
Only" and I receive the warning dialog about Macros. I disable the macros,
rename the file but the behavior persists each time the file is opened. I have
run Norton Anti-Virus but to no avail.

Help!!
Irritated.

--

Don't wait for your answer, click here: http://www.word.mvps.org/

Please reply in the group. Please do NOT email me unless I ask you to.

John McGhie, Microsoft MVP, Word and Word:Mac
Nhulunbuy, NT, Australia. mailto:[email protected]

 

[John McGhie]

ColibriNY:

I forgot to mention: users on modern Macs should routinely add the file
extension to every file: Word doesn't care, but Mac OS X uses them.

Cheers

Version: 2004
Operating System: Mac OS X 10.4 (Tiger)
Processor: Power PC

Several users at a client of mine run Word 2004 on a combination of PPC and
Intel Macs all running OS X 10.4.11 and Word version 11.5.0 or higher.
Recently, they started using a word document (.doc) as a report template. The
document has a JPEG graphic in it and originated on a PC.

Now whenever they open any Word file, they are getting the warning dialog to
disable macros. If they enable macros, the files will crash most of the time.
If they disable, the file goes to read only - if they try to Save As...
another name, that file is also read only.

In addition, if they create a new file and try to save it, they will get a
warning dialog that Word 2004 shares the same file format as Word 97-2003 and
do they want to append the .doc extension? After they save the file, the
disable macro behavior above occurs next time they try to open the file.

(BTW, for now I am asking them to print any new files to PDF format if they
need to make them available to others. I have also asked them to create a new
document to use as the template.)

What is the culprit? PC Word macro virus?
How do I address this problem most expeditiously?
Will a normal anti-virus program clear out the virus?
Will I have to reinstall Office? Since I have no idea where a macro virus
"hangs out", I started by trying to clear out all preference files. No luck.

Any help will be GREATLY appreciated!

--

Don't wait for your answer, click here: http://www.word.mvps.org/

Please reply in the group. Please do NOT email me unless I ask you to.

John McGhie, Microsoft MVP, Word and Word:Mac
Nhulunbuy, NT, Australia. mailto:[email protected]

 

[Phillip Jones, C.E.T.]

ColibriNY:

I forgot to mention: users on modern Macs should routinely add the file
extension to every file: Word doesn't care, but Mac OS X uses them.

Cheers

--
------------------------------------------------------------------------
Phillip M. Jones, CET mailto[email protected]
If it's "fixed", don't "break it"! http://www.vpea.org
http://www.kimbanet.com/~pjones/default.htm
G4-500 Mac 1.5 GB RAM OSX.3.9 G4-1.67 GB PowerBook 17" 2GB RAM OSX.4.11
------------------------------------------------------------------------

 

[CyberTaz]

Just for clarification, Phillip: That Finder setting simply determines that
filename extensions are displayed *if* present. It does not add extensions
to any filenames. The user needs to type them when naming the file or use
the checkbox in Save As to "Append file extensions"... which is the safer
option.

Regards |:>)
Bob Jones
[MVP] Office:Mac

 

[Phillip Jones, C.E.T.]

To turn it on permanently what you are talking about the first time you
save any document there is a box you check that says something like
append extension to files. once this is turned on it turned on for every
application.

Just for clarification, Phillip: That Finder setting simply determines that
filename extensions are displayed *if* present. It does not add extensions
to any filenames. The user needs to type them when naming the file or use
the checkbox in Save As to "Append file extensions"... which is the safer
option.

Regards |:>)
Bob Jones
[MVP] Office:Mac

--
------------------------------------------------------------------------
Phillip M. Jones, CET mailto[email protected]
If it's "fixed", don't "break it"! http://www.vpea.org
http://www.kimbanet.com/~pjones/default.htm
G4-500 Mac 1.5 GB RAM OSX.3.9 G4-1.67 GB PowerBook 17" 2GB RAM OSX.4.11
------------------------------------------------------------------------

 

[CyberTaz]

once this is turned on it turned on for every
application

Definitely NOT true - Perhaps you meant "turned on for every" *file* saved
by that app from then on, or "remains in place until you remove it"?

Heaven help us if settings you make in one program's Save As dialog ever
universally affect the save specs for all other programs.

Regards |:>)
Bob Jones
[MVP] Office:Mac

 

[Phillip Jones, C.E.T.]

When you do save AS or Save for first time you see a box. for title.
Then in bottom left corner there is the check box about add extensions.

once checked you never have to check it again. At least that is what I
have found.

Definitely NOT true - Perhaps you meant "turned on for every" *file* saved
by that app from then on, or "remains in place until you remove it"?

Heaven help us if settings you make in one program's Save As dialog ever
universally affect the save specs for all other programs.

Regards |:>)
Bob Jones
[MVP] Office:Mac

--
------------------------------------------------------------------------
Phillip M. Jones, CET mailto[email protected]
If it's "fixed", don't "break it"! http://www.vpea.org
http://www.kimbanet.com/~pjones/default.htm
G4-500 Mac 1.5 GB RAM OSX.3.9 G4-1.67 GB PowerBook 17" 2GB RAM OSX.4.11
------------------------------------------------------------------------

 

[CyberTaz]

That's correct - but it isn't what you originally wrote

Regards |:>)
Bob Jones
[MVP] Office:Mac

 

[Phillip Jones, C.E.T.]

But once you do that regardless of what application that comes up it
will be unchecked. And the wording is *hide extension*

Its possible the first time you open a new application that it shows as
checked. unchecking it sets it off permanently.

when I installed 2008 on my Laptop and new drive I don't remember having
to uncheck hide extensions.

That's correct - but it isn't what you originally wrote

Regards |:>)
Bob Jones
[MVP] Office:Mac

--
------------------------------------------------------------------------
Phillip M. Jones, CET mailto[email protected]
If it's "fixed", don't "break it"! http://www.vpea.org
http://www.kimbanet.com/~pjones/default.htm
G4-500 Mac 1.5 GB RAM OSX.3.9 G4-1.67 GB PowerBook 17" 2GB RAM OSX.4.11
------------------------------------------------------------------------

 

[CyberTaz]

Hi Phillip;

I don't want to belabor this discussion, but you're referring to 2
completely different & independent settings:

One is the OS X Finder setting that determines whether extensions are
displayed for filenames which *have* extensions,

The other is a Save As setting in each application which determines whether
extensions are automatically appended to the filenames.

Nothing about the one changes anything about the other & the setting in any
one program's Save As doesn't change the setting in any other program's Save
As.. IOW, if you choose to append extensions in Word it doesn't make Excel
append them. If you have the Finder set to display extensions you'll see
them for the Word file which have them but you won't see any for the Excel
files which don't. Likewise, if some Word files don't have extensions the
Finder setting won't "magically" make them appear - they'll only be
displayed for those filenames to which they've actually been added.

Regards |:>)
Bob Jones
[MVP] Office:Mac