Macros virus on Macintosh - help save my files

[Diana]

Is there any software, free or otherwise that will actually save the
documents that have been infected with a macros virus? I have ran
clamxav and it "quarantines" them, but in the end I have to either
delete them or try and copy the contents into another document. I need
to be able to "clean" these documents. Can anyone help me?

 

[Corentin Cras-Méneur]

Is there any software, free or otherwise that will actually save the
documents that have been infected with a macros virus? I have ran
clamxav and it "quarantines" them, but in the end I have to either
delete them or try and copy the contents into another document. I need
to be able to "clean" these documents. Can anyone help me?

There are various antiviruses out there, but I wonder whether you could
save the files in RTF to eliminate the Macro that's causing you all the
trouble.
You could also open the files in TextEdit or Pages. Since these apps
can't do anything with the macros, they might be able to save as another
macro-free format and rescue some of the text (and that would avoid
launching Word at all and therefore limit the extend of what the virus
can do).

Corentin

 

[John McGhie [MVP - Word and Word Macintosh]]

Hi Diana:

Yes, Word will do it.

In Preferences>Security>... Make sure "Warn before opening a file that
contains macros" is switched ON.

I suspect that the infection may have spread to your Normal template as
well. That's easy to deal with, but it must be done first...

1) Quit Word (not just minimised, it must be quit)

2) Find your Normal template and re-name it (don't delete it...)

3) Re-start Word and quit it again (that creates a new blank Normal
template). Now you can delete the old one.

Then move the suspect documents to a folder and open them normally. When
you see the Macro Warning, say "No" (which removes the virus code).

Copy the text and paste it into a new document.

That's all there is to it.

Cheers

Is there any software, free or otherwise that will actually save the
documents that have been infected with a macros virus? I have ran
clamxav and it "quarantines" them, but in the end I have to either
delete them or try and copy the contents into another document. I need
to be able to "clean" these documents. Can anyone help me?

--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <[email protected]>
Microsoft MVP, Word and Word for Macintosh. Business Analyst, Consultant
Technical Writer.
Sydney, Australia +61 (0) 4 1209 1410

 

[Corentin Cras-Méneur]

When
you see the Macro Warning, say "No" (which removes the virus code).

Out of curiosity John, does it remove it or simply prevents it from
launching in this work session??
I hardly ever receive Word Docs with MacroViruses, so I never had a
chance to "play" with that.

Corentin

 

[Diana]

Thanks to everyone for your suggestions!!

Hi Corentin:

Macro Security prevents it from running. Copy does not copy the VBA
container

If you allow the macro to run, it will, of course, replicate to the current
template (usually: it's more difficult but not impossible to copy a macro
into the current document).

So when she opens the "macro-infected" document, chances are it's the Normal
Template file that actually contains the infection. But not necessarily

Cheers



--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <[email protected]>
Microsoft MVP, Word and Word for Macintosh. Business Analyst, Consultant
Technical Writer.
Sydney, Australia +61 (0) 4 1209 1410

 

[Corentin Cras-Méneur]

Hi Corentin:

Macro Security prevents it from running. Copy does not copy the VBA
container

That's what I tought, but your phrasing " When you see the Macro
Warning, say "No" (which removes the virus code)." made me wonder
whether there was a trick I didn't know about for a moment.

If you allow the macro to run, it will, of course, replicate to the current
template (usually: it's more difficult but not impossible to copy a macro
into the current document).

Since recent announcements mentioned a flaw in the security in Word
(including in the Mac version), I thought that opening the files in
applications that can read WOrd format, but cannot run macro even if
they wanted to was a safe alternative

So when she opens the "macro-infected" document, chances are it's the Normal
Template file that actually contains the infection. But not necessarily

Cheers

My point precisely... :-\


Corentin

 

[little_creature]

What about removing all suspicious macros (modules) from infected files and
template? Could there be any trouble I cannot see now?

 

[Corentin Cras-Méneur]

What about removing all suspicious macros (modules) from infected files and
template? Could there be any trouble I cannot see now?

No problem there. Deleting these macros is the way to go.
I'm just probably over-zealous when it comes to viruses and I don;t want
to take any chance

Corentin

 

[John McGhie [MVP - Word and Word Macintosh]]

Hi Little Creature:

The problem with that method is that if there *was* any malware in the file,
by the time you are able to view the macros in the file, it has already got
you

Cheers

What about removing all suspicious macros (modules) from infected files and
template? Could there be any trouble I cannot see now?

--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <[email protected]>
Microsoft MVP, Word and Word for Macintosh. Business Analyst, Consultant
Technical Writer.
Sydney, Australia +61 (0) 4 1209 1410

 

[John McGhie [MVP - Word and Word Macintosh]]

Hi Corentin:

That's what I tought, but your phrasing " When you see the Macro
Warning, say "No" (which removes the virus code)." made me wonder
whether there was a trick I didn't know about for a moment.

Yeah, that was careless phrasing. As far as I know, if you "open" the file
with Macros disabled (by saying "No" to the Macro Warning...) the file
loaded into memory does not contain the macro code.

If you then SAVE what you opened, the copy in memory overwrites the copy on
disk and the macro code is permanently removed.

If the bad code is in the Normal template, unfortunately it will run anyway,
because the Normal template is in a "Trusted" location from which the Macro
Warning is suppressed.

So your original advice is much safer than mine

Alternatively, the user should re-name the Normal Template and THEN open the
files with the macro warning enabled. Since the suspect files are in a
non-trusted location, the macro warning will fire as normal.

Cheers


--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <[email protected]>
Microsoft MVP, Word and Word for Macintosh. Business Analyst, Consultant
Technical Writer.
Sydney, Australia +61 (0) 4 1209 1410

 

[Bob Greenblatt]

Hi Corentin:



Yeah, that was careless phrasing. As far as I know, if you "open" the file
with Macros disabled (by saying "No" to the Macro Warning...) the file
loaded into memory does not contain the macro code.

If you then SAVE what you opened, the copy in memory overwrites the copy on
disk and the macro code is permanently removed.

If the bad code is in the Normal template, unfortunately it will run anyway,
because the Normal template is in a "Trusted" location from which the Macro
Warning is suppressed.

So your original advice is much safer than mine

Alternatively, the user should re-name the Normal Template and THEN open the
files with the macro warning enabled. Since the suspect files are in a
non-trusted location, the macro warning will fire as normal.

Cheers

PMFJI, but maybe WORD is different than Excel. If you answer "disable" to
the macro warning message on an Excel workbook, it simply opens but does not
EXECUTE the macro code. The macro code is still present within the file,
however. If you then save this file in another place, or with another name
(or both) the code is still present. When you reopen the new file, the macro
code is still present and will run unless disabled again. So, for Excel,
saving a file that has been opened with macros disabled DOES NOT remove the
macros from the file.

 

[John McGhie [MVP - Word and Word Macintosh]]

I KNEW I shoulda tested this...

OK, Corentin and Bob are correct, I was wrong

The Mac Word 2004 macro warning function offers the option to "Disable
Macros" or "Do Not Open".

If you select "Disable Macros" it works just the way it says: it disables
the macros and leaves them in the document.

If you then Save As, the macros are saved and will run next time you open
the document.

{Sigh} I wish they wouldn't change things: I used to rely on that function
to "clean" documents...

Cheers

PMFJI, but maybe WORD is different than Excel. If you answer "disable" to
the macro warning message on an Excel workbook, it simply opens but does not
EXECUTE the macro code. The macro code is still present within the file,
however. If you then save this file in another place, or with another name
(or both) the code is still present. When you reopen the new file, the macro
code is still present and will run unless disabled again. So, for Excel,
saving a file that has been opened with macros disabled DOES NOT remove the
macros from the file.

--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <[email protected]>
Microsoft MVP, Word and Word for Macintosh. Business Analyst, Consultant
Technical Writer.
Sydney, Australia +61 (0) 4 1209 1410

 

[Clive Huggan]

John, Corentin or Bob,

Would one of you care to summarize the situation for people who are
concerned about how they should manage macro viruses such as this? It would
make for much easier reference than criss-crossing through this thread.

Only if you have the time, of course.

Cheers,
Clive
=====

 

[John McGhie [MVP - Word and Word Macintosh]]

Hi Clive:

1) Buy, run and keep updated an effective Internet Security Suite.

2) Enjoy...

If you suspect that a document you have contains or may contain a virus:

A) make sure you place the document in a "non-trusted" location (e.g. Your
desktop). The Macro Warning will not operate if the document is in your
User Templates or Workgroup Templates folder.

B) Open the document.

C) If you see the Macro Warning, click Disable

D) If you saw the Macro Warning, save the document as HTML (Web Page).

E) If you saved as HTML, close the original document and open the web page
version.

F) Save that as a Word document.

HTML will not support macro code, so the virus will be stripped by this
process.

Cheers

John, Corentin or Bob,

Would one of you care to summarize the situation for people who are
concerned about how they should manage macro viruses such as this? It would
make for much easier reference than criss-crossing through this thread.

Only if you have the time, of course.

Cheers,
Clive
=====

--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <[email protected]>
Microsoft MVP, Word and Word for Macintosh. Business Analyst, Consultant
Technical Writer.
Sydney, Australia +61 (0) 4 1209 1410