Word 2004 - Macro problem, Macro seems to be saved in all files.

[jellway]

Hi all,

I have this weird happening for all the Word users in our office
network.


Any .doc file they create, save and then open again comes up the with a
dialog box that asks:
"The document you are opening contains macros or customizations. Some
macros may contain viruses that could harm your computer...'Enable
Macros', 'Disable Macros', 'Do Not Open'.


If I go into Tools>Macro>Macros... there are non shown as running or
contained in the document.


So we could just click 'ignore' when the the file opens, but this
becomes a problem when we send emails to users with antivirus programs
running on a PC or Mac (Norton is the program they have been using).
The file is identified as containing a macro virus - zdflkjnbdlsbn

To make things even stranger I have a near identical setup on my laptop
and the files it create are fine and contain no macro. (maybe it isnt
'near identical').

I had a feeling it may have been somethign to do tithe the PDF plugin
(Acrobat 6) for word so I removed this and the PDFMaker.dot file from
the Office startup folder and PDFMakerLib file.....didn't solve
anyhting.

So we could just click 'ignore' when the the file opens, but this
becomes a problem when we send emails to users with antivirus programs
running on a PC or Mac (Norton is the program they have been using).
The file is identified as containing a macro or virus - The file
contains the macro or PC virus W97M.Thus.A

To make things even stranger I have a near identical set-up on my
laptop and the files it create are fine and contain no macro.


See below the message from nortons that one of our clients emailed to
us....


Quote from anti-virus web site - "This is a simple but dangerous macro
virus attacking Microsoft Word 97 documents. It was named after the
commentary line 'Thus_001' which it uses to check whether a document
has already been infected. Upon opening an infected document it turns
off the Word anti-virus protection and tries to attack the template
NORMAL.DOT and all documents that are open at the moment.
On December 13th the macro virus deletes all files and directories on
the hard disk C:"

Norton AntiVirus Scan Report
Scan started at 02/13/2006, 06:59:59 PM
Scan ended at 02/13/2006, 10:04:06 PM

Items selected to scan
The volume Macintosh HD

Summary
Repair was enabled
The scan completed
2 total infection(s) found
0 infection(s) found in archives
0 infected archive(s) found
0 file(s) repaired
2 file(s) could not be repaired
0 file(s) were quarantined

Problems encountered

1005087A.doc
Macintosh HD/private/tmp/546-43f03c80-90ac-9SfxBI/
The file contains the macro or PC virus W97M.Thus.A

1005087E.doc
Macintosh HD/private/tmp/546-43f03c80-90ac-9SfxBI/
The file contains the macro or PC virus W97M.Thus.A





Has anyone else had this problem before?

Any ideas?

 

[jellway]

as a note I am using Office 2004 11.2.1

and have also tried reinstalling the whole suite.

 

[John McGhie [MVP - Word and Word Macintosh]]

Hi:

The clue is in NAV's report. You do have a virus, and it is in the hidden
TEMP file that Word creates when Normal.dot is opened. The Temp file saves
pending changes to each open document, waiting for the user to confirm the
save.

Norton can't clean those files because they are open (locked by Word). So
its attempt to clean the file fails. The TEMP folder is normally invisible
unless you are logged in as root.

You need to first do a power-off restart of each system. When You shot down
and turn the power off to the computer at the wall point, then restart OS X,
you trigger the Unix housekeeping routine that 'should' empty all of the
TEMP files on the hard drive.

Then run a full system scan before allowing Word to start. Norton should
then succeed in cleaning all of the other instances.

If you want to be totally sure, physically disconnect each machine from the
network, and don't reconnect it until you have de-loused it. And remember
to do the servers, and all of the laptops that connect to the network too:
once these things get lose they go everywhere.

Yes, once a Macro Virus gets lose, it contains code that enables it to copy
itself to any documents that Word opens, and to re-install itself if you
delete Normal.

The PDF Maker add-in is a pest, it "could" trigger a 'Customisations'
warning for Normal.dot -- because it does make a change to the toolbars, and
that counts as a customisation. However, it does not generally produce this
error. On the other hand, some Macro viruses attempt to infect PDFMaker.dot
because they know that if it's present, it will be in a "trusted" location
from which they can spread their nasty code.

Hope this helps

Hi all,

I have this weird happening for all the Word users in our office
network.


Any .doc file they create, save and then open again comes up the with a
dialog box that asks:
"The document you are opening contains macros or customizations. Some
macros may contain viruses that could harm your computer...'Enable
Macros', 'Disable Macros', 'Do Not Open'.


If I go into Tools>Macro>Macros... there are non shown as running or
contained in the document.


So we could just click 'ignore' when the the file opens, but this
becomes a problem when we send emails to users with antivirus programs
running on a PC or Mac (Norton is the program they have been using).
The file is identified as containing a macro virus - zdflkjnbdlsbn

To make things even stranger I have a near identical setup on my laptop
and the files it create are fine and contain no macro. (maybe it isnt
'near identical').

I had a feeling it may have been somethign to do tithe the PDF plugin
(Acrobat 6) for word so I removed this and the PDFMaker.dot file from
the Office startup folder and PDFMakerLib file.....didn't solve
anyhting.

So we could just click 'ignore' when the the file opens, but this
becomes a problem when we send emails to users with antivirus programs
running on a PC or Mac (Norton is the program they have been using).
The file is identified as containing a macro or virus - The file
contains the macro or PC virus W97M.Thus.A

To make things even stranger I have a near identical set-up on my
laptop and the files it create are fine and contain no macro.


See below the message from nortons that one of our clients emailed to
us....


Quote from anti-virus web site - "This is a simple but dangerous macro
virus attacking Microsoft Word 97 documents. It was named after the
commentary line 'Thus_001' which it uses to check whether a document
has already been infected. Upon opening an infected document it turns
off the Word anti-virus protection and tries to attack the template
NORMAL.DOT and all documents that are open at the moment.
On December 13th the macro virus deletes all files and directories on
the hard disk C:"

Norton AntiVirus Scan Report
Scan started at 02/13/2006, 06:59:59 PM
Scan ended at 02/13/2006, 10:04:06 PM

Items selected to scan
The volume Macintosh HD

Summary
Repair was enabled
The scan completed
2 total infection(s) found
0 infection(s) found in archives
0 infected archive(s) found
0 file(s) repaired
2 file(s) could not be repaired
0 file(s) were quarantined

Problems encountered

1005087A.doc
Macintosh HD/private/tmp/546-43f03c80-90ac-9SfxBI/
The file contains the macro or PC virus W97M.Thus.A

1005087E.doc
Macintosh HD/private/tmp/546-43f03c80-90ac-9SfxBI/
The file contains the macro or PC virus W97M.Thus.A





Has anyone else had this problem before?

Any ideas?

--

Please reply to the newsgroup to maintain the thread. Please do not email
me unless I ask you to.

John McGhie <[email protected]>
Microsoft MVP, Word and Word for Macintosh. Consultant Technical Writer
Sydney, Australia +61 (0) 4 1209 1410

 

[jellway]

Thanks John...fantastic.....

So Mac's really can have and distribute a virus!

I will do as you ahve outlined.....

We don't have Norton for Mac here in the office....only one of our
clients....does any one have any suggestions for the best anti virus
program to pick up things like this?

I have heard Norton can take over the system a bit.....any other
suggestions?

thanks

John

 

[Beth Rosengard]

I use VirusBarrier X4 but check the MacWorld website for the latest ratings
on anti virus products for the Mac.

Beth

 

[matt neuburg]

So Mac's really can have and distribute a virus!

Well - no. It's Microsoft that is the problem. The notion of code in a
document is what's reponsible for this. All Microsoft had to do was
stick to the time-honored principle of keeping executable and data
separate, but no... m.

 

[matt neuburg]

We don't have Norton for Mac here in the office....only one of our
clients....does any one have any suggestions for the best anti virus
program to pick up things like this?

Word DID pick it up, remember? It said:

"The document you are opening contains macros or customizations. Some
macros may contain viruses that could harm your computer."

All that had to happen is that whoever first saw that dialog didn't open
the document. You then knew you had a virus and you simply ignored that
knowledge. No amount of Nortoning or whatever can make up for this.
What's needed in the office isn't software, it's human re-engineering.
Take everyone out back and flog them! m.

 

[Beth Rosengard]

Word DID pick it up, remember? It said:

"The document you are opening contains macros or customizations. Some
macros may contain viruses that could harm your computer."

All that had to happen is that whoever first saw that dialog didn't open
the document. You then knew you had a virus and you simply ignored that
knowledge. No amount of Nortoning or whatever can make up for this.
What's needed in the office isn't software, it's human re-engineering.
Take everyone out back and flog them! m.

Hi Matt,

I'm trying to figure out how this might be helpful *now*. Sure, it would
have been better not to open an infected document in the first place. Then
again, what if the original document came from a trusted source (who
presumably didn't know it was infected)?

At this point in time, "jellway's" user does most certainly need an
anti-virus program to remove the infection. That may not "make up for"
having contracted the virus in the first place, but it will solve the
current problem.

And why do you say (in your other post) that Macs can't have or distribute a
virus. They most certainly *can* distribute one. And the fact that known
viruses on the Mac have been carried in MSFT docs doesn't mean the Mac can't
get a virus. Do you really think it's not ever going to happen?

Beth

 

[matt neuburg]

Hi Matt,

I'm trying to figure out how this might be helpful *now*. Sure, it would
have been better not to open an infected document in the first place. Then
again, what if the original document came from a trusted source (who
presumably didn't know it was infected)?

At this point in time, "jellway's" user does most certainly need an
anti-virus program to remove the infection. That may not "make up for"
having contracted the virus in the first place, but it will solve the
current problem.

And why do you say (in your other post) that Macs can't have or distribute a
virus. They most certainly *can* distribute one. And the fact that known
viruses on the Mac have been carried in MSFT docs doesn't mean the Mac can't
get a virus. Do you really think it's not ever going to happen?

I'm not going to get into another slanging match. I know what I meant.
m.