BU Web: Virus Alert - Protecting Against Macro Viruses

A macro virus is a computer virus that is written in the macro language of a program such as Word or Excel or Access. It is attached to a document or template file and spreads when that file is opened

Macro viruses do not travel freely over the Internet or any other media; they only spread when you open an infected document or template. For example, if you open a Word document or template that has a macro virus, then any other Word document that you open on your computer can also get "infected" by the macro virus.

Some macro viruses are just annoying, but others are very destructive. These viruses can spread very rapidly. Fortunately, once you know about macro viruses, it is easy to protect yourself against them – read on for details.

If you are familiar with the Word macros you have on your system, you can go to Tools® Macros and look through the various macros for ones that you do not recognize. It is possible that one, or more, of them are part of a macro virus that has infected your system. Some examples of these type of macro names are: AAAZAO, AAAZFS, AutoOpen, FileSaveAs, and PayLoad.

Unexplainable behavior on your system; for example, you may be prompted for a password on a file that you know does not contain a password or your document may be unexpectedly saved as a template.
Unusual error messages, for example: ROBERTA TI AMO!

Will old versions of Word or Excel (prior to Word97 and Excel 97) protect me from macro viruses?

These older versions of software have no built-in protection from macro viruses, but you can protect yourself by running a current anti-virus program and by being aware of symptoms of macro viruses. If you receive a suspicious document, you can disable all macros by holding down the Shift key each time you open the document. For more tips on macro virus protection in older versions of Word and Excel, see http://support.microsoft.com/default.aspx?scid=fh;EN-US;KBINFO

You might consider upgrading to a newer version of Word or Excel that does have macro virus protection – that’s what Microsoft suggests, but they do have a vested interest! On the other hand, some macro viruses are written specifically to infect newer versions of software and may have no effect on the older ones. It’s a trade-off – probably macro virus protection alone is no reason to decide to upgrade, but if you have other reasons for upgrading, go ahead.

Yes – if you let it. Microsoft Office applications including Microsoft Word and Microsoft Excel are designed to protect you from macro viruses, provided the macro virus protection in these applications is turned on (which is the default setting). With the macro virus protection turned on, every time you open a document that contains macros, a dialog box appears and asks you to choose whether to enable or disable included macros.

You should always disable macros when you are not certain of their purpose or functionality. By choosing to disable the macros, you will prevent any macro viruses from running, preventing infection by the virus.

A macro virus is only activated if you open the attached document and choose to enable the macros or if your macro virus protection settings have been previously turned off and you open the attachment.

IMPORTANT: If you are not able to follow the steps below because you cannot find the menu items, you may already be infected. If so, run anti-virus software containing the latest update, and scan your system often. If you are not able to run anti-virus software, it will be necessary to delete or rename your normal.dot file on a PC or your Normal file on a Mac. This is Word's global template that will automatically be recreated once Word is launched. After this is done, repeat the steps below.

1.On the Tools menu, click Options (on a PC) or Preferences (on a Macintosh).

Enabling virus protection in Word 97

Enabling virus protection in Excel 97

Double-click on the Tools menu, point to Macro and then choose Security.
Select the level of security you want.

High security will allow only macros that have been signed to open. Unsigned macros will be automatically disabled.
Medium security always brings up the macro dialog protection box that allows you to disable macros if you are unsure of the macros.

How do I ensure I will not be infected? What should I do if I think I have been infected by a macro virus?

Ensure the Office macro virus protection is turned on as described above. Always choose "disable macros" when asked, if you are unsure of the purpose of the macro in the document. Doing so will still allow you to open the document and read its contents. Once certain the macro is safe, and only if you need to run the macro, you can then re-open the document and enable the macro.

Run the latest anti-virus software, and scan often. This is how you can ensure that the macros in documents are safe. Also remember to keep your anti-virus software up to date by installing the latest signature files for that company. (Most companies creating anti-virus applications release a new signature file each month.) Boston University has a site license for McAfee VirusScan and Virex anti-virus software, which is available to you at BU's anti-virus software Web site.

Communicate this information to all those who could become infected.

Visit the Microsoft anti-virus Web site http://office.microsoft.com/assistance/9798/virusres.aspx to learn more about macro viruses.
See the BU virus Web site www.bu.edu/computing/virus to read about any particularly troublesome viruses affecting Boston University.
Go to BU's anti-virus software Web site for the latest version of McAfee VirusScan and Virex anti-virus software. Our site license agreement means that this software is free to all students, faculty and staff at Boston University.