Preventing Microsoft Word Macro Viruses

Although our focus is on Word­Press… we often get ques­tions from our clients about non-Word­Press virus and hack issues.

Here are some thoughts on com­mon ques­tions we get about MS Word virus­es.

Microsoft Word mal­ware rarely makes the news these days but unfor­tu­nate­ly it exists. Word files received from oth­er com­put­ers or a net­work car­ry a risk. Just because you have an anti-virus pro­gram installed on your com­put­er does­n’t mean you’re a 100% safe. They can’t do any­thing until an update comes with a patch to fix the prob­lem.

To pro­tect your­self from a Word macro virus you first need to know what is.

What is a Word Macro Virus?

Word has a pow­er­ful fea­ture which lets you cre­ate Visu­al Basic for Appli­ca­tions (VBA) pro­grams– also known as macros. Macro virus­es use this fea­ture to copy the virus’s code to oth­er files. VBA pro­grams are stored in the Word doc­u­ment and tem­plate files.

The virus dupli­cates the code auto­mat­i­cal­ly to anoth­er file, usu­al­ly Normal.dot, which is what Word loads with every file. So when­ev­er you open or close the Word file or Microsoft Word itself, the virus copies itself.

Microsoft Word Macro Virus

Pre­ven­tion

  • Doc­u­ment all files in the Word file’s start­up fold­er and macros (if you don’t know how to find Word’s start­up fold­er, use this quick tuto­r­i­al). Write down the list of files and macros some­where or take a screen­shot and save it in a mem­o­rable place on your hard dri­ve.
  • If you think you’ve caught a macro virus, then you can then check for virus­es man­u­al­ly. Go to Tools> Macro> Macros in Word’s menu and a list of macros will be dis­played. Com­pare these against the list you cre­at­ed ear­li­er. Pay extra atten­tion to any macros named AutoEx­ec, AutoOpen, Auto­Close, File­Ex­it, File­New, FileOpen, File­Save, File­SaveAs, and Tools­Macro.
  • In Word 97, you need to man­u­al­ly enable virus pro­tec­tion against macros. In the Word menu, go to Tools> Options, click on the Gen­er­al tab, and check the box for Macro virus pro­tec­tion (it might already by checked).
  • In Word 2000, you can set the secu­ri­ty set­ting by going to Tools> Macro> Secu­ri­ty and set­ting the secu­ri­ty lev­el to medi­um. It will auto­mat­i­cal­ly warn you if you are open­ing a file that con­tains a macro.