Absolute PC Security and Privacy.pdf

Figure 4.2 : Searching for macro viruses in Microsoft Word
The only problem with this method, of course, is that you don’t know how the macro virus is
named. It’s a sure bet that the virus writer didn’t name the virus Macro Virus. (Some macro
names you might look for include AAAZAO, AAAZFS, and PayLoad—all of which contain
virus code.)
In addition, some macro viruses actually disable the Macro menu item within the host
program. If you find that you can’t access the list of macros for a given document, that’s a
good sign that that document is infected.
Poorly written macro viruses—or some viruses written for an older or newer version of your
program—might not run “properly” on your system. If your system displays one or more error
messages relating to macros not running (or something to do with WordBasic or VBA) when
you load a document, that’s an indication that the document contains a macro virus—which,
fortunately, is not running on your system.
Another sign of macro virus infection concerns the default program settings in Word, Excel,
and other Office applications. Many macro viruses change some of the default settings, which
are typically found in the program’s Options dialog box. If you find your default settings
suddenly changed, your system could be infected.
How to Remove a Macro Virus
The easiest way to both detect and remove macro viruses is to use one of the major antivirus
programs, as discussed in Chapter 9. Virtually all of these programs include scanning and
disinfecting for macro viruses, especially for viruses that infect Microsoft Word documents.
With these programs, removing a macro virus is as easy as clicking a button.
If you’re ambitious, you can attempt to remove a macro virus by removing each of the virus
macros from an infected document or document template. In Microsoft Word XP (also called
Word 2002), you’d follow these steps:
1. Select Tools > Macro > Macros to open the Macros dialog box.
2. Select the macro(s) to delete from the Macro Name list.
3. Click Delete.
Warning If you think you’ve just opened an infected document, you should use this
procedure to delete the suspect macros before you close the document or