An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#9652 - 04/23/10 10:55 AM Word Macro Virus
Starmac Offline


Registered: 04/23/10
Can Word macro viruses still possibly infect Word for Mac? Is there a way to detect them? Does it matter if I have an older version of Word?

I receive a ton of Word docs from the PC world. It's crazy over there the way virus and spyware spread.

Thanks for any update.
_________________________
Macs are best, there, I've said it. It must be true.

Top
#9667 - 04/24/10 10:43 AM Re: Word Macro Virus [Re: Starmac]
Virtual1 Offline


Registered: 08/04/09
Loc: Iowa
Can Word macro viruses still possibly infect Word for Mac?

Absolutely.

Is there a way to detect them?

Usually the most foolproof way of detecting them is when you open a document you haven't opened in awhile, and go to close it without making changes, it asks if you want to save changes. This means the macro has copied itself into the new document you opened, and wants this change saved. This means your office software is infected, usually in the "dotnormal" file, a template that opens every time word or excel is launched, and of course can contain macros.

Otherwise, go into the security settings for word and excel and turn on macro detection. Then it should pop up a dialog when a document is opened that contains macros. If you're running one of the newest versions of office, it should allow you to open the document without running the macros. From there, save the document under a non-office format, and then re-import it into office, to purge the macros.

VERY few documents have macros that belong there. The person that sent it to you should be able to confirm they belong. Be careful that they're not a really dim bulb and say "don't worry about that, it always does that here, that's normal." (i.e. they're blissfully unaware that they're infected, and have been so for some time now, hello typhoid mary)

Does it matter if I have an older version of Word?

Not really. These macro viruses go back well beyond office 2004.

I receive a ton of Word docs from the PC world. It's crazy over there the way virus and spyware spread.

Agreed. Don't use MS Office. OR, if you have 2008 or later, they graciously added an option that allows you to open a document that has macros in it, without executing it.

COMPLETELY brain-dead logic in previous version such as 2004 allowed you to turn on a macro warning, but all that did was force you to acknowledge the macros in the file you just opened, and allow them to run. (or NOT open the file) Of course, 99% of users say "but I HAVE TO HAVE THAT" and open it anyway, knowing there's a virus in it. Makes for a reoccurring mess.

There are many versions of OpenOffice. NeoOffice seems to be the best one, and is very actively maintained. It does fine with office documents. iWork 09 isnt' too bad either.


Making matters worse, if you go in and actually remove the macros, the macros themselves aren't removed, they're just cleared of any instructions. So there's still macros in them. Actually removing the macros sometimes requires the export-import step or using AV software. With the macros cleared, they're harmless, but office will continue to nag you about macros every time you open the file, and false alarms are a great way to desensitize you to a real issue that crops up later.
_________________________
I work for the Department of Redundancy Department

Top
#9672 - 04/24/10 01:31 PM Re: Word Macro Virus [Re: Virtual1]
Starmac Offline


Registered: 04/23/10
Thanks for your informative answer.

When you refer to opening and closing an old document asking to be saved, I think that also applies to any document that I open that I know does not have macros. If there was an infection these docs would ask to be saved.

Is Word itself infected and it infects all documents or does an infected document have to be open to infect other documents?

Can Word macros infect Excel files if they are all open at the same time?

I have macro protection turned on, but I never see the macro warning.

I asked this question because an I had two emails open with Word attachments, also open, when Word gave me a strange error message, (something like: Word has encountered an error and will delete the document.) All the text in one email was deleted. I've tried looking at macros in Word and anything I can think of, but there appears to only be the prepackaged macros that come with Word. There is almost nothing on the internet that I could find. MS calls the macro warning -> macro protection, which it isn't, and that's the end of any reference to Mac Word viruses.
_________________________
Macs are best, there, I've said it. It must be true.

Top
#9689 - 04/26/10 09:36 AM Re: Word Macro Virus [Re: Starmac]
Virtual1 Offline


Registered: 08/04/09
Loc: Iowa
When you refer to opening and closing an old document asking to be saved, I think that also applies to any document that I open that I know does not have macros. If there was an infection these docs would ask to be saved.

Generally, those macro viruses copy their macros to all open documents, as well as the "dotnormal" template that word/excel open by default when launched. (that contain default settings and global macros)


Is Word itself infected and it infects all documents or does an infected document have to be open to infect other documents?

Once word's dotnormal is infected, launching word loads the virus and even new documents you create will be infected before they are even saved.


Can Word macros infect Excel files if they are all open at the same time?

dotnormal is shared between word and excel. I don't know if any of their specific macros are shared. (there is for example, a macro that runs on Open, when a word or excel document is opened, that's a favorite one for them to exploit, I don't know if it's a single Open or an OpenWord and OpenExcel separate macro. But it'd be reasonable to expect BOTH to be set to trigger if there are two, so really it doesn't matter if they are separate.


I have macro protection turned on, but I never see the macro warning.

that means no documents you are opening have macros in them, which is a good thing. Just thing twice or more before continuing to open anything that trips that notice.


I asked this question because an I had two emails open with Word attachments, also open, when Word gave me a strange error message, (something like: Word has encountered an error and will delete the document.)

probably unrelated to viruses, just a random bug.
_________________________
I work for the Department of Redundancy Department

Top
#9691 - 04/26/10 11:27 AM Re: Word Macro Virus [Re: Virtual1]
Starmac Offline


Registered: 04/23/10
Thanks for your response. smile
Sounds good and I had tentatively come to the same conclusion. Odd though how it wiped the text from an email withing the Mail program. If that had not happened I wouldn't have thought much about Word quitting without a warning.

I guess Word really can delete documents it does not like. That's what working with MS is like, though.
_________________________
Macs are best, there, I've said it. It must be true.

Top

Moderator:  alternaut, dianne, dkmarsh