🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: demon.tech.pc
Article #22747

Re: WM97/Marker-O macro virus removal

#22747
From: Michael Salem
Date: Sun, 07 May 2000 00:00
26 lines
1832 bytes
> isn't there a manual way to remove
> Macros from Word Documents? Or at least prevent new ones from being
> infected?

Sometimes you can remove virus macros; you need to know, or to find 
out, what they are. Some viruses remove Word's ability to list and 
delete macros.

I have had great success in containing Word macro virus attacks by 
write-protecting NORMAL.DOT. (This is a file used by Word to store 
configuration information, including macros. Use the Windows Find 
facility to locate it -- it will probably be in a directory called 
TEMPLATE, but this can vary, and right-click on it, then click on 
Properties and make it read-only). This has the obvious disadvantage 
that any legitimate change to the configuration will require the user 
to unprotect, save, and reprotect NORMAL.DOT. If you load an infected 
document, other documents may become infected until you close and 
reopen Word.

I'm sure others will express the very valid criticisms that can be 
made of this technique. But it has been very useful when used 
appropriately.

HTH,
-- 
Michael Salem
Technical Details
Message-ID: <20000507.0029.12242snz@michaels.demon.co.uk>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk> <vlj7hsgt5gf4tijuo0khuumd8mkngki2fo@4ax.com> <MVK7UcC9oFF5EwkP@pigsonthewing.demon.co.uk>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1036bc,7ab9128b5ebb12c2
X-Google-Attributes: gid1036bc,public
From: 4ms2u$ms@michaels.demon.co.uk (Michael Salem)
Subject: Re: WM97/Marker-O macro virus removal
Date: 2000/05/07
Message-ID: <20000507.0029.12242snz@michaels.demon.co.uk>
X-Deja-AN: 620175415
X-Mail2News-Path: news.demon.net!michaels.demon.co.uk
References: <U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk> <vlj7hsgt5gf4tijuo0khuumd8mkngki2fo@4ax.com> <MVK7UcC9oFF5EwkP@pigsonthewing.demon.co.uk>
X-Trace: mail2news.demon.co.uk 957674466 mail2news:3412 mail2news mail2news.demon.co.uk
Organization: MCL
Reply-To: news@michaels.demon.co.uk
Newsgroups: demon.tech.pc
X-Complaints-To: abuse@demon.net