Article View: demon.tech.pc
Article #22747Re: WM97/Marker-O macro virus removal
From: Michael Salem
Date: Sun, 07 May 2000 00:00
Date: Sun, 07 May 2000 00:00
26 lines
1832 bytes
1832 bytes
> isn't there a manual way to remove > Macros from Word Documents? Or at least prevent new ones from being > infected? Sometimes you can remove virus macros; you need to know, or to find out, what they are. Some viruses remove Word's ability to list and delete macros. I have had great success in containing Word macro virus attacks by write-protecting NORMAL.DOT. (This is a file used by Word to store configuration information, including macros. Use the Windows Find facility to locate it -- it will probably be in a directory called TEMPLATE, but this can vary, and right-click on it, then click on Properties and make it read-only). This has the obvious disadvantage that any legitimate change to the configuration will require the user to unprotect, save, and reprotect NORMAL.DOT. If you load an infected document, other documents may become infected until you close and reopen Word. I'm sure others will express the very valid criticisms that can be made of this technique. But it has been very useful when used appropriately. HTH, -- Michael Salem
Technical Details
Message-ID:
<20000507.0029.12242snz@michaels.demon.co.uk>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk> <vlj7hsgt5gf4tijuo0khuumd8mkngki2fo@4ax.com> <MVK7UcC9oFF5EwkP@pigsonthewing.demon.co.uk>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 1036bc,7ab9128b5ebb12c2 X-Google-Attributes: gid1036bc,public From: 4ms2u$ms@michaels.demon.co.uk (Michael Salem) Subject: Re: WM97/Marker-O macro virus removal Date: 2000/05/07 Message-ID: <20000507.0029.12242snz@michaels.demon.co.uk> X-Deja-AN: 620175415 X-Mail2News-Path: news.demon.net!michaels.demon.co.uk References: <U2FNsnAEe2E5EwdJ@pigsonthewing.demon.co.uk> <vlj7hsgt5gf4tijuo0khuumd8mkngki2fo@4ax.com> <MVK7UcC9oFF5EwkP@pigsonthewing.demon.co.uk> X-Trace: mail2news.demon.co.uk 957674466 mail2news:3412 mail2news mail2news.demon.co.uk Organization: MCL Reply-To: news@michaels.demon.co.uk Newsgroups: demon.tech.pc X-Complaints-To: abuse@demon.net