Jan's Working with Words

Some Symptoms:

You may have been infected by a macro virus if any of the following occur:

• You can save a document only as a template.
  
• The icon for a document file looks like a template icon rather than a document icon.
  
• When you open a document, a dialog box showing the number 1 appears.
  
• Some commands no longer show.
  
• New macros appear in the list of macros, like AutoOpen, AutoNew, AutoExec, and FileSaveAs macros.
  If you already had macros by these names, their contents may have been changed by the macro virus.
  
• Unusual or unexpected messages appear when you open a Word document or template.
  
• Text in your document is scrambled or new garbage text appears. 

Prevention:

• Hide in a cave and don't touch a computer!
     Or...
• Run anti-virus software continuously in the background.
  Be sure that the anti-virus software can detect and remove macro viruses.
• Email: Be sure that your anti-virus software checks all email and attachments for viruses as you receive them.

  Email software may block Office documents from opening from inside the email interface. In that case, you must save the document and open it from File Explorer or from inside the program.

  Don't ever open a document sent by email unless you were expecting it AND trust the sender, even PDF format documents. Be aware that many viruses steal email addresses from an infected computer and send themselves to the friends and co-workers found there! If your friend's computer catches a virus, it is highly likely that you will get a message that appears to be from him/her that will spread the virus to your computer.

If you suspect you have been infected:

• Immediately run an anti-virus program that is capable of getting rid of macro viruses. Not all can. 
  
• Virus check all removable disks and backup media that have been in the infected computer recently.
  If infections are found, let the anti-virus software disinfect the files or else destroy the media. Only make copies of uninfected files.
• Virus check all copies of files stored with online services.
  Examples: Carbonite, Dropbox, Google Drive, and OneDrive.
• Check any other computer that removable media may have visited after being connected to yours.
  You may have have already passed on the virus. 
• If you are on a network, notify the network administrator immediately.
  The whole network may well have been infected.

From this list, you can see how easy it is to get infected by the same virus many times by accessing files in places that you did not know it had infected. That's why the best idea is to avoid catch a virus at all!

Return Disinfected Document to .docx Format

If the virus you caught turned your document into a template, after you have disinfected the computer, you still must change the template back into a document. The procedure below is awkward but it works.

1. Click on the Office button or File tab and then on New.

2. Navigate to the document that is not supposed to be a template.
   It may be in Recent Templates or Featured. In Word 2007 and 2010 you can use New from Existing.

   A new document appears using the template, but you cannot just save the new document as a Word document. That option is grayed out! It's part of the evil plan of the infection!  

3. Select all the contents of the document with the key combo CTRL + A.
   
4. Copy.
5. Open a new blank document.
6. Paste to this new blank document.
   
7. Save as you meant to do to start with.
   
8. Navigate to the problem file in an Explorer window and delete it.

Macro Warning

Word can warn you every time you open a document that contains a macro. But Word can't tell if this is a macro virus or a useful macro that is an ordinary part of a document.

You can select how protective you want Office to be in the Microsoft Trust Center, which is part of Microsoft Office.

Office button or File tab > Word Options > Microsoft Trust Center > Trust Center Settings... > Macro Settings > Disable all macros with notification.

You can learn the latest about macro viruses from the web site of your anti-virus software or Search Microsoft's Knowledge Base with the phrase macro virus.