Help with a virus- (W97M.Thus.A)on a Mac, how to fix.

[Eniregnat]

I searched the forums (http://forums.macrumors.com/search.php?searchid=3813328) and I am a little stymied. I just had a teacher call me and tell me that the documents that I created using MS Office for OS X (v.X) have a virus. Poppycock I say, and I download ClamXav (http://www.pure-mac.com/virus.html). I search my documents folder and come up with the following log (part of which is shown below).

Any ideas on how to fix the individual documents. I am downloading the MS updates for Office, and I hope that it fixes the VB problem. I have to use VB Macros for both work and school (stats tools).

So technically, while not affecting my Mac, but affecting MS Office, I have a virus, with out running Windows. W97M.Thus.A.

15 other documents, including all of my final papers for last quarter were infected. If anybody has a good bit of text they can post os I can point my professors towards this thread explaining that this really isn't a problem, or how I could miss it.

(Sorry about the .gif pic below, but ClamX dosn't allow for quick text selection.)

Edit: I have sent my papers back to the one teacher that alerted me to the problem as text only emails. I would love some help with the problem. I will check back tomorrow.

[mduser63]

Ok, I'm no expert, but I'm guessing that W97M stands for Word 97 Macro (virus). Office is susceptible to macro viruses on both platforms (yay Microsoft!). I don't think you've got much to worry about as far as doing damage to the rest of your Mac, but it wouldn't be a bad idea to search around on the net for information on the particular virus that you've got and figure out how to completely remove it.

[Lukasha]

Unfortunately you have one of a couple of choices.

1) Put all your documents on a USB flash drive, take it to a friend's PC with current, up-to-date anti-virus software, clean your docs, delete the originals (including your normal.dot) from your Mac and copy the now cleaned versions from the flash drive back to your computer.

Or
2) Spring for Mac Anti-Virus software since Clam only detects, it doesn't clean. I believe a recent review by MacWorld stated they like Intego's VirusBarrier the best but stated that Symantec's Norton Antivirus dealt with Windows virus' better. Here's the full review:

http://www.macworld.com/2006/06/features/antivirussw/index.php

Jeff

[Eniregnat]

Ya, I knew that MS products could become infected by VB macros (unwanted code= virus), but I really didn't think it could happen on a Mac. Well, looks like I have to get an AV solution.

Thanks to you two. I really wish Apple used the term "virus resistant". The "No viruses on Mac's" is going to bite them in the ass one day. I know why OS X is so virus resistant, but really, it is only a mater of time before somebody some way that doesn’t require buffer overflows, address forcing, etc…

[OutThere]

If they're basically just text documents, why not take them, copy and paste the text into a new file, and save it elsewhere?

[Felldownthewell]

If they're basically just text documents, why not take them, copy and paste the text into a new file, and save it elsewhere?

Psh. That would be FAR to easy and simply. Remember, this is a Microsoft virus. The removal process must be VERY DIFFICULT and result in at least 15 one hour+ phonecalls to Bangalor to a guy named Tim Smith with a very thick accent.

On topic- I would go for the copy/paste strategy. If not- well, I have no mac virus experiance, but if you have a PC and want some good virus cleaning software there is a good amount of freeware...if that is what you end up deciding to do let me know and I'm sure I can put together a list.

[Lollypop]

So what is the source of the virus, the normal.dot file? I dont think a copy and paste would be enough, you need to firstly eliminate the change of the virus infecting the new file as well.

[Lollypop]

Simply to satisfy my own quriosity I went and read up about W97M.Thus.A, and it turns out its a pretty harmless little "virus" that cant really do any damage to the mac, and only does damage to windows PC's on the 13th of December. Turns out I was right, the normal.dot file is sort of the source!

Also found a website (http://outlandishjosh.com/wp/index.php?p=861) that gives instructions on exactly how to remove the virus from a mac! :D

[Phobophobia]

Thanks to you two. I really wish Apple used the term "virus resistant". The "No viruses on Mac's" is going to bite them in the ass one day.
Apple is very careful to never say that there are no viruses on the mac. You are misinterpreting what they've said.

[bousozoku]

Do you even have MS Office virus protection enabled? Obviously, you've received the virus from somewhere else.

You should be able to clean each document manually by going into the Macro menu and deleting the macro code that is the virus.

Since you've not mentioned running Windows, you shouldn't have any code loaded that would re-create the virus in your documents folder. You should also not have a problem with Brenda, which disables the Macro menu items.

[Arnaud]

Apple is very careful to never say that there are no viruses on the mac. You are misinterpreting what they've said.

Mmm, I think it's the subject of one of those Mac ads, no?
The one when the PC is sneezing all the time, but not the mac.

[Miguey]

Psh. That would be FAR to easy and simply. Remember, this is a Microsoft virus. The removal process must be VERY DIFFICULT and result in at least 15 one hour+ phonecalls to Bangalor to a guy named Tim Smith with a very thick accent.


Haha, oh so true.

[Makosuke]

I've seen this happen to the unsuspecting as well. I've always found a certain irony that the ONLY significant virus threat on the Mac is directly through a Microsoft product. Really, think about that.

Well, you have to give them some credit--Word is so smoothly cross-platform we can even get cross-platform viruses through it. (Although, in another stroke of irony, they rarely if ever work properly on the Mac--generally just propagate without causing any damage locally).

The instructions on that page are pretty good--I ended up doing basically the same thing when I ran across a client's computer that was infected with something similar.

[it5five]

Mmm, I think it's the subject of one of those Mac ads, no?
The one when the PC is sneezing all the time, but not the mac.

"PC: Last year there were 56347563748 viruses for PC's.
Mac: PC's, not Macs."

Apple never states that Macs are virus free. Only that there are tons of viruses for windows machines.

[Eniregnat]

Thanks all, though it was more like a roast than something helpful.

I was just as clever as those of you above. I did just cut and paste the text into an email. The class required, and the university in general, requires everything to be in word format. For my experimental design class, each student created a macro and a set of track changes for her/his paper. I explained that the virus wasn't anything harmful, but the teachers did not care.

The whole thing isn't a big deal, just I wanted to use my Mac as a solution to the problem and not my PC. All to often, at work, I use my PB to solve problems, and I just hate having to use my PCs to solve a Mac problem.

I didn't have the Macro virus protection on as it interfered with a template I use at work. Now that I have done the updates for Office, I might have fixed the problem. Otherwise, as noted above, I will re-install the normal.dot and if that doesn’t work, reinstall Office- which is a pain in the ass.

[bousozoku]

It seems to me that if normal.dot doesn't exist, MS Word will re-create it.