Help with a virus- (W97M.Thus.A)on a Mac, how to fix.

Discussion in 'Mac Basics and Help' started by Eniregnat, Jul 3, 2006.

  1. Eniregnat macrumors 68000

    Eniregnat

    Joined:
    Jan 22, 2003
    Location:
    In your head.
    #1
    I searched the forums and I am a little stymied. I just had a teacher call me and tell me that the documents that I created using MS Office for OS X (v.X) have a virus. Poppycock I say, and I download ClamXav. I search my documents folder and come up with the following log (part of which is shown below).

    Any ideas on how to fix the individual documents. I am downloading the MS updates for Office, and I hope that it fixes the VB problem. I have to use VB Macros for both work and school (stats tools).

    So technically, while not affecting my Mac, but affecting MS Office, I have a virus, with out running Windows. W97M.Thus.A.

    15 other documents, including all of my final papers for last quarter were infected. If anybody has a good bit of text they can post os I can point my professors towards this thread explaining that this really isn't a problem, or how I could miss it.

    (Sorry about the .gif pic below, but ClamX dosn't allow for quick text selection.)

    Edit: I have sent my papers back to the one teacher that alerted me to the problem as text only emails. I would love some help with the problem. I will check back tomorrow.
     

    Attached Files:

  2. mduser63 macrumors 68040

    mduser63

    Joined:
    Nov 9, 2004
    Location:
    Salt Lake City, UT
    #2
    Ok, I'm no expert, but I'm guessing that W97M stands for Word 97 Macro (virus). Office is susceptible to macro viruses on both platforms (yay Microsoft!). I don't think you've got much to worry about as far as doing damage to the rest of your Mac, but it wouldn't be a bad idea to search around on the net for information on the particular virus that you've got and figure out how to completely remove it.
     
  3. Lukasha macrumors newbie

    Joined:
    Feb 19, 2005
    Location:
    Los Angeles
    #3
    Unfortunately you have one of a couple of choices.

    1) Put all your documents on a USB flash drive, take it to a friend's PC with current, up-to-date anti-virus software, clean your docs, delete the originals (including your normal.dot) from your Mac and copy the now cleaned versions from the flash drive back to your computer.

    Or
    2) Spring for Mac Anti-Virus software since Clam only detects, it doesn't clean. I believe a recent review by MacWorld stated they like Intego's VirusBarrier the best but stated that Symantec's Norton Antivirus dealt with Windows virus' better. Here's the full review:

    http://www.macworld.com/2006/06/features/antivirussw/index.php

    Jeff
     
  4. Eniregnat thread starter macrumors 68000

    Eniregnat

    Joined:
    Jan 22, 2003
    Location:
    In your head.
    #4
    Ya, I knew that MS products could become infected by VB macros (unwanted code= virus), but I really didn't think it could happen on a Mac. Well, looks like I have to get an AV solution.

    Thanks to you two. I really wish Apple used the term "virus resistant". The "No viruses on Mac's" is going to bite them in the ass one day. I know why OS X is so virus resistant, but really, it is only a mater of time before somebody some way that doesn’t require buffer overflows, address forcing, etc…
     
  5. OutThere macrumors 603

    OutThere

    Joined:
    Dec 19, 2002
    Location:
    NYC
    #5
    If they're basically just text documents, why not take them, copy and paste the text into a new file, and save it elsewhere?
     
  6. Felldownthewell macrumors 65816

    Felldownthewell

    Joined:
    Feb 10, 2006
    Location:
    Portland
    #6
    Psh. That would be FAR to easy and simply. Remember, this is a Microsoft virus. The removal process must be VERY DIFFICULT and result in at least 15 one hour+ phonecalls to Bangalor to a guy named Tim Smith with a very thick accent.

    On topic- I would go for the copy/paste strategy. If not- well, I have no mac virus experiance, but if you have a PC and want some good virus cleaning software there is a good amount of freeware...if that is what you end up deciding to do let me know and I'm sure I can put together a list.
     
  7. Lollypop macrumors 6502a

    Lollypop

    Joined:
    Sep 13, 2004
    Location:
    Johannesburg, South Africa
    #7
    So what is the source of the virus, the normal.dot file? I dont think a copy and paste would be enough, you need to firstly eliminate the change of the virus infecting the new file as well.
     
  8. Lollypop macrumors 6502a

    Lollypop

    Joined:
    Sep 13, 2004
    Location:
    Johannesburg, South Africa
    #8
    Simply to satisfy my own quriosity I went and read up about W97M.Thus.A, and it turns out its a pretty harmless little "virus" that cant really do any damage to the mac, and only does damage to windows PC's on the 13th of December. Turns out I was right, the normal.dot file is sort of the source!

    Also found a website that gives instructions on exactly how to remove the virus from a mac! :D
     
  9. Phobophobia macrumors 6502

    Joined:
    Dec 1, 2003
    #9
    Apple is very careful to never say that there are no viruses on the mac. You are misinterpreting what they've said.
     
  10. bousozoku Moderator emeritus

    Joined:
    Jun 25, 2002
    Location:
    Gone but not forgotten.
    #10
    Do you even have MS Office virus protection enabled? Obviously, you've received the virus from somewhere else.

    You should be able to clean each document manually by going into the Macro menu and deleting the macro code that is the virus.

    Since you've not mentioned running Windows, you shouldn't have any code loaded that would re-create the virus in your documents folder. You should also not have a problem with Brenda, which disables the Macro menu items.
     
  11. Arnaud macrumors 6502

    Joined:
    May 24, 2005
    Location:
    The Moon
    #11
    Mmm, I think it's the subject of one of those Mac ads, no?
    The one when the PC is sneezing all the time, but not the mac.
     
  12. Miguey macrumors 6502

    Joined:
    Jan 5, 2006
    Location:
    So Cal 909
    #12
    Haha, oh so true.
     
  13. Makosuke macrumors 603

    Joined:
    Aug 15, 2001
    Location:
    The Cool Part of CA, USA
    #13
    I've seen this happen to the unsuspecting as well. I've always found a certain irony that the ONLY significant virus threat on the Mac is directly through a Microsoft product. Really, think about that.

    Well, you have to give them some credit--Word is so smoothly cross-platform we can even get cross-platform viruses through it. (Although, in another stroke of irony, they rarely if ever work properly on the Mac--generally just propagate without causing any damage locally).

    The instructions on that page are pretty good--I ended up doing basically the same thing when I ran across a client's computer that was infected with something similar.
     
  14. it5five macrumors 65816

    it5five

    Joined:
    May 31, 2006
    Location:
    New York
    #14
    "PC: Last year there were 56347563748 viruses for PC's.
    Mac: PC's, not Macs."

    Apple never states that Macs are virus free. Only that there are tons of viruses for windows machines.
     
  15. Eniregnat thread starter macrumors 68000

    Eniregnat

    Joined:
    Jan 22, 2003
    Location:
    In your head.
    #15
    Thanks all, though it was more like a roast than something helpful.

    I was just as clever as those of you above. I did just cut and paste the text into an email. The class required, and the university in general, requires everything to be in word format. For my experimental design class, each student created a macro and a set of track changes for her/his paper. I explained that the virus wasn't anything harmful, but the teachers did not care.

    The whole thing isn't a big deal, just I wanted to use my Mac as a solution to the problem and not my PC. All to often, at work, I use my PB to solve problems, and I just hate having to use my PCs to solve a Mac problem.

    I didn't have the Macro virus protection on as it interfered with a template I use at work. Now that I have done the updates for Office, I might have fixed the problem. Otherwise, as noted above, I will re-install the normal.dot and if that doesn’t work, reinstall Office- which is a pain in the ass.
     
  16. bousozoku Moderator emeritus

    Joined:
    Jun 25, 2002
    Location:
    Gone but not forgotten.
    #16
    It seems to me that if normal.dot doesn't exist, MS Word will re-create it.
     
  17. Falkor macrumors newbie

    Joined:
    Mar 15, 2010
    #17
    W97m.Thus.A

    These posts are old but I have just "obtained" this virus on my MAC. Any help would be appreciated. The only one with a link led to a blog and I searched but could not find the info. HELP!
     
  18. spinnerlys Guest

    spinnerlys

    Joined:
    Sep 7, 2008
    Location:
    forlod bygningen
    #18
    What Mac you have and what Mac OS X and Microsoft Office version do you use?

    What AV software did find that virus?

    http://www.google.com/search?client...oe=UTF-8&redir_esc=&ei=9GCeS6KZGYGH_Aaa9oH7CQ

    http://www.eset.com/threat-center/encyclopedia/threats/w97mthusa

    You know that your Mac is safe though, don't you? Only Windows is affected by this.
     
  19. notjustjay macrumors 603

    notjustjay

    Joined:
    Sep 19, 2003
    Location:
    Canada, eh?
    #19
    Can you use the copy-paste strategy as noted in one of the earlier posts?
     
  20. Falkor macrumors newbie

    Joined:
    Mar 15, 2010
    #20
    W97m.Thus.A virus help

    I have an iMac
    MAC OSX version 10.4.11
    Microsoft Office 2004

    Copy/paste does not solve the problem. Working from home is fine (MAC) but when attached and opened at school, the school systems AV will not allow opening due to virus (the ALERT screen gave the code: W97m.Thus.A. Any solutions or a specific program to purchase to fix?
     
  21. Falkor macrumors newbie

    Joined:
    Mar 15, 2010
    #22
    Up and Running Again

    Thanks for all the help. Angelwatt, the link was very useful. For anyone who may come after me looking for answers:

    1. Open HD/Users/"house" icon/Documents/Microsoft User Data

    2. TRASH the "Normal" (don't worry, Microsoft will recreate a new "Normal")

    3. Restart computer

    4. When opening an infected file, disable macros/copy/paste into new doc/save/now TRASH the infected file.

    Thank goodness for a MAC - this would never work on a PC!
     

Share This Page