Help with a virus- (W97M.Thus.A)on a Mac, how to fix.

Eniregnat

macrumors 68000
Original poster
Jan 22, 2003
1,841
0
In your head.
I searched the forums and I am a little stymied. I just had a teacher call me and tell me that the documents that I created using MS Office for OS X (v.X) have a virus. Poppycock I say, and I download ClamXav. I search my documents folder and come up with the following log (part of which is shown below).

Any ideas on how to fix the individual documents. I am downloading the MS updates for Office, and I hope that it fixes the VB problem. I have to use VB Macros for both work and school (stats tools).

So technically, while not affecting my Mac, but affecting MS Office, I have a virus, with out running Windows. W97M.Thus.A.

15 other documents, including all of my final papers for last quarter were infected. If anybody has a good bit of text they can post os I can point my professors towards this thread explaining that this really isn't a problem, or how I could miss it.

(Sorry about the .gif pic below, but ClamX dosn't allow for quick text selection.)

Edit: I have sent my papers back to the one teacher that alerted me to the problem as text only emails. I would love some help with the problem. I will check back tomorrow.
 

Attachments

mduser63

macrumors 68040
Nov 9, 2004
3,039
30
Salt Lake City, UT
Ok, I'm no expert, but I'm guessing that W97M stands for Word 97 Macro (virus). Office is susceptible to macro viruses on both platforms (yay Microsoft!). I don't think you've got much to worry about as far as doing damage to the rest of your Mac, but it wouldn't be a bad idea to search around on the net for information on the particular virus that you've got and figure out how to completely remove it.
 

Lukasha

macrumors newbie
Feb 19, 2005
28
0
Los Angeles
Unfortunately you have one of a couple of choices.

1) Put all your documents on a USB flash drive, take it to a friend's PC with current, up-to-date anti-virus software, clean your docs, delete the originals (including your normal.dot) from your Mac and copy the now cleaned versions from the flash drive back to your computer.

Or
2) Spring for Mac Anti-Virus software since Clam only detects, it doesn't clean. I believe a recent review by MacWorld stated they like Intego's VirusBarrier the best but stated that Symantec's Norton Antivirus dealt with Windows virus' better. Here's the full review:

http://www.macworld.com/2006/06/features/antivirussw/index.php

Jeff
 

Eniregnat

macrumors 68000
Original poster
Jan 22, 2003
1,841
0
In your head.
Ya, I knew that MS products could become infected by VB macros (unwanted code= virus), but I really didn't think it could happen on a Mac. Well, looks like I have to get an AV solution.

Thanks to you two. I really wish Apple used the term "virus resistant". The "No viruses on Mac's" is going to bite them in the ass one day. I know why OS X is so virus resistant, but really, it is only a mater of time before somebody some way that doesn’t require buffer overflows, address forcing, etc…
 

OutThere

macrumors 603
Dec 19, 2002
5,730
3
NYC
If they're basically just text documents, why not take them, copy and paste the text into a new file, and save it elsewhere?
 

Felldownthewell

macrumors 65816
Feb 10, 2006
1,053
0
Portland
OutThere said:
If they're basically just text documents, why not take them, copy and paste the text into a new file, and save it elsewhere?
Psh. That would be FAR to easy and simply. Remember, this is a Microsoft virus. The removal process must be VERY DIFFICULT and result in at least 15 one hour+ phonecalls to Bangalor to a guy named Tim Smith with a very thick accent.

On topic- I would go for the copy/paste strategy. If not- well, I have no mac virus experiance, but if you have a PC and want some good virus cleaning software there is a good amount of freeware...if that is what you end up deciding to do let me know and I'm sure I can put together a list.
 

Lollypop

macrumors 6502a
Sep 13, 2004
829
0
Johannesburg, South Africa
So what is the source of the virus, the normal.dot file? I dont think a copy and paste would be enough, you need to firstly eliminate the change of the virus infecting the new file as well.
 

Lollypop

macrumors 6502a
Sep 13, 2004
829
0
Johannesburg, South Africa
Simply to satisfy my own quriosity I went and read up about W97M.Thus.A, and it turns out its a pretty harmless little "virus" that cant really do any damage to the mac, and only does damage to windows PC's on the 13th of December. Turns out I was right, the normal.dot file is sort of the source!

Also found a website that gives instructions on exactly how to remove the virus from a mac! :D
 

Phobophobia

macrumors 6502
Dec 1, 2003
477
0
Eniregnat said:
Thanks to you two. I really wish Apple used the term "virus resistant". The "No viruses on Mac's" is going to bite them in the ass one day.
Apple is very careful to never say that there are no viruses on the mac. You are misinterpreting what they've said.
 

bousozoku

Moderator emeritus
Jun 25, 2002
14,029
37
Lard
Do you even have MS Office virus protection enabled? Obviously, you've received the virus from somewhere else.

You should be able to clean each document manually by going into the Macro menu and deleting the macro code that is the virus.

Since you've not mentioned running Windows, you shouldn't have any code loaded that would re-create the virus in your documents folder. You should also not have a problem with Brenda, which disables the Macro menu items.
 

Arnaud

macrumors 6502
May 24, 2005
430
0
The Moon
Phobophobia said:
Apple is very careful to never say that there are no viruses on the mac. You are misinterpreting what they've said.
Mmm, I think it's the subject of one of those Mac ads, no?
The one when the PC is sneezing all the time, but not the mac.
 

Miguey

macrumors 6502
Jan 5, 2006
282
0
So Cal 909
Felldownthewell said:
Psh. That would be FAR to easy and simply. Remember, this is a Microsoft virus. The removal process must be VERY DIFFICULT and result in at least 15 one hour+ phonecalls to Bangalor to a guy named Tim Smith with a very thick accent.
Haha, oh so true.
 

Makosuke

macrumors 603
Aug 15, 2001
6,181
380
The Cool Part of CA, USA
I've seen this happen to the unsuspecting as well. I've always found a certain irony that the ONLY significant virus threat on the Mac is directly through a Microsoft product. Really, think about that.

Well, you have to give them some credit--Word is so smoothly cross-platform we can even get cross-platform viruses through it. (Although, in another stroke of irony, they rarely if ever work properly on the Mac--generally just propagate without causing any damage locally).

The instructions on that page are pretty good--I ended up doing basically the same thing when I ran across a client's computer that was infected with something similar.
 

it5five

macrumors 65816
May 31, 2006
1,219
1
New York
Arnaud said:
Mmm, I think it's the subject of one of those Mac ads, no?
The one when the PC is sneezing all the time, but not the mac.
"PC: Last year there were 56347563748 viruses for PC's.
Mac: PC's, not Macs."

Apple never states that Macs are virus free. Only that there are tons of viruses for windows machines.
 

Eniregnat

macrumors 68000
Original poster
Jan 22, 2003
1,841
0
In your head.
Thanks all, though it was more like a roast than something helpful.

I was just as clever as those of you above. I did just cut and paste the text into an email. The class required, and the university in general, requires everything to be in word format. For my experimental design class, each student created a macro and a set of track changes for her/his paper. I explained that the virus wasn't anything harmful, but the teachers did not care.

The whole thing isn't a big deal, just I wanted to use my Mac as a solution to the problem and not my PC. All to often, at work, I use my PB to solve problems, and I just hate having to use my PCs to solve a Mac problem.

I didn't have the Macro virus protection on as it interfered with a template I use at work. Now that I have done the updates for Office, I might have fixed the problem. Otherwise, as noted above, I will re-install the normal.dot and if that doesn’t work, reinstall Office- which is a pain in the ass.
 

Falkor

macrumors newbie
Mar 15, 2010
4
0
W97m.Thus.A

These posts are old but I have just "obtained" this virus on my MAC. Any help would be appreciated. The only one with a link led to a blog and I searched but could not find the info. HELP!
 

spinnerlys

Guest
Sep 7, 2008
14,328
7
forlod bygningen
These posts are old but I have just "obtained" this virus on my MAC. Any help would be appreciated. The only one with a link led to a blog and I searched but could not find the info. HELP!
What Mac you have and what Mac OS X and Microsoft Office version do you use?

What AV software did find that virus?

http://www.google.com/search?client...oe=UTF-8&redir_esc=&ei=9GCeS6KZGYGH_Aaa9oH7CQ

http://www.eset.com/threat-center/encyclopedia/threats/w97mthusa

You know that your Mac is safe though, don't you? Only Windows is affected by this.
 

notjustjay

macrumors 603
Sep 19, 2003
6,051
159
Canada, eh?
These posts are old but I have just "obtained" this virus on my MAC. Any help would be appreciated. The only one with a link led to a blog and I searched but could not find the info. HELP!
Can you use the copy-paste strategy as noted in one of the earlier posts?
 

Falkor

macrumors newbie
Mar 15, 2010
4
0
W97m.Thus.A virus help

I have an iMac
MAC OSX version 10.4.11
Microsoft Office 2004

Copy/paste does not solve the problem. Working from home is fine (MAC) but when attached and opened at school, the school systems AV will not allow opening due to virus (the ALERT screen gave the code: W97m.Thus.A. Any solutions or a specific program to purchase to fix?
 

Falkor

macrumors newbie
Mar 15, 2010
4
0
Up and Running Again

Thanks for all the help. Angelwatt, the link was very useful. For anyone who may come after me looking for answers:

1. Open HD/Users/"house" icon/Documents/Microsoft User Data

2. TRASH the "Normal" (don't worry, Microsoft will recreate a new "Normal")

3. Restart computer

4. When opening an infected file, disable macros/copy/paste into new doc/save/now TRASH the infected file.

Thank goodness for a MAC - this would never work on a PC!
 

baudster

macrumors newbie
Aug 21, 2019
2
0
Concerning the virus W97M/downloader obtained via my latest Microsoft Office for Mac MAU: (build 19081202, v16.28.0)-my Intego AV detected 1,015 Trojans which had attached themselves to most of the files in my docs folder. A recent backup fixed it but now I don't trust the MAU.
 

chrfr

macrumors G3
Jul 11, 2009
9,610
3,492
Concerning the virus W97M/downloader obtained via my latest Microsoft Office for Mac MAU: (build 19081202, v16.28.0)-my Intego AV detected 1,015 Trojans which had attached themselves to most of the files in my docs folder. A recent backup fixed it but now I don't trust the MAU.
Any sort of virus you found on your Office files didn't come from the Microsoft Autoupdater.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.