w97 Marker virus infects every new word doc I create!

[d-lock]

After some trouble with sending word documents trough Entourage I discovered that my boss' Macbook with OS x 10.4 and Word 97 has a W97.Marker virus problem. Identified this thanks to www.virustotal.com and ClamXav. I have read up on the various suggested solutions for the Marker virus but none seems to quite describe the issue I have.

Every new word document I create on this computer will be created with the Markervirus in the document as a default. I thought this was impossible since supposedly the Marker virus was meant to be PC only thing.

Furthermore, although this problem started exactly two weeks ago ClamXav is identifying the virus in a large number of older files as well. Can the Marker really infect 'dormant' files that are not in use? And moreover, is there a way to 'cleanse' the older infected word documents? There are hundreds of these documents and the suggested copy and paste propositions I've found online will not be very practical.

Lastly, what is the best way forward? The user of this Macbook is my boss who is not that young and struggling enough with computers as it is. I would like to suggest the simplest possible routine to her from now on.

All help appreciated.
Thanks

 

[d-lock]

OK, I didn't search properly enough. The answer to my first question is already on the forum. My humble apologies to you all. For those interested ProblemChild posted the following gem:

... You have the Word '04 Macro virus, which is being detected by others e-mail av filters. Luckily this is quite easy to get rid of, but quite difficult to stop recurring. To remove it, quit your Word and go to Home folder -> Documents -> Microsoft User Data and delete the file called Normal, or Normal.dot
When you next open Word Normal.dot will be re-created as a clean file.
...

Still, I am interested in your thoughts about my next two questions. I can't help thinking that the macro virus has somehow spread itself to 'dormant' files.

Thanks,

 

[wrldwzrd89]

Any file you opened before deleting the Normal.dot file is still infected, unfortunately, and if you open one of these the Normal.dot file gets re-infected too. This is what makes Word macro viruses so hard to get rid of completely.

However, there is a solution. Tell ClamXav to scan your documents, so that it identifies any remaining infected ones. Open these in TextEdit (instead of Word, because TextEdit doesn't support Word macros, so won't spread the virus). At this point you can either copy and paste the text into a new Word document, or (the safer option) save them as RTF, then delete the original infected ones.

Once that's done, scan one more time, just to make sure the virus is gone.

 

[madog]

This is why they removed macros in Office 2008. If you use that then you don't have to worry.

Lastly. this is why updates come out. If he is using anything less than '03/'04 then it should be updated.

 

[psxtreme]

I don't have Office 2004 but can't you just disable macros from running in the preferences and then open up the word documents and strip them of the macro?