w97 Marker virus infects every new word doc I create!

Discussion in 'macOS' started by d-lock, Oct 14, 2009.

  1. d-lock macrumors newbie

    Oct 14, 2009
    After some trouble with sending word documents trough Entourage I discovered that my boss' Macbook with OS x 10.4 and Word 97 has a W97.Marker virus problem. Identified this thanks to www.virustotal.com and ClamXav. I have read up on the various suggested solutions for the Marker virus but none seems to quite describe the issue I have.

    Every new word document I create on this computer will be created with the Markervirus in the document as a default. I thought this was impossible since supposedly the Marker virus was meant to be PC only thing.

    Furthermore, although this problem started exactly two weeks ago ClamXav is identifying the virus in a large number of older files as well. Can the Marker really infect 'dormant' files that are not in use? And moreover, is there a way to 'cleanse' the older infected word documents? There are hundreds of these documents and the suggested copy and paste propositions I've found online will not be very practical.

    Lastly, what is the best way forward? The user of this Macbook is my boss who is not that young and struggling enough with computers as it is. I would like to suggest the simplest possible routine to her from now on.

    All help appreciated.
  2. d-lock thread starter macrumors newbie

    Oct 14, 2009
    OK, I didn't search properly enough. The answer to my first question is already on the forum. My humble apologies to you all. For those interested ProblemChild posted the following gem:

    Still, I am interested in your thoughts about my next two questions. I can't help thinking that the macro virus has somehow spread itself to 'dormant' files.

  3. wrldwzrd89 macrumors G5


    Jun 6, 2003
    Solon, OH
    Any file you opened before deleting the Normal.dot file is still infected, unfortunately, and if you open one of these the Normal.dot file gets re-infected too. This is what makes Word macro viruses so hard to get rid of completely.

    However, there is a solution. Tell ClamXav to scan your documents, so that it identifies any remaining infected ones. Open these in TextEdit (instead of Word, because TextEdit doesn't support Word macros, so won't spread the virus). At this point you can either copy and paste the text into a new Word document, or (the safer option) save them as RTF, then delete the original infected ones.

    Once that's done, scan one more time, just to make sure the virus is gone.
  4. madog macrumors 65816


    Nov 25, 2004
    Korova Milkbar
    This is why they removed macros in Office 2008. If you use that then you don't have to worry.

    Lastly. this is why updates come out. If he is using anything less than '03/'04 then it should be updated.
  5. psxtreme macrumors member

    Jun 27, 2009
    I don't have Office 2004 but can't you just disable macros from running in the preferences and then open up the word documents and strip them of the macro?

Share This Page