Information on the
Macro Virus Protection Tool

Updated on May 10, 1996

You can find this page (and download its associated files) at http://www.microsoft.com/word/freestuff/mvtool/mvtool2.htm

The Microsoft Corporation has developed a tool which installs a set of protective macros that detect suspicious Word files and alert customers to the potential risk of opening files with macros. Upon being alerted, users are given the choice of opening the file without executing the macros, opening the file as is, or canceling the file open operation. Opening the file without macros ensures that macro viruses are not transmitted and does not affect the content of the document. Unless users can verify that the macros contained in the document will not cause damage, Microsoft recommends opening the file without macros.

Although the primary purpose of the Macro Virus Protection tool is to alert users to the existence of macros in their documents and allow then to open their documents without macros, the tool also contains an updated version of the scanning code for the Concept virus (also known as the Word Prank Macro virus) and can be used to scan your hard disk for Word files that contain the Concept virus.

Customers can download a North American (English) or International version of the scanning tool from several on-line sites. The scanning tool can be downloaded from the Microsoft World Wide Web site at http://www.microsoft.com/msoffice or through MSN®, The Microsoft Network using go word: macrovirustool. It is also posted in the Word forums on other on-line services such as CompuServe® and America Online®. In addition, customers using English versions of the Word can get the tool by calling Microsoft's Product Support Services at 206-462-9673 for Word for Windows, and 206-635-7200 for Word for the Macintosh or by sending e-mail to wordinfo@microsoft.com.


Macro Virus Protection Tool

The Macro Virus Protection Tool includes two files. If you have Internet access, you can find them at http://www.microsoft.com/word/freestuff/mvtool/mvtool2.htm

Scanprot.dot: The template which installs the protection macros on the user's machine.

Readme.doc: A file which provides information about the tool and its operation.

To install the Macro Virus Protection tool, use Word's File Open command to open scanprot.dot. The protection tool will be automatically installed, and will prompt you for any additional input required.

This installation procedure is the same whether you run Word as a single-user setup, as a workstation install from the network, or if Word is run from the network directly. In particular, since the setup requires changing the users' Normal template on the local machine, there is no shortcut method of installing the protection macros on a large number of machines. The macro must be run on each desktop which is to be protected against macro viruses.


Common Questions and Answers

Q: What are macro viruses?
A: Macro viruses are a new type of virus that use an application's own macro programming language to distribute themselves. Unlike previous viruses, macro viruses do not infect programs; they infect documents.

Q: What is the Macro Virus Protection tool?
A: The Macro Virus Protection tool is a free tool that installs a set of protective macros which detect suspicious Word files and alert customers to the potential risk of opening files with macros. Upon being alerted, users are given the choice of opening the file without executing the macros, thereby ensuring that no viruses are transmitted. Although the primary purpose of the Macro Virus Protection tool is to alert users to the existence of macros in their documents and allow then to open their documents without macros, the tool also contains an updated version of the scanning code for the Concept virus and can be used to scan your hard disk for Word files that contain the Concept virus.

Q: How does this new tool work?
A: The Macro Virus Protection tool installs a set of protective macros into the user's Normal template. If the user opens a document containing macros, the protective macros are activated and the user is alerted to the potential risk of opening files containing macros. The user is given the choice of opening the file without executing the macros, opening the file as is, or canceling the file open operation. Opening the file without macros ensures that macro viruses are not transmitted and does not affect the content of the document. Unless the user can verify that the macros contained in the document will not cause damage, Microsoft recommends opening the file without macros.

Q: What does the Macro Virus Protection tool protect against?
A: The Macro Virus Protection tool is a general alerting mechanism that will alert users to any macros found in a document. Although the tool scans for the Concept virus, its primary purpose is not to detect or repair specific viruses, but to alert users to the fact that they are opening a document which contains macros and that these macros could contain viruses. Users are able to protect themselves against macro viruses by opening the file without the macros.

Q: Does the Macro Virus Protection tool change my files?
A: Upon installation, the tool offers to scan for any files which contain the Concept virus. If any infected files are found, the Concept virus is deleted from them and the files are re-saved. After the tool is installed, if a document with macros is opened, the protection alert is displayed. If a user cancels the File Open operation, or chooses "No," then nothing in the file is changed and the operation continues as if the tool were not installed. If the user chooses "Yes" and opens the file without the macros, a new document containing all of the document's content but none of its macros is created. The user can choose to save this new document with the same name as the original (thus overwriting the original and permanently removing the macros), or they can close the new document without saving, to preserve the macros.

Q: What is the difference between the Macro Virus Protection tool and Scan831.doc?
A: Scan831.doc is a tool that Microsoft made available to customers to allow them to scan and remove the Concept virus from their Word files. Since the release of Scan831.doc, all of the major anti-virus vendors have either shipped or committed to shipping tools which detect the Concept virus. Although the Macro Virus Protection tool includes an updated version of the Scan831 scanning code, its primary function is to alert users to the existence of macros in their documents and allow then to open their documents without macros.

Q: Which versions of Microsoft Word does the tool run on?
A: The tool works with Word 6.0 for Windows 3.1, Word 6.0.1 for the Macintosh, Word 6.0 for Windows NT, Word for Windows 95 and Windows NT.

Q: Does the tool work for international versions of Microsoft Word?
A: International versions of the tool exist and users should download the appropriate tool based on the international version that they are using. The tool exists for the following international versions: English, German, French, Italian, Spanish, Swedish, Dutch, Brazilian, Danish, Norwegian, Portuguese, Finnish, Greek, Russian, Hungarian, Polish, Czech, Turkish, and Slovenian.

Q: Where can I get the Macro Virus Protection tool?
A: The tool can be downloaded from the following on-line services:

Q: How will you distribute updates to the tool?
A: The version on this CD-ROM was current as of Oct. 1, 1996. Any updates which become necessary will be distributed on the following on-line services:

Q: Does a box of Word or Office that I buy in the store contain macro viruses?
A: Macro viruses do not exist in any version of Word or Office that you would get in a store. You can only get macro viruses by opening a Word document or template that already contains the macro virus.

Q: Can macro viruses be transferred with documents created with or being read by Internet Assistant?
A: Internet Assistant and documents created or read by it cannot be affected. Internet Assistant blocks the mechanism that distributes this type of macro.

Q: Can macro viruses be transferred with documents created with or being read by WordMail?
A: Word cannot send or receive this type of macro as a WordMail message. However, like many email editors, WordMail supports file attachments. If an infected document is sent as a file attachment, you can get infected when you open such an attachment.

Q: Can macro viruses be transferred by documents being read with the Word Viewer?
A: Since the Microsoft Word Viewer cannot save documents, it is unable to transmit macro viruses.