AVERT - A Division of NAI Labs this page last updated 1-13-99 ## DOCFIXWB / DOCFIXVB How to Repair Word Macro Virus Damages ### 1. Problem: When saving my work, I can't change the file type from "Document Template" to "Word Document." Non Infection Explanation A (origin: MS Word Help): Inadvertently, a Word document has been opened or created as a template file. Unfortunately, you cannot change the file type of a template. To save your work as a Word document instead of a template, do the following procedure: 1. On the File menu, click New, and then click the template on which you want to base the new document (Normal.dot). 2. Click Document, and then click OK. 3. Copy or Cut/ Paste all of your work from the original file to the new document. 4. Save the new document, making sure that you click Word Document in the Save As Type box in the Save As dialog box. Note: If your original file contains macros, AutoText entries, custom toolbars, menu settings, and shortcut keys and you wish the document to have the same capabilities, you will need to copy these items to the template on which you based the document. ### Possible Infection - Explanation B: If your Word environment is infected by a macro virus, you will notice the above mentioned symptom. If you have deleted all viral macros using Tools | Macro | Delete you still may not be able to save your "cleaned" document as a Word Document(*.doc). We do NOT recommend this removal method by hand. This is because a macro virus may re-infected your environment from another document you open or may activate when you click on Tools | Macro . ### Solution: (provided by NAI Labs) 1. Use VirusScan to scan all WORD documents on your system. You can quickly and automatically examine all your files, followed by reliable virus removal. Please be sure that you are running the most current version of Scan with the most recent DAT files. 2. If you have already removed a macro virus by hand: McAfee AVResearch provides a tool, which guides you through the process of resetting a template. ### DOCFIX for MS Word Version 6 or 7 DOCFIX for MS Word Version 97 ### 2. Problem: While loading your document Word requires a password OR you are unable to make changes in your document. Non - Infection Explanation A (origin: MS Word Help): Word provides several ways to restrict changes to a document: You may do the following: You can assign a protection password, which prevents unauthorized users from opening the document... Or assign a password when you route a document for review, which prevents any changes except for annotations and marked revisions. Finally, you may assign a password when you use form fields to create a form, which prevents others from changing the sections you specify. ### Possible Infection Explanation B: Some macro viruses now are capable of setting passwords as part of their infection. For example, using your Save As function might cause a virus to set a password . You may be infected by a macro virus if you notice one of these following symptoms: - Protection password prompt before the document gets loaded - Tools|Unprotect Document menu entry appears - Changes in the document are not allowed to be saved under the same filename ### Solution: (provided by McAfee) 1. Use VirusScan to scan all WORD documents on your system. 2. You will need the exact password (case sensitive) used by the virus. Our tool will only work for one specific password.. You will need to get the password from our website within the Virus Information Library under the macro virus which you are infected with. If you can not obtain the password please contact virus_research@cc.mcafee.com. 3. McAfee AVResearch provides a tool, which guides you through the process of cleaning out a password without activating the virus. ### DOCFIX for MS Word Version 6/7 DOCFIX for MS Word Version 97 ### 3. Problem: "After cleaning a macro virus I still can't see a Word menu entry, which was deleted by the virus during infection." Possible Infection Explanation: Some Word menu entries may have been deleted by a macro virus to avoid its detection by a user. These side effects need to be restored by the user. ### Solution A: If you have no private menu customization use VIEW|TOOLBARS...|CUSTOMIZE... or TOOLS|CUSTOMIZE... , activate the MENUS tab and click on the RESETALL button. This will restore the default menu system of MS Word. ### Solution B: (provided by McAfee) If you would like to have an automated tool to re-create only lost entries OR you have private menu customization, please try the following for the English, German, French, Italian, Dutch, and Spanish versions of Word: ### DOCFIX for MS Word Version 6/7 DOCFIX for MS Word Version 97