Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Help with a virus- (W97M.Thus.A)on a Mac, how to fix.

Eniregnat

Eniregnat

macrumors 68000
Original poster
Jan 22, 2003
1,841
1
In your head.
I searched the forums and I am a little stymied. I just had a teacher call me and tell me that the documents that I created using MS Office for OS X (v.X) have a virus. Poppycock I say, and I download ClamXav. I search my documents folder and come up with the following log (part of which is shown below).

Any ideas on how to fix the individual documents. I am downloading the MS updates for Office, and I hope that it fixes the VB problem. I have to use VB Macros for both work and school (stats tools).

So technically, while not affecting my Mac, but affecting MS Office, I have a virus, with out running Windows. W97M.Thus.A.

15 other documents, including all of my final papers for last quarter were infected. If anybody has a good bit of text they can post os I can point my professors towards this thread explaining that this really isn't a problem, or how I could miss it.

(Sorry about the .gif pic below, but ClamX dosn't allow for quick text selection.)

Edit: I have sent my papers back to the one teacher that alerted me to the problem as text only emails. I would love some help with the problem. I will check back tomorrow.
 

Attachments

  • Picture 1.gif
    Picture 1.gif
    10.8 KB · Views: 697
Ok, I'm no expert, but I'm guessing that W97M stands for Word 97 Macro (virus). Office is susceptible to macro viruses on both platforms (yay Microsoft!). I don't think you've got much to worry about as far as doing damage to the rest of your Mac, but it wouldn't be a bad idea to search around on the net for information on the particular virus that you've got and figure out how to completely remove it.
 
Unfortunately you have one of a couple of choices.

1) Put all your documents on a USB flash drive, take it to a friend's PC with current, up-to-date anti-virus software, clean your docs, delete the originals (including your normal.dot) from your Mac and copy the now cleaned versions from the flash drive back to your computer.

Or
2) Spring for Mac Anti-Virus software since Clam only detects, it doesn't clean. I believe a recent review by MacWorld stated they like Intego's VirusBarrier the best but stated that Symantec's Norton Antivirus dealt with Windows virus' better. Here's the full review:

http://www.macworld.com/2006/06/features/antivirussw/index.php

Jeff
 
Ya, I knew that MS products could become infected by VB macros (unwanted code= virus), but I really didn't think it could happen on a Mac. Well, looks like I have to get an AV solution.

Thanks to you two. I really wish Apple used the term "virus resistant". The "No viruses on Mac's" is going to bite them in the ass one day. I know why OS X is so virus resistant, but really, it is only a mater of time before somebody some way that doesn’t require buffer overflows, address forcing, etc…
 
If they're basically just text documents, why not take them, copy and paste the text into a new file, and save it elsewhere?
 
OutThere said:
If they're basically just text documents, why not take them, copy and paste the text into a new file, and save it elsewhere?
Click to expand...

Psh. That would be FAR to easy and simply. Remember, this is a Microsoft virus. The removal process must be VERY DIFFICULT and result in at least 15 one hour+ phonecalls to Bangalor to a guy named Tim Smith with a very thick accent.

On topic- I would go for the copy/paste strategy. If not- well, I have no mac virus experiance, but if you have a PC and want some good virus cleaning software there is a good amount of freeware...if that is what you end up deciding to do let me know and I'm sure I can put together a list.
 
So what is the source of the virus, the normal.dot file? I dont think a copy and paste would be enough, you need to firstly eliminate the change of the virus infecting the new file as well.
 
Simply to satisfy my own quriosity I went and read up about W97M.Thus.A, and it turns out its a pretty harmless little "virus" that cant really do any damage to the mac, and only does damage to windows PC's on the 13th of December. Turns out I was right, the normal.dot file is sort of the source!

Also found a website that gives instructions on exactly how to remove the virus from a mac! :D
 
Eniregnat said:
Thanks to you two. I really wish Apple used the term "virus resistant". The "No viruses on Mac's" is going to bite them in the ass one day.
Click to expand...
Apple is very careful to never say that there are no viruses on the mac. You are misinterpreting what they've said.
 
Do you even have MS Office virus protection enabled? Obviously, you've received the virus from somewhere else.

You should be able to clean each document manually by going into the Macro menu and deleting the macro code that is the virus.

Since you've not mentioned running Windows, you shouldn't have any code loaded that would re-create the virus in your documents folder. You should also not have a problem with Brenda, which disables the Macro menu items.
 
Phobophobia said:
Apple is very careful to never say that there are no viruses on the mac. You are misinterpreting what they've said.
Click to expand...

Mmm, I think it's the subject of one of those Mac ads, no?
The one when the PC is sneezing all the time, but not the mac.
 
Felldownthewell said:
Psh. That would be FAR to easy and simply. Remember, this is a Microsoft virus. The removal process must be VERY DIFFICULT and result in at least 15 one hour+ phonecalls to Bangalor to a guy named Tim Smith with a very thick accent.
Click to expand...

Haha, oh so true.
 
I've seen this happen to the unsuspecting as well. I've always found a certain irony that the ONLY significant virus threat on the Mac is directly through a Microsoft product. Really, think about that.

Well, you have to give them some credit--Word is so smoothly cross-platform we can even get cross-platform viruses through it. (Although, in another stroke of irony, they rarely if ever work properly on the Mac--generally just propagate without causing any damage locally).

The instructions on that page are pretty good--I ended up doing basically the same thing when I ran across a client's computer that was infected with something similar.
 
Arnaud said:
Mmm, I think it's the subject of one of those Mac ads, no?
The one when the PC is sneezing all the time, but not the mac.
Click to expand...

"PC: Last year there were 56347563748 viruses for PC's.
Mac: PC's, not Macs."

Apple never states that Macs are virus free. Only that there are tons of viruses for windows machines.
 
Thanks all, though it was more like a roast than something helpful.

I was just as clever as those of you above. I did just cut and paste the text into an email. The class required, and the university in general, requires everything to be in word format. For my experimental design class, each student created a macro and a set of track changes for her/his paper. I explained that the virus wasn't anything harmful, but the teachers did not care.

The whole thing isn't a big deal, just I wanted to use my Mac as a solution to the problem and not my PC. All to often, at work, I use my PB to solve problems, and I just hate having to use my PCs to solve a Mac problem.

I didn't have the Macro virus protection on as it interfered with a template I use at work. Now that I have done the updates for Office, I might have fixed the problem. Otherwise, as noted above, I will re-install the normal.dot and if that doesn’t work, reinstall Office- which is a pain in the ass.
 
W97m.Thus.A

These posts are old but I have just "obtained" this virus on my MAC. Any help would be appreciated. The only one with a link led to a blog and I searched but could not find the info. HELP!
 
Falkor said:
These posts are old but I have just "obtained" this virus on my MAC. Any help would be appreciated. The only one with a link led to a blog and I searched but could not find the info. HELP!
Click to expand...

What Mac you have and what Mac OS X and Microsoft Office version do you use?

What AV software did find that virus?

http://www.google.com/search?client...oe=UTF-8&redir_esc=&ei=9GCeS6KZGYGH_Aaa9oH7CQ

http://www.eset.com/threat-center/encyclopedia/threats/w97mthusa

You know that your Mac is safe though, don't you? Only Windows is affected by this.
 
Falkor said:
These posts are old but I have just "obtained" this virus on my MAC. Any help would be appreciated. The only one with a link led to a blog and I searched but could not find the info. HELP!
Click to expand...

Can you use the copy-paste strategy as noted in one of the earlier posts?
 
W97m.Thus.A virus help

I have an iMac
MAC OSX version 10.4.11
Microsoft Office 2004

Copy/paste does not solve the problem. Working from home is fine (MAC) but when attached and opened at school, the school systems AV will not allow opening due to virus (the ALERT screen gave the code: W97m.Thus.A. Any solutions or a specific program to purchase to fix?
 
Up and Running Again

Thanks for all the help. Angelwatt, the link was very useful. For anyone who may come after me looking for answers:

1. Open HD/Users/"house" icon/Documents/Microsoft User Data

2. TRASH the "Normal" (don't worry, Microsoft will recreate a new "Normal")

3. Restart computer

4. When opening an infected file, disable macros/copy/paste into new doc/save/now TRASH the infected file.

Thank goodness for a MAC - this would never work on a PC!
 
Concerning the virus W97M/downloader obtained via my latest Microsoft Office for Mac MAU: (build 19081202, v16.28.0)-my Intego AV detected 1,015 Trojans which had attached themselves to most of the files in my docs folder. A recent backup fixed it but now I don't trust the MAU.
 
baudster said:
Concerning the virus W97M/downloader obtained via my latest Microsoft Office for Mac MAU: (build 19081202, v16.28.0)-my Intego AV detected 1,015 Trojans which had attached themselves to most of the files in my docs folder. A recent backup fixed it but now I don't trust the MAU.
Click to expand...
Any sort of virus you found on your Office files didn't come from the Microsoft Autoupdater.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back