Everything you need to know about macro viruses

Oct. 29, 2018

What is a macro virus? A macro virus is a computer virus written in the same macro language that is used for software applications, such as word processing programs.

Microsoft Word and Excel are two examples of applications that feature powerful macro languages. The languages are embedded in documents. This allows them to run automatically when the documents are open.

Virus warning signs: How to tell if your computer has a virus

Computer viruses are about as diverse as computer users. Here’s how to tell if your computer has a virus.

If a macro virus has infected these files, it has the potential to damage the document or other computer software. When an infected file is opened, the macro virus releases a sequence of actions that begin automatically. These actions cause damage to the computer and its applications.

How do macro viruses spread?

Macro viruses are often spread through phishing emails containing attachments that have been embedded with the virus. The virus will access the files in the recipient’s address book and send an infected email to everyone on the contact list.

Because the email looks like it came from a credible source, many recipients open it. Once an infected macro is executed, it can jump to every other document on the user’s computer and infect them.

Macro viruses spread whenever a user opens or closes an infected document. They run on applications and not on operating systems. The most common methods of spreading macro viruses include:

  • Sharing files on a disk
  • Sharing files on a network
  • Opening a file that is an email attachment
  • Downloading a file via a modem and then opening the file
  • Downloading a file via the internet or an intranet and then opening the file

As with many other forms of viruses and malware, macro viruses can be difficult to detect.

What do macro viruses do?

Macro viruses are programmed to perform lots of tasks on computers. For example, a macro virus can create new files, corrupt data, move text, send files, format hard drives, and insert pictures. One of their more common missions? Delivering destructive viruses and malware.

An example of a macro virus

A now-classic example of a macro virus is the Melissa Virus from 1999. Opening an email containing a document infected with the virus caused the email to send itself to the first 50 addresses in the user’s contact list. The virus subsequently replicated at an extraordinarily fast rate.

Application rather than operating system

Because macro viruses are based on an application rather than on an operating system, they have the ability to infect any operating system, including those on non-Windows computers.

What are the symptoms of a macro virus infection?

Here are a few signs that indicate your computer may have a macro virus infection:

  • Your computer runs slower than normal.
  • Your computer asks you for a password on a file that normally doesn’t require one.
  • Your computer saves documents as “template” files.
  • Your computer displays strange error messages.

How do I get rid of a macro virus?

It’s a good idea to use a reliable security software to help remove macro viruses. Most trusted antivirus software prevents macros from downloading malware to your computer.

Here’s what to do if you think a Word or Excel document contains a macro virus: Press “Shift” while opening the document. This opens it in Safe Mode. It allows you to check if there are macros present in the document. If you find anything, you can remove it manually.

In Word 2010 or Excel

  1. Click “View”
  2. Select “Macros”
  3. Select “Organizer
  4. In the dropdown menu, select the infected file and delete it.

How do I help prevent macro viruses from infecting my computer?

As with all forms of computer viruses and malware, prevention is best. Use the following tips to help protect your computer:

  • Install updates to your computer security system when available to guard against new types of viruses.
  • Make sure you update your computer’s operating system regularly to ensure optimal protection. For example, if you have Windows 8 and are being prompted to update to Windows 10, do it.
  • Use digital signatures. They identify download sources. That way you can be sure the files you’re downloading and running are not risky.
  • Choose a reputable security software.

Macro viruses are among some of the sneakier ways of infecting a computer. But there are things you can do to help protect your computer and data.

For example, it’s smart to stay current on new cyberthreats. Also, give your computer a thorough security scan if it hasn’t had one in a while. And if you’ve been ignoring update notifications, take action.

Try Norton 360 FREE 30-Day Trial* - Includes Norton Secure VPN

30 days of FREE* comprehensive antivirus, device security and online privacy with Norton Secure VPN.

Join today. Cancel anytime.

*Terms Apply

Editorial note: Our articles provide educational information for you. NortonLifeLock offerings may not cover or protect against every type of crime, fraud, or threat we write about. Our goal is to increase awareness about cyber safety. Please review complete Terms during enrollment or setup. Remember that no one can prevent all identity theft or cybercrime, and that LifeLock does not monitor all transactions at all businesses.

Copyright © 2023 NortonLifeLock Inc. All rights reserved. NortonLifeLock, the NortonLifeLock Logo, the Checkmark Logo, Norton, LifeLock, and the LockMan Logo are trademarks or registered trademarks of NortonLifeLock Inc. or its affiliates in the United States and other countries. Firefox is a trademark of Mozilla Foundation. Android, Google Chrome, Google Play and the Google Play logo are trademarks of Google, LLC. Mac, iPhone, iPad, Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc. Alexa and all related logos are trademarks of, Inc. or its affiliates. Microsoft and the Window logo are trademarks of Microsoft Corporation in the U.S. and other countries. The Android robot is reproduced or modified from work created and shared by Google and used according to terms described in the Creative Commons 3.0 Attribution License. Other names may be trademarks of their respective owners.