Step-by-step cleanup of a macro virus from Microsoft Office files

A macro virus hides inside documents, templates, or spreadsheets and runs code when Microsoft Office opens the infected file. Some infections display obvious warnings, while others silently download malware, alter settings, or spread through shared folders and email attachments.

Cleaning the affected Office files requires more than deleting one suspicious document. You must stop the macro from running, identify possible persistence locations, scan the computer, and recover files from a trustworthy source. The steps below apply mainly to Windows systems, although similar precautions are useful on macOS.

Do not open additional attachments or enable content while investigating. If the computer contains business records, legal documents, or irreplaceable personal files, preserve copies before making major changes and consider obtaining professional incident-response help.

Recognize the warning signs

Unexpected security warnings, unfamiliar macros, disabled antivirus protection, or Office files that open with strange messages can indicate a macro-based infection. Other signs include documents being modified without permission, new files appearing in shared folders, unusually slow performance, and emails sent from your account without your knowledge.

A macro virus may also launch PowerShell, Command Prompt, or a browser in the background. Repeated Office crashes, unknown add-ins, and prompts asking you to “enable editing” or “enable content” are reasons to stop interacting with the document until it has been checked.

Disconnect the computer from Wi-Fi or wired networks if you suspect active data theft or rapid file changes. This can limit communication with a command-and-control server and reduce the chance of the infection spreading through network shares.

Protect files and disable macros

First, close Word, Excel, PowerPoint, Outlook, and other Office applications. Do not save an infected document after opening it. If ransomware-like behavior or mass file changes are occurring, shut down the affected computer after disconnecting it from the network.

On a separate, trusted device, change important passwords, especially email, cloud storage, and Microsoft account credentials. Use multi-factor authentication where available. Avoid copying suspicious files to USB drives or uploading them to cloud storage, because that can distribute the infection.

Open an unaffected Office application only if the computer appears stable, then go to Trust Center settings and set macro execution to “Disable all macros with notification” or a stricter option. Do not choose “Enable all macros.” In many environments, administrators can enforce this setting through Group Policy.

Inspect Office locations and persistence

Use a trusted antivirus or Microsoft Defender scan before manually deleting files. A full scan can detect the macro carrier and related payloads, while an offline scan is useful when malware tries to hide during normal Windows operation. Record detection names and file paths before quarantine when possible.

Check the Office startup folders and templates for unfamiliar files. Depending on the Office version, suspicious items may include global templates, add-ins, XLSTART workbooks, or files with recent modification dates that you did not create. Do not delete system or business templates without verifying their purpose.

Review Windows startup entries, scheduled tasks, browser extensions, and recently installed programs. A macro may be only the first-stage trigger for a trojan or spyware component. If browser extensions are changing unexpectedly, follow this guide on malicious extensions before signing in to sensitive websites again.

Location or component	What to check	Safer action
Office documents	Unexpected VBA projects, prompts, or altered content	Quarantine and replace with clean copies
Global templates and add-ins	Unknown files or recent changes	Disable, then verify with trusted documentation
XLSTART and startup folders	Workbooks that open automatically	Move suspicious items to quarantine
Scheduled tasks	Random names, hidden scripts, or unusual triggers	Disable only after recording details
Browser and email settings	New extensions, rules, or forwarding addresses	Remove unknown entries and reset credentials

Scan for related malware

A macro infection can install a downloader, keylogger, remote-access trojan, or ransomware. Run a full scan with Microsoft Defender and a reputable second-opinion scanner, keeping both tools updated. Never install security software from a pop-up, an unsolicited email, or a file delivered by the suspicious document.

Review active network connections and recently created processes if you have the technical experience to do so. Unknown executables in temporary folders, AppData, or Office-related directories deserve investigation, but avoid terminating essential Windows processes based only on a vague name.

Check email rules, sent messages, cloud-sharing activity, and login history. If the computer’s camera indicator activates unexpectedly or accounts show suspicious access, isolate the device and investigate further using guidance about webcam hijacking signs. A macro-triggered payload can affect privacy beyond the original document.

Recover clean documents carefully

Restore important files from backups made before the infection. Prefer offline, versioned, or immutable backups over copies connected to the affected computer. Before restoring a large collection, scan the backup and test a small number of files in a protected environment.

For documents that must be preserved, open them in Protected View or a disposable virtual machine with macros disabled. Copy plain text or unformatted data into a new document instead of retaining an embedded VBA project. If a workbook requires macros for legitimate business functions, obtain the code from its original publisher and verify its digital signature.

If files were encrypted or corrupted, do not rename them repeatedly or use random decryptor programs. Identify the ransomware family, preserve several encrypted samples, and check reputable security resources for a matching decryptor. Recovery tools are most effective when the original encrypted files and ransom note remain available.

Reduce the chance of reinfection

Keep Windows, Microsoft Office, browsers, and security software patched. Configure Office to block macros from internet-originated files and use trusted locations sparingly. Organizations should apply application allowlisting, restrict script interpreters where practical, and train staff to treat unexpected attachments as hostile.

Use standard user accounts for daily work and keep administrator credentials separate. Email filtering, attachment sandboxing, and disabled macros for users who do not need them can prevent many common attacks.

Practical safeguards include:

• Verify unexpected documents through a separate communication channel.
• Keep at least one disconnected or immutable backup.
• Review Office add-ins, templates, and startup folders regularly.
• Enable multi-factor authentication on email and cloud accounts.
• Report suspicious attachments instead of forwarding them.

After cleanup, monitor the computer and online accounts for several days. Remove any remaining suspicious sessions, reset credentials from a clean device, and document the files, detections, and actions taken. Run a final full scan before reconnecting the system to shared drives.

Use these steps to contain a suspected macro virus, protect unaffected documents, and restore work from verified sources. If malware continues returning, sensitive data may have been exposed, or the infection involves a business network, preserve evidence and contact a qualified cybersecurity professional promptly.