A Word macro virus is malicious macro code that spreads by infecting Word documents or templates. It may run when an infected file is opened and its macros are allowed to run. A macro-enabled file is not automatically infected: the file type and the trust settings affect what it can do, but neither alone proves a file is safe or malicious.
What makes it a Word macro virus?
The defining feature is spread through file infection. The virus uses Word macro code stored in a document or template and can copy itself into other Word files or templates. Microsoft classifies macro viruses as malware that spreads through infected documents and runs when those documents are opened.
As an Amazon Associate I earn from qualifying purchases.
That distinguishes a macro virus from macro malware more broadly. A malicious macro might, for example, download other harmful software without copying itself into more documents. Such a threat is macro malware, but the available evidence does not establish it as a virus unless it spreads by infecting files.
What can it do?
Propagation is the defining behavior, but an infected macro can also alter Word documents or settings. Microsoft’s historical description of Virus:W97M/DocCopy.L says it infected Word’s global template and documents opened or closed in Word. The entry also reports that it could disable macro warnings and remove password protection from documents, making them available for infection. Microsoft published the entry on July 29, 2011, and updated it on September 15, 2017; it describes historical behavior, not the prevalence of that strain today.
#1 Best Overall
Does a .docm file mean a document is infected?
No. In current Word formats, .docm identifies a macro-enabled document format that can contain macros. A standard modern Word document uses .docx. The extension is a clue about the file’s capabilities, not a verdict about its contents: a .docm file may be legitimate, and the extension alone does not establish that it is malicious.
Microsoft’s guidance for Microsoft 365 and the listed Office versions—including Word 2024, 2021, 2019, and 2016—groups macros with ActiveX controls and add-ins as active content. Whether that content runs depends on Office’s trust and active-content handling. Microsoft says active content does not run automatically unless the file is trusted or opened from a trusted location; a malicious macro may run if its content is enabled.
How to handle a macro-enabled Word file safely
- Do not choose Enable Content unless you know what the active content does. Microsoft cautions: “Do not select Enable Content unless you’re certain that you know exactly what that active content does, even if the file appears to come from a person or organization that you trust.”
- If you only need to view a document or make simple edits, Microsoft says you usually do not need to run a macro. Leave active content disabled when you do not have a clear reason to enable it.
- Keep anti-malware protection current. Microsoft says modern anti-malware software should detect and block known macro viruses; that guidance does not guarantee detection of every unknown or modified threat.
Historical examples are not evidence of current prevalence
Microsoft’s Virus:WM/Concept.A entry describes a virus written for Word 6 that became the first widely known Word macro virus. It spread by infecting documents and templates, including Word’s Normal template. The entry was published July 15, 2009, and updated September 15, 2017. This is a historical example, not evidence that Concept.A is active today.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
