Word has some special Macro names that are run at certain times. For example, a macro virus in AutoOpen would be run when you open a document and would can copy itself when you open another document. There are many other ways a macro virus can spread from one document to another.
Since the virus is in NORMAL.DOT, reinstalling Word won't remove it. Deleting the NORMAL.DOT file won't remove the virus either because it will just become reinfected when one of the infected documents is opened. Also, not all macro viruses infect NORMAL.DOT.
A document usually cannot contain macros, but a template can, so the Word virus usually needs to change the document so it is a template. This means you might only be able to save it to the template directory, which is where you should look for any missing documents. In Word 97, a document doesn't need to be saved as a template to contain a macro virus. Upconverted and poorly written macro viruses will still save documents as templates.
Most of today's Word macro
viruses use a temporary file to copy their code to other documents. This
temporary file is usually in C:\ and has a SYS extension, but it is not really a system file. You should
delete the file that is detected but you'll still have to remove the macro
virus that created this file.
It can be bypassed or deleted by a clever macro virus. If you open an infected document using a method besides FileOpen the protection may not detect the virus.
It cannot distinguish legitimate macros from virus macros. It requires the user to accurately determine 100% of the time whether a document's macros are a virus or not, just by reading that a document contains macros.
Also, SCANPROT is very slow and only detects the original, unmodified Concept virus. There are over 4,000 macro viruses right now.
I also include Disabling AutoMacros, Prompt To Save NORMAL.DOT, Word's built in virus protection, and making NORMAL.DOT read-only in this category. They can't distinguish the perfectly normal from the virus, and they can be bypassed. Of course they help, but for most people they're probably not worth the trouble for the protection they give and they give a false sense of security.
2. Why not to use MVTOOL/SCANPROT
I do not recommend SCANPROT for a few reasons.3. What kind of product to use
If you are a Windows user then there are a lot of different anti macro virus products available. Almost all Windows antiviruses have been updated to handle macro viruses. You should test how well they work and ask questions before you make any decisions on which one
to buy. Most antivirus companies have evaluation version available to try out.
You could try the antivirus programs on my site here.
If you have finished cleaning the virus and menu items such as ToolsMacro are still missing, then click the View menu, choose Toolbars, choose Customize, click the Menus tab, then click Reset All. The programs I have here to remove macro viruses can also restore the menu items .