Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

How do you remove the W97M.Downloader Trojan from a Macbook Pro?

Hi all,


I am running a Macbook Pro (OS X Yosemite 10.10.4) and Nortons for Mac.


Yesterday I received notification from Nortons that I was infected with the W97M.Downloader Trojan and that it couldn't quarantine or delete it. Extensive searching on the net has found only 1-2 instructions for moving this trojan but its for Windows PCs only. I am unable to find any help for removing this from my Mac.

I am of the understanding this Trojan has potential for malicious behaviour. I didn't think that Macs could get viruses?


Can anyone help please?


Thanks

Posted on Jul 3, 2015 7:29 PM

Reply
Question marked as Best reply

Posted on Jul 3, 2015 7:33 PM

Yes, so far that is correct. There are no viruses that affect OS X. Having, one, a hundred or a million Windows viruses on your Mac are just files taking up space that can't do a thing to your Mac.


Most likely, it's an email attachment. Also, besides any AV software being completely useless on a Mac, Norton is the worst of the worst. Get rid of it. Your Mac will run FAR better.

5 replies
Question marked as Best reply

Jul 3, 2015 7:33 PM in response to brer_rabbit

Yes, so far that is correct. There are no viruses that affect OS X. Having, one, a hundred or a million Windows viruses on your Mac are just files taking up space that can't do a thing to your Mac.


Most likely, it's an email attachment. Also, besides any AV software being completely useless on a Mac, Norton is the worst of the worst. Get rid of it. Your Mac will run FAR better.

Mar 4, 2016 5:10 AM in response to Kurt Lang

Not True - I have 2 macs and no windows PC but W97M keeps getting on my Macs and sending emails to all my contacts. I have removed it with AVG repeatedly, but it just keeps coming back. I run AVG Realtime Protection all the time, but it doesn't stop the re infection. My contacts must hate this. I have changed the email password. It happens after Mac Mail app crashes - next day I get loads of bounced emails the I sent (but didn't and they are not in my sent folder.


Its a myth that Macs don't get infected - MINE DOES


And I can't find how to cure it!!

Mar 4, 2016 7:00 AM in response to DH15USR

WM97 is a Microsoft Office Word macro virus. It can't do anything unless you open an infected Word document, which allows the macro to run. And then only if you intentionally turn off the option in Word's preferences:


User uploaded file


With the default option of being on, Word will tell you the file you're opening has a macro attached to it. Many macros are beneficial to getting work done, this one isn't. But the point is it can't do anything unless you open an infected document and allow the macro to run.


If you did allow the macro to run at any time, the virus behavior of it is to infect Word's Normal.dot template so every single Word document you create has the same macro attached to it. If you're not using Office for Mac, or don't allow Word macros to load, WM97 is not your problem. And regardless, the macro has nothing to do with email. What it does when loaded is to attempt to download other Windows malware. Which of course can't do a thing to your Mac.


If you are using Office, getting rid of WM97 is pretty easy, though time consuming if you've created a lot of Word documents.


1) Close any Office apps running. Or at least Word.


2) Delete the (possibly) infected base template for Word. For Office 2004, go to the ~/Documents/Microsoft User Data/ folder. Delete the file Normal . For Office 2008 and 2011, go to the ~/Library/Application Support/Microsoft/Office/User Templates/ folder. Delete the file Normal.dotm . The tilde ~ means your user account, not the root Library folder. One the quickest ways to open your user account is to be at the desktop so Finder is the active foreground app listed next to the Apple logo at the upper left. Then press Command+Shift+H.


3) Launch Word without opening any standing documents. It will create a new Normal template. Open Word's preferences and make sure under the Security heading that the check box to warn of macros is on. Close Word. Do a Get Info on the newly created template and lock it (click the check box for the Locked setting). Close the Get Info box.


4) Now start opening all of your Word documents. If it opens with a warning about macros, open the document without allowing the macro to load. Open a new document. Copy/past the text from the infected document to the new blank document. Save the new document. Close the infected document and delete it. Repeat for all infected Word documents.


Now back to email. You aren't finding any sent emails because you aren't sending them. Someone else is. There are no email viruses that work in OS X. They all rely on the Windows OS to work. The two main possibilities.


1) Much more likely. One of more people you know who have your email address in their email client on a Windows computer has an email virus. They all do pretty much the same thing. They send out spam to every contact in that person's address book and randomly choose one of the contact names to spoof as the "sender". It looks to others like it came from you, but didn't. Nothing you can do about it. They have to clean up their end. The only possible work on your end is to never forward and email with an unknown attachment. You may be the one forwarding Windows email viruses to your Windows using friends and colleagues.


2) You are using very easy to guess or crack passwords for your email account at your ISP. That someone would target your account over and over in particular just to send out spam isn't very likely, but possible. Test by using something much harder to crack or guess, such as zgO8YcYL9gr1ZhuWynNiqXNB.


3) If after changing to a password that would literally take trillions of years to crack using brute force methods, and spam once again starts appearing to come from you, you may have a problem. Possibly a keylogger. Those would get on your system by your doing. Such as downloading and installing illegal software, or software from sites you weren't sure about. That a crook would only use that data to pick on your email account is also so-so. They'd be much more interested in snagging your bank account passwords and PINs. It's still much more likely after using such a strong password that the emails are coming from infected Windows users who have your email address in their contacts.

How do you remove the W97M.Downloader Trojan from a Macbook Pro?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.