VBA malware in Excel

Question

How to find and delete malware that is related to Excel-macro workbooks?

Answer 1

Hi Kaj Bredenberg,

Thank you for reaching out to the Microsoft Q&A forum.

If you suspect that a workbook contains malicious VBA (macro) code, please follow the steps below to identify and remove potential threats safely:

1/ Do not enable macros immediately

When opening the Excel file, do not click “Enable Content” if you are unsure about the source. Malicious code usually runs only after macros are enabled.

2/ Scan the file with Microsoft Defender

If you are using Windows:

• Right-click the Excel file
• Select Scan with Microsoft Defender You can also run a full system scan from Windows Security:
• Go to Start > Windows Security
• Select Virus & threat protection
• Choose Scan options > Full scan This helps detect known macro-based malware.

3/ Open Excel in Safe Mode

To prevent macros from running:

• Press Windows + R
• Type: excel /safe
• Open the file while in Safe Mode Safe Mode prevents add-ins and automatic macro execution.

4/ Check the VBA project manually (advanced users only)

If macros are enabled and you want to inspect them:

• Open Excel • Press Alt + F11 to open the VBA editor
• Review modules for suspicious code such as:
• Auto-run procedures (e.g., Workbook_Open)
• Code that downloads files from the internet
• Code that runs PowerShell or cmd commands If you are unsure about the code, do not modify it manually.

5/ Remove macros completely_ If you want to keep only the data:

• Open the file without enabling macros
• Click File > Save As
• Save as: Excel Workbook (*.xlsx) The .xlsx format does not support macros, so this removes all VBA code.

6/ Keep Excel updated

Make sure Microsoft 365 Apps or Excel is fully updated, as security updates help prevent macro exploitation.

If the file came from an unknown or untrusted source, the safest option is to delete it and avoid opening similar attachments in the future.

If you need further help, please let us know:

• Are you using Microsoft 365 Apps, Excel 2019, or another version?
• Are you receiving any specific security warning message? We will be happy to assist further.

We will be happy to assist further.

---

If you have extra questions about this answer, please click "Comment". 

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.