{"id":8809,"date":"2026-05-29T16:04:40","date_gmt":"2026-05-29T14:04:40","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=8809"},"modified":"2026-06-09T05:36:09","modified_gmt":"2026-06-09T03:36:09","slug":"cum-functioneaza-virusii-macro","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/","title":{"rendered":"Cum func\u021bioneaz\u0103 macroviru\u0219ii"},"content":{"rendered":"<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">A macro virus is a type of malware that uses macros embedded within documents to perform malicious actions on a computer. These threats are most commonly associated with office applications that support automation features, such as word processors, spreadsheets, and presentation software.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When a malicious document is opened and its macros are allowed to run, the embedded code can execute automatically and perform actions without the user&#8217;s knowledge.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#What_Is_a_Macro\" >What Is a Macro?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#How_Does_a_Macro_Virus_Work\" >How Does a Macro Virus Work?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#How_Macro_Viruses_Spread\" >How Macro Viruses Spread<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Common_Types_of_Macro-Based_Malware\" >Common Types of Macro-Based Malware<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Information-Stealing_Malware\" >Information-Stealing Malware<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Malware_Downloaders\" >Malware Downloaders<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Ransomware_Delivery\" >Ransomware Delivery<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Spam_and_Botnet_Activity\" >Spam and Botnet Activity<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#How_to_Protect_Against_Macro_Viruses\" >How to Protect Against Macro Viruses<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Keep_Software_Updated\" >Keep Software Updated<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Leave_Macros_Disabled\" >Leave Macros Disabled<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Use_Antivirus_and_Endpoint_Protection\" >Use Antivirus and Endpoint Protection<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Be_Careful_with_Email_Attachments\" >Be Careful with Email Attachments<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#What_to_Do_If_You_Suspect_an_Infection\" >What to Do If You Suspect an Infection<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#The_Importance_of_Backups\" >The Importance of Backups<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Practical_Implications\" >Practical Implications<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/mybox.com\/help\/ro\/knowledgebase\/how-macro-viruses-work\/#Summary\" >Summary<\/a><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Is_a_Macro\"><\/span>What Is a Macro?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<\/div>\n\n<div id=\"mybox-2519523408\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Acces timpuriu<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Mai ave\u021bi nevoie de ajutor?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contacta\u021bi echipa noastr\u0103 de servicii pentru clien\u021bi.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Trimite mesaj<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">A macro is a sequence of automated instructions designed to perform repetitive tasks within an application.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, macros can be used to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Format documents automatically<\/li>\n\n\n\n<li>Generate reports<\/li>\n\n\n\n<li>Process spreadsheet data<\/li>\n\n\n\n<li>Automate administrative tasks<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Applications such as Microsoft Word and Microsoft Excel support macros through scripting languages like VBA (Visual Basic for Applications).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While macros are legitimate productivity tools, they can also be abused to deliver malware.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_Does_a_Macro_Virus_Work\"><\/span>How Does a Macro Virus Work?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A macro virus is typically distributed inside a document file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The general infection process follows these steps:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>A user receives a document through email, messaging platforms, or file downloads.<\/li>\n\n\n\n<li>The document contains malicious macros.<\/li>\n\n\n\n<li>The user opens the file.<\/li>\n\n\n\n<li>The document prompts the user to enable macros or content editing.<\/li>\n\n\n\n<li>Once macros are enabled, the malicious code executes.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Depending on its purpose, the malware may then perform various actions on the infected system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Modern office applications disable macros by default to reduce this risk.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_Macro_Viruses_Spread\"><\/span>How Macro Viruses Spread<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Macro viruses often rely on social engineering techniques rather than software vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Common distribution methods include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Email attachments<\/li>\n\n\n\n<li>Fake invoices<\/li>\n\n\n\n<li>Delivery notifications<\/li>\n\n\n\n<li>Resume submissions<\/li>\n\n\n\n<li>Shared cloud storage links<\/li>\n\n\n\n<li>Downloaded document templates<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers frequently disguise malicious documents as legitimate business files to encourage users to enable macros.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Common_Types_of_Macro-Based_Malware\"><\/span>Common Types of Macro-Based Malware<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Information-Stealing_Malware\"><\/span>Information-Stealing Malware<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Some malicious macros attempt to collect information from the infected device.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Potential targets include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Saved credentials<\/li>\n\n\n\n<li>Browser data<\/li>\n\n\n\n<li>System information<\/li>\n\n\n\n<li>User activity<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The collected information may then be transmitted to an external server controlled by the attacker.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Malware_Downloaders\"><\/span>Malware Downloaders<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A macro may act as a delivery mechanism rather than the final threat.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After execution, it can download and install additional malware such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Remote access tools<\/li>\n\n\n\n<li>Banking trojans<\/li>\n\n\n\n<li>Spyware<\/li>\n\n\n\n<li>Other malicious software<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This approach allows attackers to update or change their payloads over time.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Ransomware_Delivery\"><\/span>Ransomware Delivery<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Some ransomware campaigns use malicious Office documents as an initial infection vector.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once activated, the macro may download ransomware that encrypts files and prevents access to data until recovery procedures are performed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Spam_and_Botnet_Activity\"><\/span>Spam and Botnet Activity<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In some cases, infected systems may become part of a larger network of compromised devices used for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Sending spam emails<\/li>\n\n\n\n<li>Distributing malware<\/li>\n\n\n\n<li>Conducting coordinated attacks<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The user may be unaware that their device is participating in these activities.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_Protect_Against_Macro_Viruses\"><\/span>How to Protect Against Macro Viruses<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Keep_Software_Updated\"><\/span>Keep Software Updated<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Regular software updates help address security vulnerabilities and improve protection mechanisms.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Update:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Operating systems<\/li>\n\n\n\n<li>Office applications<\/li>\n\n\n\n<li>Browsers<\/li>\n\n\n\n<li>Security software<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Leave_Macros_Disabled\"><\/span>Leave Macros Disabled<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Macros should remain disabled unless they are required and originate from a trusted source.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unexpected requests to enable macros should be treated with caution.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Use_Antivirus_and_Endpoint_Protection\"><\/span>Use Antivirus and Endpoint Protection<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Modern security solutions can help detect:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Malicious documents<\/li>\n\n\n\n<li>Suspicious macro activity<\/li>\n\n\n\n<li>Known malware signatures<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Regular scans and active protection improve overall security.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Be_Careful_with_Email_Attachments\"><\/span>Be Careful with Email Attachments<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid opening unexpected attachments, especially when they:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Come from unknown senders<\/li>\n\n\n\n<li>Create urgency<\/li>\n\n\n\n<li>Request enabling macros<\/li>\n\n\n\n<li>Contain unusual file names<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Verifying the sender before opening attachments can significantly reduce risk.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_to_Do_If_You_Suspect_an_Infection\"><\/span>What to Do If You Suspect an Infection<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you believe a malicious macro has been executed:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Disconnect the device from the network if possible.<\/li>\n\n\n\n<li>Run a full antivirus scan.<\/li>\n\n\n\n<li>Remove any detected threats.<\/li>\n\n\n\n<li>Update passwords for important accounts.<\/li>\n\n\n\n<li>Review recent system activity.<\/li>\n\n\n\n<li>Restore data from backups if necessary.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">If sensitive information may have been exposed, additional security measures may be required.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"The_Importance_of_Backups\"><\/span>The Importance of Backups<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Regular backups provide protection against many forms of malware, including threats delivered through macro-enabled documents.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A good backup strategy should include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multiple backup copies<\/li>\n\n\n\n<li>Offline or external backups<\/li>\n\n\n\n<li>Periodic recovery testing<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Backups can significantly reduce the impact of ransomware and other destructive attacks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Practical_Implications\"><\/span>Practical Implications<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Macro viruses remain effective because they often rely on convincing users to enable macros manually. While modern office applications include protections against these threats, malicious documents continue to be used in phishing campaigns and malware distribution.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Combining software updates, security tools, cautious file handling, and regular backups provides the most effective defense against macro-based attacks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Summary\"><\/span>Summary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A macro virus is malware that uses macros embedded within documents to execute malicious actions when a file is opened and macros are enabled. These threats can steal information, install additional malware, distribute spam, or act as an entry point for ransomware.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Maintaining updated software, leaving macros disabled by default, using security software, and exercising caution when opening documents can significantly reduce the risk of infection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[10,42],"manual_kb_tag":[6611,6612,6613,6614,6615,739,758,6608,6609,6610],"class_list":["post-8809","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-safety","manualknowledgebasecat-miscellaneous","manual_kb_tag-office-macros","manual_kb_tag-macro-based-malware","manual_kb_tag-document-malware","manual_kb_tag-phishing-attachments","manual_kb_tag-ransomware-delivery","manual_kb_tag-social-engineering","manual_kb_tag-email-attachments","manual_kb_tag-macro-virus","manual_kb_tag-malicious-macros","manual_kb_tag-macro-enabled-documents"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/8809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":2,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/8809\/revisions"}],"predecessor-version":[{"id":8810,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb\/8809\/revisions\/8810"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/media?parent=8809"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manualknowledgebasecat?post=8809"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/ro\/wp-json\/wp\/v2\/manual_kb_tag?post=8809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}