to their original condition or to a functionally equivalent state in step 320 the system determines if any records remain to be examined if there are remaining records the system determines in step 322 whether there are any further macros in the record 39 s document if not the method continues in step 320 if there are macros in the document the system determines in step 324 whether the macro was present in the previous old state of the document if so the method continues in step 322 if not the macro that was added since the last database entry was made is removed in step 326 alternatively the module 202 could remove all macros from documents which previously contained none or remove all and only macros that belong to one or more viral sets the document 39 s database information is then updated in step 328 when all such documents have been processed the user is informed of which macros were removed from which documents in step 330 and the generic module returns control to the main anti virus program 201 now that the invention has been described by way of a preferred embodiment various modifications and improvements will occur to those of skill in the art for example the program can alternatively be designed to alert the user of possible viral activity when documents are determined to contain program objects where before they had contained none in another possible embodiment the alert will occur when a predetermined minimum number of documents.