Windows Explored

One of our users was being annoyed by the following macro security prompt when opening a PowerPoint presentation: “Security Warning … contains macros.”

It’s not uncommon to see this warning when opening any Office file that contains macros. However, in the case here, the presentation was a simple slide show that, as far as the author knew, contained no macros. I was asked to investigate. I quickly scanned through the slide show and could see no custom actions or anything else that would indicate a macro. In fact, no macros were listed in the macro window:

To find the source of this prompt, I would need to look under the hood of the PowerPoint presentation. This could be accomplished by going into the Office Visual Basic Editor, which I accessed from Tools > Macro > Visual Basic Editor. From here the problem revealed itself:

The slides here did not actually correspond to real slide numbers in the presentation so I don’t know what the numbering in the VB Editor means or how it got there.

To see what the slide in the VB editor links to in the actual presentation click the View Object button in the Project window. In all but one of the slides, this object pointed to a slide that had various logos pasted into. I can only guess, but perhaps some code was copied into the slides during a copy and paste from the Internet, which included the embedded HTMLHidden code above.

To correct the problem, I selected the code in each slide in the VB Editor and deleted it (I could not actually remove the slide itself, the option was grayed out). After doing so, I saved in the VB Editor, saved and closed the presentation, opened it again, the macro warning did not pop up and then verified that the slides no longer existed in the VB Editor:

The last step was to run the presentation and make sure it was still intact.