[Jean-Pierre]

After having made several trials, among which uninstall / reinstall OFFICE, I
found a remnant of "MathType". I uninstalled it and, apparently, the tentative
connexion did occur no more.

"MathType" is an equation editor that insist on installing itself on a free-30
days trial basis when one uses the standard equation editor. But I found it
brings little to the standard equation editor, so I did not buy its licence.
Apparently this remnant caused the tentative INTERNET connection. Note that the
tentative NET connexion happened even for "new" documents, having no equations
whatsoever.

Jean-Pierre
Belgium

================================================== ================
"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my anti-virus
that WORD has been recently modified, that it tries to access the INTERNET and
that I should deny the permission unless I am sure that the modification is
due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed
them.

I re-started WORD and got again the message about WORD trying to access the
NET.

I do not understand why WORD should access the NET. Is there any reason for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium