[Jean-Pierre]

Hello,

Since a few days, everytime I start WORD, I get the message from my anti-virus
that WORD has been recently modified, that it tries to access the INTERNET and
that I should deny the permission unless I am sure that the modification is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed
them.

I re-started WORD and got again the message about WORD trying to access the NET.

I do not understand why WORD should access the NET. Is there any reason for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Terry Farrell]

Word regularly connects to the Internet to update Help and report changes
you may have added to your Custom.dic (this may influence whether these get
added to the main spelling checker at a later update) and other service
options.

--
Terry Farrell - MS Word MVP

"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the INTERNET
and
that I should deny the permission unless I am sure that the modification
is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known
action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer
: no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to access
the NET.

I do not understand why WORD should access the NET. Is there any reason
for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have
to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Aalaan]

Is this a feature on Word 2000? It may explain some previously inexplicable
email sending that seems to go on while I'm on line and not consciously
sending anything.

"Terry Farrell" wrote in message
news
Word regularly connects to the Internet to update Help and report changes
you may have added to your Custom.dic (this may influence whether these
get added to the main spelling checker at a later update) and other
service options.

--
Terry Farrell - MS Word MVP

"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the
INTERNET and
that I should deny the permission unless I am sure that the modification
is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known
action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer
: no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to access
the NET.

I do not understand why WORD should access the NET. Is there any reason
for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD
have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Graham Mayor]

If my system was sending e-mails without my express permission, I would be
very alarmed! This sounds like virus activity - or you are not explaining
the issue well..

--

Graham Mayor - Word MVP

My web site www.gmayor.com
Word MVP web site http://word.mvps.org


Aalaan wrote:
Is this a feature on Word 2000? It may explain some previously
inexplicable email sending that seems to go on while I'm on line and
not consciously sending anything.

"Terry Farrell" wrote in message
news
Word regularly connects to the Internet to update Help and report
changes you may have added to your Custom.dic (this may influence
whether these get added to the main spelling checker at a later
update) and other service options.

--
Terry Farrell - MS Word MVP

"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the
INTERNET and
that I should deny the permission unless I am sure that the
modification is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any
known action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the
computer
no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to
access the NET.

I do not understand why WORD should access the NET. Is there any
reason for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should
WORD have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Terry Farrell]

Alan

IIRC, not on Word2000. As Graham says, this sounds badly likely malware.

I recommend SpyBot Search and Destroy for attacking malware as it has been
the most successful utility I have used on my own and friend's computers ate
eradicating tough malware where many other utilities (and quite big vendors)
have failed. It is free to use for personal use but it is imperative to make
sure that you go to the correct site. There are several other sites
pretending to be the home of SpyBot and they end up making you pay for what
is a free utility.

Get it from he http://www.spybot.info/

Terry Farrell


"Aalaan" wrote in message
...
Is this a feature on Word 2000? It may explain some previously
inexplicable email sending that seems to go on while I'm on line and not
consciously sending anything.

"Terry Farrell" wrote in message
news
Word regularly connects to the Internet to update Help and report changes
you may have added to your Custom.dic (this may influence whether these
get added to the main spelling checker at a later update) and other
service options.

--
Terry Farrell - MS Word MVP

"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the
INTERNET and
that I should deny the permission unless I am sure that the modification
is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known
action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the
computer : no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to access
the NET.

I do not understand why WORD should access the NET. Is there any reason
for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD
have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Tom Willett]

The remote IP address is to VeriSign.
The port is an unassigned port, but I've heard it's often used by trojans.

Tom
"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the INTERNET
and
that I should deny the permission unless I am sure that the modification
is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known
action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer
: no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to access
the NET.

I do not understand why WORD should access the NET. Is there any reason
for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have
to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Aalaan]

I had my suspicions, but so far no-one has debited any of my bank accounts
(not that there's much to debit!). Thank you very much for that site. I did
try caVet but have been unhappy and certainly I keep hearing things about
Nortons, so all in all I have been suspicious of the very industry itself.
But I'll try your site right now...

"Terry Farrell" wrote in message
...
Alan

IIRC, not on Word2000. As Graham says, this sounds badly likely malware.

I recommend SpyBot Search and Destroy for attacking malware as it has been
the most successful utility I have used on my own and friend's computers
ate eradicating tough malware where many other utilities (and quite big
vendors) have failed. It is free to use for personal use but it is
imperative to make sure that you go to the correct site. There are several
other sites pretending to be the home of SpyBot and they end up making you
pay for what is a free utility.

Get it from he http://www.spybot.info/

Terry Farrell


"Aalaan" wrote in message
...
Is this a feature on Word 2000? It may explain some previously
inexplicable email sending that seems to go on while I'm on line and not
consciously sending anything.

"Terry Farrell" wrote in message
news
Word regularly connects to the Internet to update Help and report
changes you may have added to your Custom.dic (this may influence
whether these get added to the main spelling checker at a later update)
and other service options.

--
Terry Farrell - MS Word MVP

"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the
INTERNET and
that I should deny the permission unless I am sure that the
modification is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known
action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the
computer : no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to access
the NET.

I do not understand why WORD should access the NET. Is there any reason
for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD
have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Jean-Pierre]

I made no change to anything in the recent past.

Why should WORD connect to the site of "VERISIGN" ? There is no reason for it.
The "trojan" assumption of Tom Willet looks therefore more credible.

Jean-Pierre

================================================
"Terry Farrell" wrote in message
news
Word regularly connects to the Internet to update Help and report changes
you may have added to your Custom.dic (this may influence whether these get
added to the main spelling checker at a later update) and other service
options.

--
Terry Farrell - MS Word MVP

"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the INTERNET
and
that I should deny the permission unless I am sure that the modification
is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known
action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer
: no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to access
the NET.

I do not understand why WORD should access the NET. Is there any reason
for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have
to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Jean-Pierre]

The PANDA encyclopedia lists about 100 items (virus, trojan...) of malware using
port 20480. The proposed cure is inviarably "Update your PANDA Anti Virus and
perform a complete scan".

I have PANDA running and automatically updated. I ran a complete scan, with no
result.

I did the same with SPYBOT and Ad-Aware (update + full scan) : no result.

What else can I do ? Will uninstall/reinstall OFFICE help ?
Can I re-use the "Normal.dot" file or could itself contain the infection ?
Could the infection be located in the templates saved with specific documents ?

Jean-Pierre
Belgium

=====================================
"Tom Willett" wrote in message
...
The remote IP address is to VeriSign.
The port is an unassigned port, but I've heard it's often used by trojans.

Tom
"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my
anti-virus
that WORD has been recently modified, that it tries to access the INTERNET
and
that I should deny the permission unless I am sure that the modification
is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known
action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer
: no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and
removed
them.

I re-started WORD and got again the message about WORD trying to access
the NET.

I do not understand why WORD should access the NET. Is there any reason
for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have
to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Jean-Pierre]

After having made several trials, among which uninstall / reinstall OFFICE, I
found a remnant of "MathType". I uninstalled it and, apparently, the tentative
connexion did occur no more.

"MathType" is an equation editor that insist on installing itself on a free-30
days trial basis when one uses the standard equation editor. But I found it
brings little to the standard equation editor, so I did not buy its licence.
Apparently this remnant caused the tentative INTERNET connection. Note that the
tentative NET connexion happened even for "new" documents, having no equations
whatsoever.

Jean-Pierre
Belgium

================================================== ================
"Jean-Pierre" wrote in message
...
Hello,

Since a few days, everytime I start WORD, I get the message from my anti-virus
that WORD has been recently modified, that it tries to access the INTERNET and
that I should deny the permission unless I am sure that the modification is
due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed
them.

I re-started WORD and got again the message about WORD trying to access the
NET.

I do not understand why WORD should access the NET. Is there any reason for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium

[Bob Mathews]

On 21-Feb-2007, Jean-Pierre wrote:

After having made several trials, among which uninstall /
reinstall OFFICE, I found a remnant of "MathType". I
uninstalled
it and, apparently, the tentative connexion did occur no more.

"MathType" is an equation editor that insist on installing
itself on a free-30 days trial basis when one uses the
standard equation editor. But I found it brings little to
the standard equation editor, so I did not buy its licence.
Apparently this remnant caused the tentative INTERNET
connection. Note that the tentative NET connexion
happened even for "new" documents, having no
equations whatsoever.

Jean-Pierre, the IP address you mention is in fact Verisign, as
other people have mentioned in this thread. Office apparently
uses IE's certificate revocation list mechanism for digital
signatures. If the your system is configured to automatically
check the certificate revocation list, it will do so not only for
IE, but also for Office apps as well. Here's a document that
specifies what Office actually does and how it's configured...

http://office.microsoft.com/en-us/or...403081033.aspx

So the bottom line this has nothing to do with MathType.

--
Bob Mathews bobm at dessci.com
Director of Training
http://www.dessci.com/free.asp?free=news
FREE fully-functional 30-day evaluation of MathType 5
Design Science, Inc. -- "How Science Communicates"
MathType, WebEQ, MathPlayer, MathFlow, Equation Editor, TeXaide