Home |
Search |
Today's Posts |
#1
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
Hello,
Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#2
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
Word regularly connects to the Internet to update Help and report changes
you may have added to your Custom.dic (this may influence whether these get added to the main spelling checker at a later update) and other service options. -- Terry Farrell - MS Word MVP "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#3
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
Is this a feature on Word 2000? It may explain some previously inexplicable
email sending that seems to go on while I'm on line and not consciously sending anything. "Terry Farrell" wrote in message news Word regularly connects to the Internet to update Help and report changes you may have added to your Custom.dic (this may influence whether these get added to the main spelling checker at a later update) and other service options. -- Terry Farrell - MS Word MVP "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#4
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
If my system was sending e-mails without my express permission, I would be
very alarmed! This sounds like virus activity - or you are not explaining the issue well.. -- Graham Mayor - Word MVP My web site www.gmayor.com Word MVP web site http://word.mvps.org Aalaan wrote: Is this a feature on Word 2000? It may explain some previously inexplicable email sending that seems to go on while I'm on line and not consciously sending anything. "Terry Farrell" wrote in message news Word regularly connects to the Internet to update Help and report changes you may have added to your Custom.dic (this may influence whether these get added to the main spelling checker at a later update) and other service options. -- Terry Farrell - MS Word MVP "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#5
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
Alan
IIRC, not on Word2000. As Graham says, this sounds badly likely malware. I recommend SpyBot Search and Destroy for attacking malware as it has been the most successful utility I have used on my own and friend's computers ate eradicating tough malware where many other utilities (and quite big vendors) have failed. It is free to use for personal use but it is imperative to make sure that you go to the correct site. There are several other sites pretending to be the home of SpyBot and they end up making you pay for what is a free utility. Get it from he http://www.spybot.info/ Terry Farrell "Aalaan" wrote in message ... Is this a feature on Word 2000? It may explain some previously inexplicable email sending that seems to go on while I'm on line and not consciously sending anything. "Terry Farrell" wrote in message news Word regularly connects to the Internet to update Help and report changes you may have added to your Custom.dic (this may influence whether these get added to the main spelling checker at a later update) and other service options. -- Terry Farrell - MS Word MVP "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#6
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
The remote IP address is to VeriSign.
The port is an unassigned port, but I've heard it's often used by trojans. Tom "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#7
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
I had my suspicions, but so far no-one has debited any of my bank accounts
(not that there's much to debit!). Thank you very much for that site. I did try caVet but have been unhappy and certainly I keep hearing things about Nortons, so all in all I have been suspicious of the very industry itself. But I'll try your site right now... "Terry Farrell" wrote in message ... Alan IIRC, not on Word2000. As Graham says, this sounds badly likely malware. I recommend SpyBot Search and Destroy for attacking malware as it has been the most successful utility I have used on my own and friend's computers ate eradicating tough malware where many other utilities (and quite big vendors) have failed. It is free to use for personal use but it is imperative to make sure that you go to the correct site. There are several other sites pretending to be the home of SpyBot and they end up making you pay for what is a free utility. Get it from he http://www.spybot.info/ Terry Farrell "Aalaan" wrote in message ... Is this a feature on Word 2000? It may explain some previously inexplicable email sending that seems to go on while I'm on line and not consciously sending anything. "Terry Farrell" wrote in message news Word regularly connects to the Internet to update Help and report changes you may have added to your Custom.dic (this may influence whether these get added to the main spelling checker at a later update) and other service options. -- Terry Farrell - MS Word MVP "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#8
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
I made no change to anything in the recent past.
Why should WORD connect to the site of "VERISIGN" ? There is no reason for it. The "trojan" assumption of Tom Willet looks therefore more credible. Jean-Pierre ================================================ "Terry Farrell" wrote in message news Word regularly connects to the Internet to update Help and report changes you may have added to your Custom.dic (this may influence whether these get added to the main spelling checker at a later update) and other service options. -- Terry Farrell - MS Word MVP "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#9
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
The PANDA encyclopedia lists about 100 items (virus, trojan...) of malware using
port 20480. The proposed cure is inviarably "Update your PANDA Anti Virus and perform a complete scan". I have PANDA running and automatically updated. I ran a complete scan, with no result. I did the same with SPYBOT and Ad-Aware (update + full scan) : no result. What else can I do ? Will uninstall/reinstall OFFICE help ? Can I re-use the "Normal.dot" file or could itself contain the infection ? Could the infection be located in the templates saved with specific documents ? Jean-Pierre Belgium ===================================== "Tom Willett" wrote in message ... The remote IP address is to VeriSign. The port is an unassigned port, but I've heard it's often used by trojans. Tom "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#10
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
After having made several trials, among which uninstall / reinstall OFFICE, I
found a remnant of "MathType". I uninstalled it and, apparently, the tentative connexion did occur no more. "MathType" is an equation editor that insist on installing itself on a free-30 days trial basis when one uses the standard equation editor. But I found it brings little to the standard equation editor, so I did not buy its licence. Apparently this remnant caused the tentative INTERNET connection. Note that the tentative NET connexion happened even for "new" documents, having no equations whatsoever. Jean-Pierre Belgium ================================================== ================ "Jean-Pierre" wrote in message ... Hello, Since a few days, everytime I start WORD, I get the message from my anti-virus that WORD has been recently modified, that it tries to access the INTERNET and that I should deny the permission unless I am sure that the modification is due to an update. The connection details are : OUTBOUND connection - Protocol TCP - Remote IP address :12.158.80.10 Destination port : 20480 The incriminated program is : WINWORD.EXE Created : Jan 16, 2007 - 10:53:18 PM Modified : Jan 16, 2007 - 10:53:18 PM (The creation/modification date & time does not correspond to any known action of mine !) I am not aware that I modified / updated WORD. I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no "malware" was detected. I ran SPYBOT (after udating it) : Nothing found. I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed them. I re-started WORD and got again the message about WORD trying to access the NET. I do not understand why WORD should access the NET. Is there any reason for it or any setting requiring it ? The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to connect to the VERISIGN site ? Operating system is W2K - SP4 OFFICE version is 2002-SP3 Thank you in advance. Jean-Pierre Belgium |
#11
Posted to microsoft.public.word.newusers
|
|||
|
|||
WORD tries to connect to the INTERNET (12.158.80.10)
On 21-Feb-2007, Jean-Pierre wrote:
After having made several trials, among which uninstall / reinstall OFFICE, I found a remnant of "MathType". I uninstalled it and, apparently, the tentative connexion did occur no more. "MathType" is an equation editor that insist on installing itself on a free-30 days trial basis when one uses the standard equation editor. But I found it brings little to the standard equation editor, so I did not buy its licence. Apparently this remnant caused the tentative INTERNET connection. Note that the tentative NET connexion happened even for "new" documents, having no equations whatsoever. Jean-Pierre, the IP address you mention is in fact Verisign, as other people have mentioned in this thread. Office apparently uses IE's certificate revocation list mechanism for digital signatures. If the your system is configured to automatically check the certificate revocation list, it will do so not only for IE, but also for Office apps as well. Here's a document that specifies what Office actually does and how it's configured... http://office.microsoft.com/en-us/or...403081033.aspx So the bottom line this has nothing to do with MathType. -- Bob Mathews bobm at dessci.com Director of Training http://www.dessci.com/free.asp?free=news FREE fully-functional 30-day evaluation of MathType 5 Design Science, Inc. -- "How Science Communicates" MathType, WebEQ, MathPlayer, MathFlow, Equation Editor, TeXaide |
Reply |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Forum | |||
Why does Word try to connect to the internet? | Microsoft Word Help | |||
"Word" will not connect to internet to Activate. | New Users | |||
In Word,can't connect hyperlinks to internet server. Why is this? | Microsoft Word Help | |||
why wont my product connect to the internet? | New Users | |||
I need to connect one word doc to another, how? | Microsoft Word Help |