[Jean-Pierre]

Hello,

Since a few days, everytime I start WORD, I get the message from my anti-virus
that WORD has been recently modified, that it tries to access the INTERNET and
that I should deny the permission unless I am sure that the modification is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed
them.

I re-started WORD and got again the message about WORD trying to access the NET.

I do not understand why WORD should access the NET. Is there any reason for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium