Outlook Word editor connects to suspicious site

  • Thread starter Thread starter Kirk
  • Start date Start date
K

Kirk

I'm a little suspicious that I may have an unknown virus or spyware.

I have Outlook XP and Word is configured as my editor for writing
messages. When I reply or write a new message, my firewall (I'm using
Sygate) warns me that winword.exe is trying to access 65.45.13.188
(www.imandd.com). So I told it No, and didn't let it go out. But
then Outlook will lock and I'll have to kill the process, including
the winword process. Outlook doesn't do it when I turn the word
editor off.

I figured I'd see what "imandd.com" is. I went there is it looks like
a bogus site of a company where you can't click on anything. I did a
whois search and also a google search. The whois came up with a fake
address and the google search came up with references to some motley
crue stuff. Do a search and you'll see.

Is this site just a pawn for some keylogger or spyware??? I don't
know.

This is a red flag!!! If winword connected to microsoft, it'd be
another story.

I have Spybot Search & Destroy, Adaware, and Norton AV all up to date
and scan my system often however they don't detect anything.

So I was just wondering if anyone would know why Outlook would try and
connect to this place via Word. If I run Word by itself, it doesn't
do this.

I have a feeling my system has some kind of virus or spyware that's
not detected. I tried to fish through the registry, yeah right.
Since I can't seem to find or scrub this, I'm about to wipe it and
reload everything (Ugh).

Anyone come across this?
Thanks,
Kirk
 
I gave it a shot. renamed it, deleted it, etc. Still tries to
connect to that same ip address.


Diane Poremsky said:
find and rename the normal.dot and see if it still happens.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)





Kirk said:
I'm a little suspicious that I may have an unknown virus or spyware.

I have Outlook XP and Word is configured as my editor for writing
messages. When I reply or write a new message, my firewall (I'm using
Sygate) warns me that winword.exe is trying to access 65.45.13.188
(www.imandd.com). So I told it No, and didn't let it go out. But
then Outlook will lock and I'll have to kill the process, including
the winword process. Outlook doesn't do it when I turn the word
editor off.

I figured I'd see what "imandd.com" is. I went there is it looks like
a bogus site of a company where you can't click on anything. I did a
whois search and also a google search. The whois came up with a fake
address and the google search came up with references to some motley
crue stuff. Do a search and you'll see.

Is this site just a pawn for some keylogger or spyware??? I don't
know.

This is a red flag!!! If winword connected to microsoft, it'd be
another story.

I have Spybot Search & Destroy, Adaware, and Norton AV all up to date
and scan my system often however they don't detect anything.

So I was just wondering if anyone would know why Outlook would try and
connect to this place via Word. If I run Word by itself, it doesn't
do this.

I have a feeling my system has some kind of virus or spyware that's
not detected. I tried to fish through the registry, yeah right.
Since I can't seem to find or scrub this, I'm about to wipe it and
reload everything (Ugh).

Anyone come across this?
Thanks,
Kirk
Click to expand...
Click to expand...
 
Do you get this when launching Word on it's own, or is this just
Outlook-with-Word-as-Editor problem?

Suggest you seek assistance from the Word experts in
microsoft.public.word.docmanagement and/or microsoft.public.outlook as
they may know the place where this could be "configured".

Hope this is useful to you. Let us know.

rms


I gave it a shot. renamed it, deleted it, etc. Still tries to
connect to that same ip address.


Diane Poremsky said:
find and rename the normal.dot and see if it still happens.

--
Diane Poremsky [MVP - Outlook]
Author, Teach Yourself Outlook 2003 in 24 Hours
Coauthor, OneNote 2003 for Windows (Visual QuickStart Guide)





I'm a little suspicious that I may have an unknown virus or spyware.

I have Outlook XP and Word is configured as my editor for writing
messages. When I reply or write a new message, my firewall (I'm using
Sygate) warns me that winword.exe is trying to access 65.45.13.188
(www.imandd.com). So I told it No, and didn't let it go out. But
then Outlook will lock and I'll have to kill the process, including
the winword process. Outlook doesn't do it when I turn the word
editor off.

I figured I'd see what "imandd.com" is. I went there is it looks like
a bogus site of a company where you can't click on anything. I did a
whois search and also a google search. The whois came up with a fake
address and the google search came up with references to some motley
crue stuff. Do a search and you'll see.

Is this site just a pawn for some keylogger or spyware??? I don't
know.

This is a red flag!!! If winword connected to microsoft, it'd be
another story.

I have Spybot Search & Destroy, Adaware, and Norton AV all up to date
and scan my system often however they don't detect anything.

So I was just wondering if anyone would know why Outlook would try and
connect to this place via Word. If I run Word by itself, it doesn't
do this.

I have a feeling my system has some kind of virus or spyware that's
not detected. I tried to fish through the registry, yeah right.
Since I can't seem to find or scrub this, I'm about to wipe it and
reload everything (Ugh).

Anyone come across this?
Thanks,
Kirk
Click to expand...
Click to expand...
Click to expand...
 
Back
Top