WORD tries to connect to the INTERNET (12.158.80.10)

  • Thread starter Thread starter Jean-Pierre
  • Start date Start date
J

Jean-Pierre

Hello,

Since a few days, everytime I start WORD, I get the message from my anti-virus
that WORD has been recently modified, that it tries to access the INTERNET and
that I should deny the permission unless I am sure that the modification is due
to an update.

The connection details are :
OUTBOUND connection -
Protocol TCP -
Remote IP address :12.158.80.10
Destination port : 20480

The incriminated program is : WINWORD.EXE
Created : Jan 16, 2007 - 10:53:18 PM
Modified : Jan 16, 2007 - 10:53:18 PM
(The creation/modification date & time does not correspond to any known action
of mine !)

I am not aware that I modified / updated WORD.

I updated my Anti-Virus (PANDA) and performed a full scan of the computer : no
"malware" was detected.

I ran SPYBOT (after udating it) : Nothing found.

I ran Ad-Aware (after updating it) : it found 8 tracking cookies and removed
them.

I re-started WORD and got again the message about WORD trying to access the NET.

I do not understand why WORD should access the NET. Is there any reason for it
or any setting requiring it ?
The address (12.158.80.10) seems to be from VERISIGN. Why should WORD have to
connect to the VERISIGN site ?


Operating system is W2K - SP4
OFFICE version is 2002-SP3

Thank you in advance.

Jean-Pierre
Belgium
 
Word regularly connects to the Internet to update Help and report changes
you may have added to your Custom.dic (this may influence whether these get
added to the main spelling checker at a later update) and other service
options.
 
Is this a feature on Word 2000? It may explain some previously inexplicable
email sending that seems to go on while I'm on line and not consciously
sending anything.
 
If my system was sending e-mails without my express permission, I would be
very alarmed! This sounds like virus activity - or you are not explaining
the issue well..

--
<>>< ><<> ><<> <>>< ><<> <>>< <>><<>
Graham Mayor - Word MVP

My web site www.gmayor.com

<>>< ><<> ><<> <>>< ><<> <>>< <>><<>
 
Alan

IIRC, not on Word2000. As Graham says, this sounds badly likely malware.

I recommend SpyBot Search and Destroy for attacking malware as it has been
the most successful utility I have used on my own and friend's computers ate
eradicating tough malware where many other utilities (and quite big vendors)
have failed. It is free to use for personal use but it is imperative to make
sure that you go to the correct site. There are several other sites
pretending to be the home of SpyBot and they end up making you pay for what
is a free utility.

Get it from here: http://www.spybot.info/

Terry Farrell
 
The remote IP address is to VeriSign.
The port is an unassigned port, but I've heard it's often used by trojans.

Tom
 
I had my suspicions, but so far no-one has debited any of my bank accounts
(not that there's much to debit!). Thank you very much for that site. I did
try caVet but have been unhappy and certainly I keep hearing things about
Nortons, so all in all I have been suspicious of the very industry itself.
But I'll try your site right now...
 
I made no change to anything in the recent past.

Why should WORD connect to the site of "VERISIGN" ? There is no reason for it.
The "trojan" assumption of Tom Willet looks therefore more credible.

Jean-Pierre

================================================
 
The PANDA encyclopedia lists about 100 items (virus, trojan...) of malware using
port 20480. The proposed cure is inviarably "Update your PANDA Anti Virus and
perform a complete scan".

I have PANDA running and automatically updated. I ran a complete scan, with no
result.

I did the same with SPYBOT and Ad-Aware (update + full scan) : no result.

What else can I do ? Will uninstall/reinstall OFFICE help ?
Can I re-use the "Normal.dot" file or could itself contain the infection ?
Could the infection be located in the templates saved with specific documents ?

Jean-Pierre
Belgium

=====================================
 
After having made several trials, among which uninstall / reinstall OFFICE, I
found a remnant of "MathType". I uninstalled it and, apparently, the tentative
connexion did occur no more.

"MathType" is an equation editor that insist on installing itself on a free-30
days trial basis when one uses the standard equation editor. But I found it
brings little to the standard equation editor, so I did not buy its licence.
Apparently this remnant caused the tentative INTERNET connection. Note that the
tentative NET connexion happened even for "new" documents, having no equations
whatsoever.

Jean-Pierre
Belgium

==================================================================
 
After having made several trials, among which uninstall /
reinstall OFFICE, I found a remnant of "MathType". I
uninstalled
it and, apparently, the tentative connexion did occur no more.

"MathType" is an equation editor that insist on installing
itself on a free-30 days trial basis when one uses the
standard equation editor. But I found it brings little to
the standard equation editor, so I did not buy its licence.
Apparently this remnant caused the tentative INTERNET
connection. Note that the tentative NET connexion
happened even for "new" documents, having no
equations whatsoever.
Click to expand...

Jean-Pierre, the IP address you mention is in fact Verisign, as
other people have mentioned in this thread. Office apparently
uses IE's certificate revocation list mechanism for digital
signatures. If the your system is configured to automatically
check the certificate revocation list, it will do so not only for
IE, but also for Office apps as well. Here's a document that
specifies what Office actually does and how it's configured...

http://office.microsoft.com/en-us/ork2003/HA011403081033.aspx

So the bottom line this has nothing to do with MathType.

--
Bob Mathews bobm at dessci.com
Director of Training
http://www.dessci.com/free.asp?free=news
FREE fully-functional 30-day evaluation of MathType 5
Design Science, Inc. -- "How Science Communicates"
MathType, WebEQ, MathPlayer, MathFlow, Equation Editor, TeXaide
 
Back
Top