Normal.dot/global.dot virus problem

[Jeff]

Greetings,

Since finding and removing Sasser & MyDoom I've had major
problems with Word. It has now affected every aspect of XP
Office. Have tried solution offered in KB Article
289506 "How To: Install and Use the Support.dot Template
in MS Word 2002" which turned the problem from just the
normal.dot to global/all Office products. Norton AV sees
nothing during multiple scans, may be macro virus? Error
messages as follows while trying to open a word doc:

Box with Norton Antivirus pops up.

The document C:\...\Application
Data\Microsoft\Templates\Normal.dot is still infected. Do
you want to delete this file? I click NO.

Another box appears saying The document C:\...whatever.doc
is still infected. Do you want to delete this file? I
agaimn click no, the dialogue box says whatever.doc is not
available. I then have a blank non-opened word toolbar
across the top with nothing open or visable beneath.

I then try to close this non-doc and get this:

The Normal.dot already exists. Do you want to replace the
existing file? I click no, and the "Save as" box appears,
I close it with cancel, then again try to close word, and
then get:

Changes have been made that affect the global template,
Normal.dot. Do I want to save these changes? Again, no,
but word closes. The Normal.dot file has changes from 31
KB to 29 KB. Unsure what other files are affected.

Have de-installed/re-installed Office a couple of times,
and have downloaded and installed the SP3, so perhaps this
little macro virus, if it is that, has gone into the
registry. Have looked for what above mentioned article
provided as place to go delete a couple registry lines,
however they are not where the article says they are, if
anywhere.

I'd use Passport, but am laid off and can't afford it at
this point. Can't modify resume, although I sent it to a
friend who scanned it for virus(s) and came up empty.

Please post reply and/or send fix to above mentioned email
address.

Thanks in advance!

JP

 

[Susan Ramlet]

Hi, Jeff,

Try deleting normal.dot. Word will generate a new one, if it's missing.
See if that works.

Otherwise, try contacting Symantec to see if they can help you disinfect
these documents. You might check that you have the latest version of NAV
and its signature files, too.

 

[Jeff]

Hi Susan,

Thanks for the tip, tried it, MS Word recreated
Normal.dot as you said, but said it was still infected, as
the .doc I was trying to edit, which again, could not be
found. Very strange goings on on the Office suite.

Can't afford Symantec's charges (didn't I pay enough for
the SW in the first place?) for disinfecting files, and
have auto-update on so I always have a fresh virus file.

Have had to up XP Pro firewall as well as install Norton
firewall as lots of UDP attacks from other systems are
currently being blocked. Perhaps that's how the macro(?)
got in originally?

Will try to contact Symantec, but unless I can pay, I
can't use any office product If they provide a fix,
I'll post it for future use should anyone else encounter
this problem.

Thank you for trying!

JP

 

[Jeff]

Hey, without costing me a new penny, Symantec has
a "Knowledge Base", which suggests the following, which
seems to have solved this annoying problem:

Situation:
When you launch Word, Norton AntiVirus (NAV) displays the
message "The document C:\Documents and
Settings\Administrator\Application
Data\Microsoft\Templates\Normal.dot is still infected. Do
you want to delete this file?" If you click yes, then you
see a message box "Word cannot open the
existing..."<displays a square icon>."

You may also see the error message "NAVW32.exe application
error:"

Solution:
How you respond to this message depends on whether you ran
a virus scan with the latest definitions. If you did not
run a virus scan, then follow the instructions in the
document Scanning your computer for viruses using Norton
AntiVirus.

If Norton AntiVirus (NAV) does not detect an infection,
then determine whether Simply Transparent, TweakUI, Net
Object Fusion, or Pop-Up Stopper, is installed. If any
these programs are installed, then they may cause a
conflict with the NAV Office plug-in. To fix the problem,
either uninstall the program or disable the NAV Office
plug-in.

To disable the plug-in for Office 2000 or Office XP:

Start NAV. If NAV is installed as a part of Norton
SystemWorks (NSW) or Norton Internet Security (NIS), then
start NSW or NIS, and then select Norton AntiVirus.
Click Options, and then click Miscellaneous.
In the How to keep Microsoft Office documents protected
section, uncheck Enable Office plug-in.
Click OK, and then exit NAV.

NOTE: If you disable the NAV plug-in, then your computer
will still be protected. NAV Auto-Protect will still
provide protection by scanning any file that is launched,
downloaded, opened, created, or deleted.

If NAV does not detect an infection, and if you do not
have Simply Transparent, TweakUI, Net Object Fusion, or
Pop-Up Stopper installed, and if you continue to see the
message that Normal.dot or Excel.xls is infected, then
delete the template file.

Normal.dot and Excel.xls are the default templates for
Microsoft Word and Excel, respectively. These files may be
corrupted and cause this message. Delete the template
files. The next time that you open the applications, new
template files will be created.

CAUTION: If you are using a modified default template,
then this process will remove the modified template.
Instead of following these steps, you will need to restore
the file (either Normal.dot or Excel.xls) from a clean
backup.

Depending on which template file was referred to, close
Microsoft Word or Excel. (For example: If Normal.dot was
referred to, then close Microsoft Word. If the message
indicated Excel.xls, then close Microsoft Excel.)
Search for and delete the file referred to in the message
and then reopen the Microsoft Office application. Follow
the steps that apply to your version of Windows:
For Windows 95/98/NT/2000
Click Start, point to Find or Search, and then click Files
or Folders.
Make sure that "Look in" is set to (C and that Include
subfolders is checked.
In the "Named" or "Search for..." box, type--or copy and
paste--the following file names:

<file name>

NOTE: <file name> is the file that the message refers to
(For example: Normal.dot or Excel.xls.)

Click Find Now or Search Now.
Click the file that is displayed, and then press Delete.
Click Yes to the next prompt.
Reopen the Microsoft Office Application
For Windows XP
Click Start.
Click Search.
Make sure that "Look in" is set to "All drives" or to
(C.
Make sure that "Search subfolders" is checked. (You may
have to click the "Advanced Options" arrow to display
this.)
Click All files and folders.
In the "All or part of the file name box" type--or copy
and paste--the following:

<file name>

NOTE: <file name> is the file that the message refers to
(For example: Normal.dot or Excel.xls.)

Click Search.
Click the file that is displayed, and then press Delete.
Click Yes to the next prompt.
Reopen the Microsoft Office Application

 

[Susan Ramlet]

Fantastic. Glad you got it worked out, and thanks for posting back with the
solution.

--
Susan Ramlet
MVP - Microsoft Office
----------------------------------------------
Please post replies to the newsgroup where all may benefit.

Hey, without costing me a new penny, Symantec has
a "Knowledge Base", which suggests the following, which
seems to have solved this annoying problem:

<snip>