W
WCSally
Dear Microsoft Customer Support,
I have recently had to install the trial version of Office 2003 to complete
my Penn Foster Coursework in Office Proficiency. This released a monster on
my system!
Issue number one, I need the software to work for a few weeks (but I am not
online). If it is possible to activate it for the trial period off line,
PLEASE let me know how, I cannot even log into MS support system (because the
PID is not recognized?). Thus this lengthy letter here.
Issue number two, I need to repair my system.
`````````````````````````````````````````````````````````````````````
Monster:
SMB_WinRegFile Trojan with port 0.0.0.0 and a SCSI Miniport are no longer in
Control Set One or Control Set Two in the registry, they are alive and well
in the HKLM_Classes_Root!!
Before Install I had 9 active pipes, now I have 28! I had tons of gibberish
in the SideBySides (Manifests). If it were another program I would delete it.
Here is an example:
HKLM\Software\Microsoft\Active Setup\Installed
Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} = DOTNETFRAMEWORKS ...
Stub Path = C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\mscories.dll,Install
..C is listed as a root ending (HKLM_Root_Classes) for file names on my
machine as is .H.
• Dot Net was the attack point when I went online last autumn with the third
computer to come down with this issue. I received a message from the (white
hat?) hackers that I had Sub Seven, ( I knew it was on the Aptiva - and I
guess these two newer machines too.) with a false security certificate. I
have some fixes or hacks in the registry starting with </ xxx .... this was
disconcerting to me, but I left some of them that were not related to the
original problem (IE4.0 install as a "/s" procedures). I don't clean the
Windows Journal Viewer, because if I did it would corrupt the next big
program I install. You cannot really ever delete it, just disable it.
`````````````````````````````````````````````````````````````````````
I downloaded all (?-if not I’ll get them now) the Patches for office 2003.
They will not take, the error code says: "The expected version of the
product was not found on your system".
Also, I am not online and Office 2003 Trial-ware seems to function only as a
reader, without online connection. I am hoping there is a workaround for
this:
I cannot go online, I am currently job hunting (for months now!! being 58
years young) and only my mother's retirement income is housing me, feeding me
and buying gasoline. I am hoping there is a work around for the need to
activate online. I have 4 text books and 4 exams to do (rather promptly).
• I generally use Star Office if I require this type of functionality
however Medical Billing and Coding work may require that I use Word, in which
case I must resolve this.
SP2 on my third computer did a good job of keeping it at bay, until I
installed Office 2003 and:
office2003-KB905756-FullFile-ENU.exe
office2003-KB913571-FullFile-ENU.exe
office2003-KB914455-FullFile-ENU.exe
office2003-KB917151-FullFile-ENU.exe
office2003-KB917334-FullFile-ENU.exe
office2003-KB918425-FullFile-ENU.exe ...... none of which would take!!!
If I missed an especially important patch, please advise and send me the
link!!
`````````````````````````````````````````````````````````````````````
History:
I have a long history with this issue, it came from my Brother's Estate,
when I received his Aptiva in 1998. It did have PE_? on it, and an f-Prot
disk and an blacked out section of the HD. His version of Office was
registered to someone else, but it may have been his employer's multi-seat
installation. I do not know exactly, I just know that a new hard drive was
the solution the first time. Then I lost the bios. The machine corrupted
the scanner installation, and that has been an ongoing issue too. The Thunker
--16 and 32 bit core libraries are what are corrupted and the Manifest side
by sides. The corrupted help issues are all in binary, and all are converted
to links when they are initially installed.
When finally I could purchase a new machine with XP Pro on it (AMD dual
processors ... could please have a link to the SP1 and SP2 & SP3 for this
machine) -- it "caught" the same issue.
Issue calls itself "oembios.bin" and it creates an H partition, and uses a
lot of text files (WebPublFiles, __Billboard, etc) to transfer all it's
corrupted program driver loads to the installations which follow a wipe and
reload. It disables or hides access to MSIZAP.exe or Zapmis.exe for
PaintShopPro. It uses IE4.0 NT base, and lots of per user items from IE 5.0.
I think it is associated with Groups but do not know how to address that
issue.
I found it on my third machine (an inexpensive Intel for the web) when I
started it up -- Boot-up 1, and must assume it came from the monitor because
that was the only thing from the old system (except a CD with Black Ice
Download and Steve Gibson's Unpnp.exe --but those were post start up –i.e.
Boot 1.)
I also run Font Doctor regularly, which gets all those orphan streaming bit
map fonts.
``````````````````````````````````````````````````````````````````````
I am adept at “cleaning†the registry, or I can put in Control Keys with no
load, no install class, and no start or no start page in them; if this will
help. I do not know if putting (copying) the entry for the issue {SCSI
Miniport, at 0.0.0.0 registry entries} into a control class will make it so
for the machine: ??? Due to the H partition: Which has crippled the AV and
tries to control Black Ice, too.
I could try to export a report on my machine to you, but I would have to be
able to send it to you on the library computers without infecting them.
Actually I have the System Info report and will append it, it is a .txt file,
and should be scanned before opening.
When I return from sending this e-mail I will try the Restore Point I set
before loading Office 2003. I have little hope due to the update in the H
partition which undoubtedly took place, but must complete this course work.
----This re-install of Office was successful, but Office still will not
function.
`````````````````````````````````````````````````````````````````````
ASSIDE:
I have another question. Is there a web page or a mini-application that
folks may access that will correct any bad settings in Word that allow it to
be hacker friendly? ... I know it has many functions that most people never
even dream are there. Also a page for templates known to be bad to use in
Excel: Or a way to scan for these and disable them?
If there were some way for folks to protect themselves from this it would
bode well for Microsoft and for the American Public. Computer repair here
runs from $50 to $200 with no guarantees. And that is the best shop in town
(back logged for 3+ weeks). The South Oregon Coast is a recessed area, (Thank
Mr. Gates for the computers in the libraries!) although the whole nation is
struggling right now. We are coming to depend on them, and they need to be
protected, and fixing the preferences in WORD and then making them
unchangeable without a p/w (incase you have a Trojan or blue pill issue)
would be nice!
`````````````````````````````````````````````````````````````````````````
Thank you for any and all assistance.
Sally Kaiser
(e-mail address removed)
I have recently had to install the trial version of Office 2003 to complete
my Penn Foster Coursework in Office Proficiency. This released a monster on
my system!
Issue number one, I need the software to work for a few weeks (but I am not
online). If it is possible to activate it for the trial period off line,
PLEASE let me know how, I cannot even log into MS support system (because the
PID is not recognized?). Thus this lengthy letter here.
Issue number two, I need to repair my system.
`````````````````````````````````````````````````````````````````````
Monster:
SMB_WinRegFile Trojan with port 0.0.0.0 and a SCSI Miniport are no longer in
Control Set One or Control Set Two in the registry, they are alive and well
in the HKLM_Classes_Root!!
Before Install I had 9 active pipes, now I have 28! I had tons of gibberish
in the SideBySides (Manifests). If it were another program I would delete it.
Here is an example:
HKLM\Software\Microsoft\Active Setup\Installed
Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} = DOTNETFRAMEWORKS ...
Stub Path = C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\mscories.dll,Install
..C is listed as a root ending (HKLM_Root_Classes) for file names on my
machine as is .H.
• Dot Net was the attack point when I went online last autumn with the third
computer to come down with this issue. I received a message from the (white
hat?) hackers that I had Sub Seven, ( I knew it was on the Aptiva - and I
guess these two newer machines too.) with a false security certificate. I
have some fixes or hacks in the registry starting with </ xxx .... this was
disconcerting to me, but I left some of them that were not related to the
original problem (IE4.0 install as a "/s" procedures). I don't clean the
Windows Journal Viewer, because if I did it would corrupt the next big
program I install. You cannot really ever delete it, just disable it.
`````````````````````````````````````````````````````````````````````
I downloaded all (?-if not I’ll get them now) the Patches for office 2003.
They will not take, the error code says: "The expected version of the
product was not found on your system".
Also, I am not online and Office 2003 Trial-ware seems to function only as a
reader, without online connection. I am hoping there is a workaround for
this:
I cannot go online, I am currently job hunting (for months now!! being 58
years young) and only my mother's retirement income is housing me, feeding me
and buying gasoline. I am hoping there is a work around for the need to
activate online. I have 4 text books and 4 exams to do (rather promptly).
• I generally use Star Office if I require this type of functionality
however Medical Billing and Coding work may require that I use Word, in which
case I must resolve this.
SP2 on my third computer did a good job of keeping it at bay, until I
installed Office 2003 and:
office2003-KB905756-FullFile-ENU.exe
office2003-KB913571-FullFile-ENU.exe
office2003-KB914455-FullFile-ENU.exe
office2003-KB917151-FullFile-ENU.exe
office2003-KB917334-FullFile-ENU.exe
office2003-KB918425-FullFile-ENU.exe ...... none of which would take!!!
If I missed an especially important patch, please advise and send me the
link!!
`````````````````````````````````````````````````````````````````````
History:
I have a long history with this issue, it came from my Brother's Estate,
when I received his Aptiva in 1998. It did have PE_? on it, and an f-Prot
disk and an blacked out section of the HD. His version of Office was
registered to someone else, but it may have been his employer's multi-seat
installation. I do not know exactly, I just know that a new hard drive was
the solution the first time. Then I lost the bios. The machine corrupted
the scanner installation, and that has been an ongoing issue too. The Thunker
--16 and 32 bit core libraries are what are corrupted and the Manifest side
by sides. The corrupted help issues are all in binary, and all are converted
to links when they are initially installed.
When finally I could purchase a new machine with XP Pro on it (AMD dual
processors ... could please have a link to the SP1 and SP2 & SP3 for this
machine) -- it "caught" the same issue.
Issue calls itself "oembios.bin" and it creates an H partition, and uses a
lot of text files (WebPublFiles, __Billboard, etc) to transfer all it's
corrupted program driver loads to the installations which follow a wipe and
reload. It disables or hides access to MSIZAP.exe or Zapmis.exe for
PaintShopPro. It uses IE4.0 NT base, and lots of per user items from IE 5.0.
I think it is associated with Groups but do not know how to address that
issue.
I found it on my third machine (an inexpensive Intel for the web) when I
started it up -- Boot-up 1, and must assume it came from the monitor because
that was the only thing from the old system (except a CD with Black Ice
Download and Steve Gibson's Unpnp.exe --but those were post start up –i.e.
Boot 1.)
I also run Font Doctor regularly, which gets all those orphan streaming bit
map fonts.
``````````````````````````````````````````````````````````````````````
I am adept at “cleaning†the registry, or I can put in Control Keys with no
load, no install class, and no start or no start page in them; if this will
help. I do not know if putting (copying) the entry for the issue {SCSI
Miniport, at 0.0.0.0 registry entries} into a control class will make it so
for the machine: ??? Due to the H partition: Which has crippled the AV and
tries to control Black Ice, too.
I could try to export a report on my machine to you, but I would have to be
able to send it to you on the library computers without infecting them.
Actually I have the System Info report and will append it, it is a .txt file,
and should be scanned before opening.
When I return from sending this e-mail I will try the Restore Point I set
before loading Office 2003. I have little hope due to the update in the H
partition which undoubtedly took place, but must complete this course work.
----This re-install of Office was successful, but Office still will not
function.
`````````````````````````````````````````````````````````````````````
ASSIDE:
I have another question. Is there a web page or a mini-application that
folks may access that will correct any bad settings in Word that allow it to
be hacker friendly? ... I know it has many functions that most people never
even dream are there. Also a page for templates known to be bad to use in
Excel: Or a way to scan for these and disable them?
If there were some way for folks to protect themselves from this it would
bode well for Microsoft and for the American Public. Computer repair here
runs from $50 to $200 with no guarantees. And that is the best shop in town
(back logged for 3+ weeks). The South Oregon Coast is a recessed area, (Thank
Mr. Gates for the computers in the libraries!) although the whole nation is
struggling right now. We are coming to depend on them, and they need to be
protected, and fixing the preferences in WORD and then making them
unchangeable without a p/w (incase you have a Trojan or blue pill issue)
would be nice!
`````````````````````````````````````````````````````````````````````````
Thank you for any and all assistance.
Sally Kaiser
(e-mail address removed)
only online