Kaspersky Reports Trojan (Zbot); Word, Other Progs Won't Run

[ppayzant]

Yes, I tried Kazaa some years ago. When I saw the awful stuff available for download, I quickly uninstalled - not completely, I guess!

I got the Canon software working again, and IE7 from yesterday, but Word will not stick. I'm installing from MS Office '97 Pro. All the other Office programs work, but Word just shows the hourglass for a second and then nothing. It worked right after a reinstall, but then back to the non-working after I rebooted.

I know this is a malware forum, so do you think I might still have malware? If not, any suggestions to get Word working?

Thanks,
Phil

[sUBs]

The kazaa entry is not threatenting. Every program even after uninstallation leaves traces of itself on the machine. If you would like to get rid of it, please do this ...


Open NOTEPAD.exe and copy/paste the text in the codebox below:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_USERS\S-1-5-21-73586283-776561741-725345543-1004\software\kazaa]

Save this as fix.reg Choose to "Save type as - All Files"
It should look like this:
Double click on fix.reg & allow it to merge into the registry


----------

I'm installing from MS Office '97 Pro. All the other Office programs work, but Word just shows the hourglass for a second and then nothing. It worked right after a reinstall, but then back to the non-working after I rebooted.

Word 97 is a bit old. I wonder if any of the recent Windows security updates may have broken it. Have you tried Office Updates yet?

[ppayzant]

The MS Office Update website says "Note that the Office Update site does not check for Office 97 updates." So, if is broken by a security update (which would explain it suddenly stopping, I guess) I'll need to look for an alternative to Word '97, yes?

Two new things:

1) During a reboot last evening, while attempting to get Word reinstalled, I got a message "Generic Host Process for Win32 Services has encountered a problem and needs to close". This was before the desktop appeared. It didn't happen on subsequent reboots.

2) I got a new threat notification from a-squared this morning: "C:\Program Files\Microsoft Games\Age of Empires II\UNINSTAL.EXE detected: Email-Worm.Win32.Luder.e!A2" but I suspect it is a false positive, from a Google search.

Phil

[sUBs]

So, if is broken by a security update (which would explain it suddenly stopping, I guess) I'll need to look for an alternative to Word '97, yes?

We're speculating. That may not be the reason.
One good way to find out is to give this a trial > http://us1.trymicrosoftoffice.com/default.aspx

I got a message "Generic Host Process for Win32 Services has encountered a problem and needs to close".

Let me know if it happens again

I suspect it is a false positive

Put the file to the test > http://virusscan.jotti.org/

[ppayzant]

Office 2007 installed fine, Word runs fine. So, does this confirm the suspicion that a recent security update broke my old '97 Word?

The threat reported by a-squared was a false positive - thanks for that very useful link!

Everything seems to be running fine at the moment. Any other suggestions?

[sUBs]

Office 2007 installed fine, Word runs fine. So, does this confirm the suspicion that a recent security update broke my old '97 Word?

Depends on what you plan to do about it. It's still not conclusively proven to be a issue with updates. To complain to MS & persuade them to release a fix, you shall need to show that it's conclusively related. This involves re-installing Office 97 & uninstalling each of the recent Updates till you identify the correct one. All of which may be a fruitless exercise as MS may not be providing support to outdated products.

On the other hand, if you're planning to upgrade now seems a good enough time to truly assess the trial copy of Office 2007


-----------


Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

1. Uninstall ComboFix ... do not skip this step
   This process will perform some post cleanup measures.
   Do this by going to to Start > Run & typing in ComboFix /u
   
   
2. ANTIVIRUS SOFTWARE
   It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   
   
3. Microsoft Windows Update ? http://www.windowsupdate.com
   Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
   
   
4. SPYWAREBLASTER
   SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.
   
   Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here ? http://www.bleepingcomputer.com/forums/tutorial49.html

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

• http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Kindly respond to this thread once more so we can mark this thread as resolved.

[ppayzant]

Thanks for all the practical and useful help. I'll certainly employ the preventive measures you suggest. Please mark the thread resolved.

Thanks again,
Phil