Word: changes instances of the word 'the' to....

I have a machine that appears to have a trojan or macro virus, it changes all instances of the word 'the' when typed in Word 2003 to the word 'balls'. I have followed all the recommended steps and have attached logs.......

 

Re: Word: HiJackThis log....

Here is the HijackThis log....

 

Re: System Specs

Dell Dimension - celeron 2.6 ghz, 1.25 Gb ram, 20Gb HDD, Windows XP professional, Office 2003, running Spybot S&D, Symantec Corporate Edition Antivirus 10.1, Ad-aware SE personal (free), Outlook, Windows Server 2003 network,

 

Re: Correct HJT log plus GetRunKeys log attached,

Correct HJT log plus GetRunKeys log attached, my apologies!!

 

Lets try the easy solution first

In Word goto Tools --> AutoCorrect Options

Untick Replace text as you type

CLick OK

Does that make a difference ?

 

Re: Yes, it makes a difference

Yes, deselecting "Replace text as you type" made a difference. Now to make sure this is not passed on to other computers or doesn't spring anymore surprises locally. This is the main office computer and is used to send tons of email. This computer has had trojan.lodear and trojan.vundo in recent history, I used the cleaner tools from Symantec for these, but i'm wondering if this could be a 'gift' from one of them....

I also found this Word related item in the event viewer:


Event Type: Warning
Event Source: MsiInstaller
Event Category: None
Event ID: 1004
Date: 10/23/2006
Time: 2:54:01 PM
User: SOPHIA\techie
Computer: ELLISON
Description:
Detection of product '{90120409-6000-11D3-8CFE-0150048383C9}', feature 'WordUserData', component '{8ADD2C93-C8B7-11D1-9C67-0000F81F1B38}' failed. The resource 'HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\UserData' does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

I don't know that vundo or any other trojans really do this sort of thing, It is possible but I htink its more likely a practical joke by a co worker or a practical joke software. I didn't actually look at your logs yet but I will do in a minute and let you know if they are clean.

If you go back to the dialog for auto correct and look through the list you will probably find the entry for the/balls just re3move this entry and you can reenable auto correct.

 

Thank you so much for your help!! I did go through the autocorrect list and there was no entry for the/balls, none for 'the' at all. I don't think any of the users here are sophisticated enough to pull this prank anyway, more likely joke software.

 

Your logs look clean!


Have a read of this thread
How to Protect yourself from malware!

Theres a lot of useful info in there for you!