Worm Access

[SkrtNHeels]

Each time I use Publisher 2003 to publish my web site, I get a message from
Norton that a worm has been blocked. Each time a different one. Does
Publisher have a particular vulnerability that I am unaware of? Is there
something I should be doing?

Thank you.
Skrt

 

[JoAnn Paules [MSFT MVP]]

Are your virus definitions up-to-date? Are you quarantining your virii, etc?
If so, try getting rid of those issues and see if that makes a difference.

 

[SkrtNHeels]

JoAnn,

Thank you for the reply. Yes, my Norton is absolutely up to day. I've
published 3 times in the past 24-36 hours and I get a popup message from
Norton that it has blocked these worms. Following is the pasted report of
these incidents for your reference:

3/18/2005 1:30:40 PM,Rule "Default Block Shiva Burka Trojan horse" blocked
communication.,"Rule ""Default Block Shiva Burka Trojan horse"" blocked
communication. Local address: All local network adapters(1600). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/18/2005 1:24:22 PM,Rule "Default Block FTP99CMP Trojan horse" blocked
communication.,"Rule ""Default Block FTP99CMP Trojan horse"" blocked
communication. Local address: All local network adapters(1492). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/18/2005 1:14:43 PM,Rule "Default Block Backdoor/SubSeven Trojan horse"
blocked communication.,"Rule ""Default Block Backdoor/SubSeven Trojan
horse"" blocked communication. Local address: All local network
adapters(Backdoor-g-1(1243)). Process name is ""C:\Program Files\Microsoft
Office\OFFICE11\MSPUB.EXE""."
3/18/2005 10:31:25 AM,Rule "Default Block FTP99CMP Trojan horse" blocked
communication.,"Rule ""Default Block FTP99CMP Trojan horse"" blocked
communication. Local address: All local network adapters(1492). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/18/2005 10:22:02 AM,Rule "Default Block Backdoor/SubSeven Trojan horse"
blocked communication.,"Rule ""Default Block Backdoor/SubSeven Trojan
horse"" blocked communication. Local address: All local network
adapters(Backdoor-g-1(1243)). Process name is ""C:\Program Files\Microsoft
Office\OFFICE11\MSPUB.EXE""."
3/18/2005 10:21:26 AM,Rule "Default Block Ultor's Trojan horse" blocked
communication.,"Rule ""Default Block Ultor's Trojan horse"" blocked
communication. Local address: All local network adapters(1234). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/18/2005 4:20:03 AM,Rule "Default Block Shiva Burka Trojan horse" blocked
communication.,"Rule ""Default Block Shiva Burka Trojan horse"" blocked
communication. Local address: All local network adapters(1600). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/18/2005 4:16:02 AM,Rule "Default Block FTP99CMP Trojan horse" blocked
communication.,"Rule ""Default Block FTP99CMP Trojan horse"" blocked
communication. Local address: All local network adapters(1492). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/18/2005 4:04:43 AM,Rule "Default Block Ultor's Trojan horse" blocked
communication.,"Rule ""Default Block Ultor's Trojan horse"" blocked
communication. Local address: All local network adapters(1234). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/17/2005 2:10:36 AM,Rule "Default Block FTP99CMP Trojan horse" blocked
communication.,"Rule ""Default Block FTP99CMP Trojan horse"" blocked
communication. Local address: All local network adapters(1492). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
3/17/2005 2:02:13 AM,Rule "Default Block Backdoor/SubSeven Trojan horse"
blocked communication.,"Rule ""Default Block Backdoor/SubSeven Trojan
horse"" blocked communication. Local address: All local network
adapters(Backdoor-g-1(1243)). Process name is ""C:\Program Files\Microsoft
Office\OFFICE11\MSPUB.EXE""."
3/17/2005 2:01:34 AM,Rule "Default Block Ultor's Trojan horse" blocked
communication.,"Rule ""Default Block Ultor's Trojan horse"" blocked
communication. Local address: All local network adapters(1234). Process name
is ""C:\Program Files\Microsoft Office\OFFICE11\MSPUB.EXE""."
2/16/2005 2:28:03 PM,Rule "Default Block Netspy Trojan horse" blocked
communication.,"Rule ""Default Block Netspy Trojan horse"" blocked

Thanks again for replying. I look forward to hearing from you again soon.

Kathy

 

[Mary Sauer]

Sounds more like firewall messages.

 

[Mary Sauer]

http://tinyurl.com/3j34a

 

[SkrtNHeels]

I understand that Norton is blocking the attempts, what I'm wondering is what
about the publishing process is making the computer vulnerable to those
attempts.