Office 2003 Trial (activation offline, PLEASE), and Excell Trojan [WiredBox.Net

> Dear Microsoft Customer Support,
>
> I have recently had to install the trial version of Office 2003 to
> complete
> my Penn Foster Coursework in Office Proficiency. This released a monster
> on
> my system!
> Issue number one, I need the software to work for a few weeks (but I am
> not
> online). If it is possible to activate it for the trial period off line,
> PLEASE let me know how, I cannot even log into MS support system (because
> the
> PID is not recognized?). Thus this lengthy letter here.
>
> Issue number two, I need to repair my system.
>
>
> `````````````````````````````````````````````````````````````````````
> Monster:
> SMB_WinRegFile Trojan with port 0.0.0.0 and a SCSI Miniport are no longer
> in
> Control Set One or Control Set Two in the registry, they are alive and
> well
> in the HKLM_Classes_Root!!
>
> Before Install I had 9 active pipes, now I have 28! I had tons of
> gibberish
> in the SideBySides (Manifests). If it were another program I would delete
> it.
>
> Here is an example:
> HKLM\Software\Microsoft\Active Setup\Installed
> Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} = DOTNETFRAMEWORKS ...
> Stub Path = C:\WINDOWS\system32\Rundll32.exe
> C:\WINDOWS\system32\mscories.dll,Install
> .C is listed as a root ending (HKLM_Root_Classes) for file names on my
> machine as is .H.
>
> . Dot Net was the attack point when I went online last autumn with the
> third
> computer to come down with this issue. I received a message from the
> (white
> hat?) hackers that I had Sub Seven, ( I knew it was on the Aptiva - and I
> guess these two newer machines too.) with a false security certificate. I
> have some fixes or hacks in the registry starting with </ xxx .... this
> was
> disconcerting to me, but I left some of them that were not related to the
> original problem (IE4.0 install as a "/s" procedures). I don't clean
> the
> Windows Journal Viewer, because if I did it would corrupt the next big
> program I install. You cannot really ever delete it, just disable it.
>
> `````````````````````````````````````````````````````````````````````
>
> I downloaded all (?-if not I'll get them now) the Patches for office 2003.
> They will not take, the error code says: "The expected version of the
> product was not found on your system".
>
>
> Also, I am not online and Office 2003 Trial-ware seems to function only as
> a
> reader, without online connection. I am hoping there is a workaround for
> this:
>
> I cannot go online, I am currently job hunting (for months now!! being 58
> years young) and only my mother's retirement income is housing me, feeding
> me
> and buying gasoline. I am hoping there is a work around for the need to
> activate online. I have 4 text books and 4 exams to do (rather promptly).
> . I generally use Star Office if I require this type of functionality
> however Medical Billing and Coding work may require that I use Word, in
> which
> case I must resolve this.
>
> SP2 on my third computer did a good job of keeping it at bay, until I
> installed Office 2003 and:
> office2003-KB905756-FullFile-ENU.exe
> office2003-KB913571-FullFile-ENU.exe
> office2003-KB914455-FullFile-ENU.exe
> office2003-KB917151-FullFile-ENU.exe
> office2003-KB917334-FullFile-ENU.exe
> office2003-KB918425-FullFile-ENU.exe ...... none of which would take!!!
>
> If I missed an especially important patch, please advise and send me the
> link!!
>
>
>
>
> `````````````````````````````````````````````````````````````````````
> History:
> I have a long history with this issue, it came from my Brother's Estate,
> when I received his Aptiva in 1998. It did have PE_? on it, and an f-Prot
> disk and an blacked out section of the HD. His version of Office was
> registered to someone else, but it may have been his employer's multi-seat
> installation. I do not know exactly, I just know that a new hard drive
> was
> the solution the first time. Then I lost the bios. The machine corrupted
> the scanner installation, and that has been an ongoing issue too. The
> Thunker
> --16 and 32 bit core libraries are what are corrupted and the Manifest
> side
> by sides. The corrupted help issues are all in binary, and all are
> converted
> to links when they are initially installed.
>
> When finally I could purchase a new machine with XP Pro on it (AMD dual
> processors ... could please have a link to the SP1 and SP2 & SP3 for this
> machine) -- it "caught" the same issue.
> Issue calls itself "oembios.bin" and it creates an H partition, and uses
> a
> lot of text files (WebPublFiles, __Billboard, etc) to transfer all it's
> corrupted program driver loads to the installations which follow a wipe
> and
> reload. It disables or hides access to MSIZAP.exe or Zapmis.exe for
> PaintShopPro. It uses IE4.0 NT base, and lots of per user items from IE
> 5.0.
> I think it is associated with Groups but do not know how to address that
> issue.
>
> I found it on my third machine (an inexpensive Intel for the web) when I
> started it up -- Boot-up 1, and must assume it came from the monitor
> because
> that was the only thing from the old system (except a CD with Black Ice
> Download and Steve Gibson's Unpnp.exe --but those were post start up -i.e.
> Boot 1.)
> I also run Font Doctor regularly, which gets all those orphan streaming
> bit
> map fonts.
> ``````````````````````````````````````````````````````````````````````
>
> I am adept at "cleaning" the registry, or I can put in Control Keys with
> no
> load, no install class, and no start or no start page in them; if this
> will
> help. I do not know if putting (copying) the entry for the issue {SCSI
> Miniport, at 0.0.0.0 registry entries} into a control class will make it
> so
> for the machine: ??? Due to the H partition: Which has crippled the AV
> and
> tries to control Black Ice, too.
>
> I could try to export a report on my machine to you, but I would have to
> be
> able to send it to you on the library computers without infecting them.
> Actually I have the System Info report and will append it, it is a .txt
> file,
> and should be scanned before opening.
>
> When I return from sending this e-mail I will try the Restore Point I set
> before loading Office 2003. I have little hope due to the update in the H
> partition which undoubtedly took place, but must complete this course
> work.
> ----This re-install of Office was successful, but Office still will not
> function.
> `````````````````````````````````````````````````````````````````````
>
> ASSIDE:
> I have another question. Is there a web page or a mini-application that
> folks may access that will correct any bad settings in Word that allow it
> to
> be hacker friendly? ... I know it has many functions that most people
> never
> even dream are there. Also a page for templates known to be bad to use in
> Excel: Or a way to scan for these and disable them?
> If there were some way for folks to protect themselves from this it would
> bode well for Microsoft and for the American Public. Computer repair here
> runs from $50 to $200 with no guarantees. And that is the best shop in
> town
> (back logged for 3+ weeks). The South Oregon Coast is a recessed area,
> (Thank
> Mr. Gates for the computers in the libraries!) although the whole nation
> is
> struggling right now. We are coming to depend on them, and they need to
> be
> protected, and fixing the preferences in WORD and then making them
> unchangeable without a p/w (incase you have a Trojan or blue pill issue)
> would be nice!
> `````````````````````````````````````````````````````````````````````````
>
> Thank you for any and all assistance.
> Sally Kaiser
> west-coast-sally[ at ]hotmail.com
>