Virus or Malware infection .... any idea what?

Barry Watzman · Guest

Last night, I was using my computer just fine when I shut it down & went
to bed.

This morning I turn it on, it boots up normally, and just as it's done
booting it shuts itself down. Not a sudden shutdown, but the instant
it's fully up it behaves exactly as if I had done a "Start / Turn Off
Computer / Shut Down".

No matter what I do, it shuts itself down right after starting up.

Tried safe mode ... it works, but very limited usability (with or
without networking), and attempts to run much of anything fail (the
windows installer is corrupted, so I can't UNinstall anything, virtually
no services have started (or will start). I was able to try system
restore to the previous day (when everything was working fine). That
was my only restore point (there should have been more), and going back
to it did not help or change things in any way.

I believe I had some virus or malware infection, but does anyone have
any idea what? My system is pretty tight (AV software and multiple
anti-spyware, all fully updated) and I wasn't doing anything yesterday,
although a Microsoft Windows Defender update did get installed via
auto-update.

I rolled back to an image update from November (only drive C: seems to
have been effected, and I have ALL of my data on drive E:, I even moved
"My Documents", and I hadn't installed much since November, so this was
fine).

I'm back up and running fine, and both AV and spyware scans are clean.
BUT, I have Outlook on the system, and EVERY time I start it, I get a
text box that says:

"Microsoft Office Word [in border of the message box]"

"This file contains macros with an expired or revoked signature. Since
you are running under high security level, these macros will be disabled."

Is there any way I can find the source/cause of this? Other than
outlook 2003, nothing else is open or running. I don't know if this is
related to what happened or not, but it's sure suspicious.

smackedass · Guest

Barry,

I think I'm going to bring a fresh change of underwear and Rosary beads with
me when I go out on my calls today, if something like this is happening to
YOU, and you can't figure it out...;)

Hmm, what has changed between yesterday and today...are you aware of the new
(there were older varieties) "Storm Worm"? See
http://www.earthtimes.org/articles/show/22142.html and
http://www.symantec.com/enterprise/security_response/weblog/2007/01/trojanpeacomm_building_a_peert.html
for more info. Of course, those inflicted would have to had opened an
executable file that arrived by email...

Obviously, the "macro" message refers to a macro, or the security levels
that are set in one or more of the Office programs, but if you haven't
touched them, that message is a consequence of something else that is wrong,
and I don't know how that would cause your computer to shut off.

Dunno. Dunno. Sorry.

sa

"Barry Watzman" <WatzmanNOSPAM@neo.rr.com> wrote in message
news:45b1ad27$0$7712$4c368faf@roadrunner.com...

Barry Watzman · Guest

Yes, it looks like I had some kind of infection, but I'm really puzzled
as to how I would have gotten it. I'm the only one who uses this PC,
and I understand this stuff, I don't open attachments, and I don't visit
the types of sites that normally spread malware, and my system has what
should be adequate security (both AV and spyware), and I keep it updated
continuously.

Now I'm worried about the macro message ("This file contains macros with
an expired or revoked signature. Since you are running under high
security level, these macros will be disabled.")

PURE SPECULATION: I believe that something in outlook has a malicious
macro in it that may have been the cause of my problem. The macro is
still present, but at the moment isn't being allowed to run, and thus so
far I'm ok. But one little slip, it gets executed and I'm toast
(again). What I need to do is find the macro, but the message only
tells me that it's there, but not where. "This file ...." Come on,
Word, tell me WHAT file!!! I could argue that since the entire C: drive
was wiped out and restored, the offending file would have to be the
outlook .PST file. But the message occurs when I merely open outlook.
Yes, the .PST file is opened, but no message within it is opened.

?????

smackedass wrote: