"This document could not be registered..." Virus problem?

[loup garou]

Hey guys, I've been scratching my head over this one for the past couple of weeks.

I have several small clients who had XP machines on their networks infected with the Blaster worm (they have individual dial up accounts so they never do windows update, even though I beg them to). Patching and removal was a breeze, no problems whatsoever.

However, several W2k machines were exhibiting strange symptoms at the same time, the most prominent being the error message:
"This document could not be registered. It will not be possible to create links from other documents to this document."
upon opening any Office XP application. They couldn't save anything and application functionality was severely crippled. Also, they could not copy & paste and had issues accessing certain websites.

All machines had the latest virus def's on Norton, no Blaster processes or registry entries, and Symantec's Blaster scan tool came up negative. Strangely enough, updating these machines to SP4 seems to fix the problems. Although they are seemingly OK, I'd like to know what was afflicting their PC's as I cannot find any virii that exhibit these symptoms. I've run Google Group searches and MSKB searches on the OXP error message, but just turn up a bunch of fixes for Word 97 and earlier.

Any ideas or anyone else experiencing similar problems???

 

[LiLithTecH]

The only time I have come accross that error is when
the NORMAL.DOT file gets corrupted (especially true it Word is used as OUTLOOK editor)

Nothing in SP4 would effect that so it just may be a coincidental.

 

[loup garou]

Originally posted by: LiLithTecH
The only time I have come accross that error is when
the NORMAL.DOT file gets corrupted (especially true it Word is used as OUTLOOK editor)

Nothing in SP4 would effect that so it just may be a coincidental.

I have had problems with the normal template getting corrupted as well on other occasions. But, as you said, SP4 shouldn't fix it. And besides, it also happening with Excel and Powerpoint, which have nothing to do with the normal template. SP4 does fix the OXP errors because it re-registers the applications, just as running each app from cmd with /r switch will fix it as well. And not to mention the other problems of cutting and pasting and accessing websites, which are only fixed by installing SP4 (these aren't fixed when reregistering OXP apps). This is really weird...I'm sure it's some sort of registry corruption, but I want to know what's causing it. It can't be a coincidence, because I have multiple unrelated clients experiencing these problems, all with the same setup. Windows 2000, individual dialup accounts on each machine, small network, Ofifce XP.

Oh, I just thought of another symptom. When clicking on Help>About Internet Explorer (IE6), I noticed on one client's machine that there is nothing after version, cipher strength, product ID, etc.

 

[loup garou]

Anyone?

 

[loup garou]

 

[kazeakuma]

If they can't copy and paste and have problems accessing websites it sounds like a worm that I dealt with a little while ago. Lemme see if I can remember what it is....

Err, nope. I seem to think though that it was related to Blaster/Welchia. I'll post again if I can remember what the damn thing was.

 

[loup garou]

Originally posted by: kazeakuma
If they can't copy and paste and have problems accessing websites it sounds like a worm that I dealt with a little while ago. Lemme see if I can remember what it is....

Err, nope. I seem to think though that it was related to Blaster/Welchia. I'll post again if I can remember what the damn thing was.

That's what's strange...other people in their offices had Blaster (XP machines). But on the 2000 machines, scans turned up negative (with latest definitions), Blaster removal tool didn't find anything, NA Stinger didn't find anything, and there are no virus processes or registry entries that I can find.

 

[kazeakuma]

Originally posted by: werk

Originally posted by: kazeakuma
If they can't copy and paste and have problems accessing websites it sounds like a worm that I dealt with a little while ago. Lemme see if I can remember what it is....

Err, nope. I seem to think though that it was related to Blaster/Welchia. I'll post again if I can remember what the damn thing was.

That's what's strange...other people in their offices had Blaster (XP machines). But on the 2000 machines, scans turned up negative (with latest definitions), Blaster removal tool didn't find anything, NA Stinger didn't find anything, and there are no virus processes or registry entries that I can find.

That's true, latest defs should catch all. Although my faith in nearly every virus scanner has been eroded somewhat lately, given how many viruses I have seen get past them :frown:

Is there a dllhost.exe process on these pcs?

 

[loup garou]

Originally posted by: kazeakuma

Originally posted by: werk

Originally posted by: kazeakuma
If they can't copy and paste and have problems accessing websites it sounds like a worm that I dealt with a little while ago. Lemme see if I can remember what it is....

Err, nope. I seem to think though that it was related to Blaster/Welchia. I'll post again if I can remember what the damn thing was.

That's what's strange...other people in their offices had Blaster (XP machines). But on the 2000 machines, scans turned up negative (with latest definitions), Blaster removal tool didn't find anything, NA Stinger didn't find anything, and there are no virus processes or registry entries that I can find.

That's true, latest defs should catch all. Although my faith in nearly every virus scanner has been eroded somewhat lately, given how many viruses I have seen get past them :frown:

Is there a dllhost.exe process on these pcs?

I don't remember...I'll check next time I'm at one of their offices.

 

[kazeakuma]

Originally posted by: werk

Originally posted by: kazeakuma

Originally posted by: werk

Originally posted by: kazeakuma
If they can't copy and paste and have problems accessing websites it sounds like a worm that I dealt with a little while ago. Lemme see if I can remember what it is....

Err, nope. I seem to think though that it was related to Blaster/Welchia. I'll post again if I can remember what the damn thing was.

That's what's strange...other people in their offices had Blaster (XP machines). But on the 2000 machines, scans turned up negative (with latest definitions), Blaster removal tool didn't find anything, NA Stinger didn't find anything, and there are no virus processes or registry entries that I can find.

That's true, latest defs should catch all. Although my faith in nearly every virus scanner has been eroded somewhat lately, given how many viruses I have seen get past them :frown:

Is there a dllhost.exe process on these pcs?

I don't remember...I'll check next time I'm at one of their offices.

Reason why I ask is it's actually a worm but for some reason doesn't always get picked up in a scan. I wish I could remember more because I had EXACTLY the same problem with a few pcs here, but in the mad rush of Blaster patching on some 150pcs I kinda let my memory slip