Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

MSPublisher damaged during Trojan Attack


  • Please log in to reply
6 replies to this topic

#1 JerryAttrick

JerryAttrick

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:46 PM

Posted 30 September 2012 - 03:38 PM

We recently had a trojan attack while my daughter was running MSPublisher to collate images for her homework. The trojan and virus has been cleared, thanks to great help on another forum. But MSPublisher still won't work.

It knew that it had been shut down incorrectly (we had to turn the machine off at the wall), so it offered to try to recover the file my daughter was working on. But the recovery failed with a message that MSIEXEC could not start.

It also claims Windows is low on memory - it isn't

I tried MSPublisher again and got an error message about failing to start correctly last time. It asked to start in Safe mode.
I said Yes to start in Safe mode but it claimed Windows is low in memory again.

I cannot repair the installation from Add/Remove Programs.

I cannot remove the installation from Add/Remove Programs, or even through the original CD disks.

Other MSOffice programs work, but I think that the installation was broken by the the Trojan attack.

Should we remove manually and reinstall MSOffice from scratch? http://support.microsoft.com/kb/290301 describes how to remove MSOffice completely by hand. Do we do that?

Help!

BC AdBot (Login to Remove)

 


#2 lti

lti

  • Members
  • 581 posts
  • OFFLINE
  •  
  • Local time:03:46 PM

Posted 30 September 2012 - 09:15 PM

You can remove and reinstall Office or repair the current installation. When you insert the original Office setup CD, the setup program will give you a "Repair" option. It will search for corrupt files and replace any that it finds.

#3 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:04:46 PM

Posted 30 September 2012 - 11:17 PM

I cannot repair the installation from Add/Remove Programs.

I cannot remove the installation from Add/Remove Programs, or even through the original CD disks.

http://support.microsoft.com/kb/290301 describes how to remove MSOffice 2010 completely by hand. Do we do that?


If you check this link http://support.microsoft.com/kb/290301 there is a fixit available to remove MS OFFICE which is better than manual removal

http://go.microsoft.com/?linkid=9737366

good luck

Edited by narenxp, 30 September 2012 - 11:17 PM.


#4 JerryAttrick

JerryAttrick
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:46 PM

Posted 01 October 2012 - 12:33 PM

I managed to completely remove MSOffice, and reinstall it from the DVD. It still goes wrong. See first post for symptoms.

Are there any registry settings to poke to tell it to forget its unsuccessful shutdown?
Could the MSIEXEC program be corrupt?
Should I try the next option?

I wonder if it is something that is in Windows itself that has been corrupted. Should I try to patch Windows?

My daughter's homework awaits!

#5 JerryAttrick

JerryAttrick
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:46 PM

Posted 01 October 2012 - 12:47 PM

I think I've got it...

MSPublisher is interfering with Comodo Defence+ (or vice versa). Turning it off completely allows me to use MSPublisher. This is new and potentially undesired behaviour.

I have managed a full install, and even a repair.

It might be that Comodo has been damaged in the attack and not MSPublisher. I will uninstall Comodo Firewall/Defence+ and reinstall the latest version.

#6 JerryAttrick

JerryAttrick
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:09:46 PM

Posted 01 October 2012 - 02:48 PM

Solved it!

I fixed the Comodo installation (it knew there was a problem) and it's all OK now.

Lesson learnt...

The answer might not be where you think it is!

#7 narenxp

narenxp

  • BC Advisor
  • 16,371 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:India
  • Local time:04:46 PM

Posted 01 October 2012 - 09:59 PM

Thankyou for letting us know.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users