" THIS DOCUMENT WAS HACKED"

[Riqui]

Please help me a friend of mine told me today about a message than appears in a word document created 10/31/2006 in his computer with  word office 2003,windows XP; the message was  " THIS DOCUMENT WAS HACKED, The antivirus used in the PC is Mcafee,

[Lisandro]

Riqui, it won't help if you post twice... you'll just double the effort to help.
Why don't you stay in the first opened thread about this?

[Riqui]

I'm sorry, whilst I do have MS Office it is 97, so I have no idea what might or might not be possible in word 2003.

Not is is apparent what has happened, e.g. what is responsible for the message, McAfee or word, but one thing for sure you should create a new Topic for this so this Topic doesn't get complicated with multiple problems.

But I suggest they use that message as a start point for a google search http://www.google.com/search?q=%22THIS+DOCUMENT+WAS+HACKED%22&btnG=Search

Sorry, but this was my reason

[DavidR]

I do think it better for an unrelated question to your original topic.

As I said use that as a start point, to promote the idea of a google search, on what is happening.

Getting creative with the search string order, wording, or simple explanation of what is happening, changes the results, as this one does, http://www.google.com/search?q=virus+hacked+%22Word+2003+documents%22. However as I said it would be better to take this to a new topic.

This one from the above search, http://www.microsoft.com/technet/prodtechnol/office/office2003/operate/o3secdet.mspx is Microsoft Office 2003 Editions Security Whitepaper

[Riqui]

As I said use that as a start point, to promote the idea of a google search, on what is happening.

Getting creative with the search string order, wording, or simple explanation of what is happening, changes the results, as this one does,

Thanks DavidR , You know before I decide to ask for help to the Team that was my first step search in Google and like Tech nothing happen.

Riqui

[DavidR]

I think more information is needed, what did they do in creating the document, use a .dot template, etc. ?

Does this happen in all newly created documents ?
Where is this message displayed ?
Are there any macros in the normal.dot default template ?

I'm showing how old my word version is (office 97) is as I don't even know if the word template files are called .dot any more. For this to be displayed in a document, I would assume it has to be a macro in the default document doing it.

[Riqui]

Next Monday I send you a copy of the document, Thanks

[DavidR]

Next Monday I send you a copy of the document, Thanks

Since I don't work for Alwil, but am an avast user like yourself, so I doubt you will be sending it to me.

[Riqui]

I think more information is needed, what did they do in creating the document, use a .dot template, etc. ?Yes was used a template

Does this happen in all newly created documents ? No only with the created 10/31/006
Where is this message displayed ? On top
Are there any macros in the normal.dot default template ?No there are not

The author indicated in Properties of the document is not my friend, is Alessio Urso but he is not the hacker.

October 31, 2006

…………….
…………….
…………….

THIS DOCUMENT WAS HACKED !!!

Gentlemen:

We are pleased to enclose check number…. from  ………BANK on the amount of $........ for the following invoices:
………
………
………
………
………….  freight expenses according to e-mail dated 10-13-06


Thanks,

…………..S. A.




……………..
…………….

[DavidR]

If correct and this was a document created from the normal.dot template, but the TEXT wasn't there on initial creation (when the new document was displayed), but some time after when they next checked it. Then I don't think word is infected but you/them may have had a virus that can modify documents, which in itself I don't think is too difficult.

However, why they would do it is the question, why change the author further drawing attention, which isn't your usual virus/trojan behaviour. Unless this was accompanied with some sort of warning/threat to do this to all documents, or suggest some anti-spyware program that could prevent this.

If this were more widespread I would think it was a concerted attack but just one document is weird.
If the document was created on the given date, did the properties show when it was last modified, this could indicate when any un/authorised access to the document took place. The other thing to consider is he the only one to have access to the document/folder or are documents shared, etc.

I would ensure your friend has a good firewall to prevent any unauthorised outbound access to the internet, because if it were and attack, why stop at Branding the Page when you can export potentially valuable data.

I'm sorry there isn't anything else I can suggest.

[Riqui]

No DavidR isn't anything else You can suggest, my friend is already in alert to prevent any unauthorized outbound access to the internet.


Thanks

[DavidR]

Your welcome.