winword problems

Viruses and worms
1

Dear Sirs,

I’m not too good in Pcs, my notebook is quite old…anyway I can’t print a word document - just one of mine, for the rest of them everithing works fine - may you please help me?

This is the error message that occured:

========================================
WINWORD ha provocato un errore di pagina non valida nel

modulo WINWORD.EXE in 0167:30161a47.

Registri:

EAX=0069047c CS=0167 EIP=30161a47 EFLGS=00010202

EBX=0072e1d8 SS=016f ESP=0062e168 EBP=0062e4a4

ECX=00000000 DS=016f ESI=0072eea4 FS=41d7

EDX=00725b64 ES=016f EDI=00725b64 GS=0000

Byte all’indirizzo CS:EIP:

8b 09 8b 31 e8 1a 7d 06 00 8b 00 8b 40 5c 3b c6

Immagine dello stack:

0069047c 00000000 0072eea4 30282b00 0062e488 00000000 00000080 0072e1d8 00007fff 00000001 00040022 18800830 02c40000 011b0000 00000000 00000000

=========================================
I also tried to do a scan with hijackthis, that is the result:

==========================================
Logfile of HijackThis v1.99.1
Scan saved at 15.01.27, on 02/03/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.00 (5.00.2919.6304)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAMMI\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAMMI\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAMMI\ALWIL SOFTWARE\AVAST4\SETUP\AVAST.SETUP
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMI\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: @msdxmLC.dll,-1@1040,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM..\Run: [SystemTray] SysTray.Exe
O4 - HKLM..\Run: [IrMon] IrMon.exe
O4 - HKLM..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM..\Run: [internat.exe] internat.exe
O4 - HKLM..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM..\RunServices: [avast!] C:\Programmi\Alwil Software\Avast4\ashServ.exe
O4 - Startup: Avvio Office.lnk = C:\Programmi\Microsoft Office\Office\OSA.EXE
O4 - Startup: Ricerca rapida.lnk = C:\Programmi\Microsoft Office\Office\FINDFAST.EXE
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {B54CEBFE-9BB6-11D5-BA31-204C4F4F5020} (SoleCd.clsSolecd) - file://C:\Programmi\ilSoleCD\Solecd.CAB
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab

Thank you in advance for your time and your help,
Emanuele

2

I’m sorry I can’t see anything obvious for this print problem, but I don’t think it is virus related. I certainly can’t remember anything like a virus stopping printing (unless somehow it infected a file responsible for printing).

All I can suggest is a google search for cant print from winword and see if that returns anything useful. Are you able to print from other programs, such as print an email from your email program, etc. ?

From your HJT log I see you still don’t have a firewall, this is an essential part of your system security.

No active firewall was found on your system or the firewall you use is unknown to us. If you don´t use a firewall you should download and install one

This is an on-line analysis of your log http://hijackthis.de/logfiles/4d648ca4b3711c774b75a50313f78279.html it shows some Possibly nasty entries.
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
Do you know what these two are:
O16 - DPF: {B54CEBFE-9BB6-11D5-BA31-204C4F4F5020} (SoleCd.clsSolecd) - file://C:\Programmi\ilSoleCD\Solecd.CAB
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab

This is non-essential and uses lots of resources and constantly access the HDD.
O4 - Startup: Ricerca rapida.lnk = C:\Programmi\Microsoft Office\Office\FINDFAST.EXE

3

well, I can print from any other program except from those long files in word (162 pp.):
in the meanwhile the pc tries to load the file to print it, then the error message pops up and closes my word document !

Then when I try to open it again the pc says that the file is currently used by another costumer and asks me if i need a copy of it!!!

I’m lost.

4

Well this is consistant with the error you are getting on winword.exe and it shows the printer works outside of winword.exe.

What version of Word are you using ?
Did you get anything back on the google search I suggested ?
Perhaps you may need to do a repair install (over install) of Word ?