<CT> Re: Warning about abandonware MSoffice 4.3

  • From: "Martin B. Brilliant" <mbrilliant@xxxxxxxxxxxx>
  • To: calmira_tips@xxxxxxxxxxxxx
  • Date: Mon, 16 Sep 2002 08:15:57 -0400

In answer to several questions and comments:

> From: Norm Finch <NormF@xxxxxxxxx>
> Did you have the heuristic component of F-Prot turned on when you
> scanned? ... perhaps you found ... a new virus ...

I think I did, but just to make sure, I repeated the scans with 
heuristics turned on. "No viruses or suspicious files/boot sectors 
were found."

> > When I tried to install it in Windows NT 4.0 I repeatedly got error
> > messages telling about some kind of error in some line number in
> > something.c.
> Just talked with my son ... He says the mistake was trying to
> install an incompatible program under NT 4.0.... Those error
> messages, says he, are from NT 4.0.

I've seen messages from NT, and they don't look like that. Windows NT 
messages tell that there was a particular sort of violation, and 
optionally give a partial hex dump. They don't report an error at a 
line number in a something.c file.

Besides, Windows NT 4 does have a subsystem that's designed to be 
compatible with 16-bit Windows programs. I had just previously 
installed Winword 6.0, from the same abandonware site. Long before 
that, I installed Winword 2.0, which was designed for Windows 386. 
Both those Winword versions still work in my Win NT system.

I'll be the first to admit that a lot of people know more about 
computer systems at the age of 23 than I know at the age of 70. But 
what they do not know is that to solve a problem, they have to take 
account of all the evidence, not just the part that fits in with what 
they just learned.

> That being the case, malware is not the issue at all, but OS/program
> incompatiblity.

In the case of the attempt to install in Win NT 4, yes, but no. The 
evidence of malware is in the result of the attempt to install in WfW 
3.11 (in another primary partition). When that happened, the unusual 
messages from the Win NT installation attempt look suspicious.

> From: GLENNRPH@xxxxxxx

> ... As for repairing the MBR, the only method I have
> used with success is to run FDISK /MBR at a DOS command prompt, not
> in a DOS box in ANY version of Window....

Agreed. That's one of the things I did. But that doesn't correct the 
partition table.

In my case, the only damage to the partition table seemed to be bad 
partition type bytes. That might have been caused by some other 
repair procedure, because malicious software would probably have done 
a lot more damage. I used Norton's Disk Editor (in maintenance mode) 
to correct that. There are web sites that tell you more than you need 
to know about partition tables, but all I needed in this case was the 
fact that HPFS and NTFS have the same type byte.

> ...hmmm...Marty, your download was fully complete, wasn't it? 

Good question. Answer: I don't know directly, but since the download 
was in the form of ZIP files, and an incomplete ZIP file usually 
can't be unzipped, I'd say it was complete.

I have another piece of evidence that I don't know how to interpret. 
When I ran Norton Disk Doctor after the disaster, one of the problems 
it said it found, and offered to correct, was a bad logical-drive 
chain. I didn't let it change that, because I wasn't having any 
trouble accessing my logical drives.

But suppose there was something wrong with the logical-drive chain. 
Something that would not be a problem in ordinary use, but might 
cause trouble in some cases. Possibly when some know-it-all 
programmer, writing an installer, decides that it isn't necessary to 
use documented procedures, because everybody knows that the operating 
system works thus-and-so, and we'll just take this little shortcut. 
My whole problem might not have been a malicious program at all, but 
a disaster waiting to happen in my operating system.

One of my up and coming little projects, along with a lot of more 
urgent things, is to set up a sacrificial computer system and run the 
MS Office 4.3 installer on it, to see whether it trashes computers 
consistently. If anybody else has means, motive, and opportunity to 
do the same, please post the results, as I will when I get around to 
doing it. If it turns out that the problem was in my system, and not 
in the abandonware post, we will all be happier.

Martin B. Brilliant at home in Holmdel, NJ
To unsubscribe, send a message to ecartis@xxxxxxxxxxxxx with
"unsubscribe calmira_tips" in the body.
OR visit http://freelists.org

Other related posts: