IP blocked with winword.exe

[cammac725]

Hi

 

I'm getting an IP Blocked when I start Microsoft Word 2007 ( sometimes with Excel also). The log shows various ports being used when this happens. Here is a partial log of the events:

 

2013/12/06 10:57:16 -0800 AWSERVER **************** IP-BLOCK 66.77.96.140 (Type: outgoing, Port: 51922, Process: winword.exe)

2013/12/06 12:58:30 -0800 AWSERVER **************** IP-BLOCK 66.77.96.140 (Type: outgoing, Port: 52547, Process: winword.exe)

2013/12/06 13:01:02 -0800 AWSERVER **************** IP-BLOCK 66.77.96.140 (Type: outgoing, Port: 52616, Process: winword.exe)

2013/12/06 13:12:39 -0800 AWSERVER **************** IP-BLOCK 66.77.96.140 (Type: outgoing, Port: 52726, Process: winword.exe)

2013/12/06 13:58:07 -0800 AWSERVER **************** IP-BLOCK 66.77.96.140 (Type: outgoing, Port: 52984, Process: winword.exe)

 

I checked that IP address; it's for W3i Holdings, LLC, an information technology company in Minnesota.

 

I also checked the location of Winword.exe on the computer, it's in the correct location and the MD5 hash matches that of the same application on another computer.

 

Anyone know what might be going on?

[daledoc1]

Hi and , cammac725:
 
If you think the IP blocks might be a False Positive, it might be a good idea to check this pinned topic and then to report the finding here: Website Blocking
 
If you think you might be infected, based on the IP blocks or other computer behavior, then I would suggest that you please follow the recommendations in this pinned topic: Available Assistance For Possibly Infected Computers.
A malware analyst will guide you through the scanning & cleanup process.

Thanks,

daledoc1

[cammac725]

Thanks for the reply, daledoc1.

 

I found the offending app. It was an add-in to Word called Clip Art Collection; just disabled the add-in.

 

Cheers

[AdvancedSetup]

Just curious, was this "Clip Art Collection" a 3rd party add-on or the one that is built-in to Microsoft Office?

[cammac725]

It came with a 3rd party program: EZ Cards Creator.

[AdvancedSetup]

Thank you for the follow-up.  Just wanted to make sure it was not from Microsoft as that IP is not associated to Microsoft.