Today, I opened a Word document while I had Protowall running and noticed some activity by Protowall. This aroused my suspicions enough to close everything running on my computer. I then started Protowall, and opened the Word document again. Protowall showed signs of activity, so I checked the log and found that at the exact time the Word document was opening, Protowall was blocking packets. Here is an excerpt from the log that corresponds with the opening of the Word document: ------------------ 2004/11/08 12:04:42 [<-] BLOCKED [!] - Destination is PornDirect/Sitefinder/Verisign[Spyware] (64.94.110.11) [protocol: TCP / destport: 80] 2004/11/08 12:04:45 [<-] BLOCKED [!] - Destination is PornDirect/Sitefinder/Verisign[Spyware] (64.94.110.11) [protocol: TCP / destport: 80] 2004/11/08 12:04:51 [<-] BLOCKED [!] - Destination is PornDirect/Sitefinder/Verisign[Spyware] (64.94.110.11) [protocol: TCP / destport: 80] 2004/11/08 12:05:02 [<-] BLOCKED [!] - Destination is Microsoft Corp trackers 2 AP2P (131.107.103.243) [protocol: TCP / destport: 80] 2004/11/08 12:05:05 [<-] BLOCKED [!] - Destination is Microsoft Corp trackers 2 AP2P (131.107.103.243) [protocol: TCP / destport: 80] 2004/11/08 12:05:11 [<-] BLOCKED [!] - Destination is Microsoft Corp trackers 2 AP2P (131.107.103.243) [protocol: TCP / destport: 80] ----------------- I then closed the Word document and opened Word from the Program Files menu, and Protowall showed activity again. The log showed packets being blocked to the same IP addresses as before. This would seem to indicate that Word 2002 is not only phoning home, but contacting a known spyware site as well. Opening the other programs in the Office suite didn't produce this suspicious activity. Any thoughts on this?

After uninstalling Office XP, I installed Office 2003. Protowall still shows activty when opening word, but at least it no longer has to block packets being sent to 64.94.110.11. It is still having to block packets being sent to Microsoft Corp trackers 2 AP2P (131.107.103.243). I'd be interested to know what exactly is being sent to Microsoft.