[wighty]

Over the course of the past 12 hours, my wife's computer (Dell 4550, WIN XP Home SP1+) seems to have been infected by what I believe may have been the Remote Code Execution exploit. The computer is behind a FW, has virus (NAV) & spyware (Counterspy) protection, security patches, hotfixes, etc.. I it also networked (via cable) with my computer to the internet (cable) through a 4 port router. My system was not affected.

Last night all was well. But this morning several MS programs produce the same error message, "Microsoft ® HTML Application host has encountered a problem and needs to close". We are sorry for the inconvenience...". The programs affected are IE6, OE6, Services, System Restore, User Accounts, NAV, etc. I also found the Remote Assitance box checked under System Properties, when I know I had unchecked it some time ago, and disabled the associated services. I also get random Access violations in User32.dll

Using a diagnostic known as AIDA32 (no longer being upgraded), I was able to find a couple of suspicious entries under the SERVER folder - Opened Files, Global Groups, & Account security. The opened files screen is grayed-out, but the AIDA32 Account security page lists these items (that I'm certain I did not create):
Computer Role Primary
Domain Name SEZ4550
Primary Domain Controller Not Specified
Forced Logoff Time Disabled
Min / Max Password Age 0 / 49710 days
Minimum Password Length 0 chars
Password History Length Disabled
Lockout Threshold Disabled
Lockout Duration 30 min
Lockout Observation Window 30 min

I've read a similar Topic in this forum about someone who had a similar experience in Jan 06, but there seemed to be no resolution to the problem.

Although I'm not a computer novice, I am not experienced with the Windows Server. Based on what I've been able to find I suspect "someone" created a new user account and "adjusted" the permissions on several key Windows system files.

I'm hoping the collective knowlege in this forum can help me diagnose the problem, and hopefully come up with a solution that doesn't involve reformatting the HD and reistalling Windows. Is that possible?

[Advertisements]

Just to ensure I follow forum protocol, I ran spyware, virus, & HJT scans. The Spryware scan (CounterSpy) found FunWeb products & My Web Search Toolbar items that I removed - that did not affest (improve) the original problem.

Since NAV would not work, I D/Ld AVG and ran their virus scan - none found.

I then used HJT and have a log file. But I'm not certain that I should C&P that info in this forum, and since I started this topic outside the HJT forum, I'm not sure if I need to have my topic moved there before posteding the HJT log. < moderator's insight needed >

In addition to the other things that don't work, I now find that I can not create new folders on the HD...

[wighty]

Just to ensure I follow forum protocol, I ran spyware, virus, & HJT scans. The Spryware scan (CounterSpy) found FunWeb products & My Web Search Toolbar items that I removed - that did not affest (improve) the original problem.

Since NAV would not work, I D/Ld AVG and ran their virus scan - none found.

I then used HJT and have a log file. But I'm not certain that I should C&P that info in this forum, and since I started this topic outside the HJT forum, I'm not sure if I need to have my topic moved there before posteding the HJT log. < moderator's insight needed >

In addition to the other things that don't work, I now find that I can not create new folders on the HD...

[Dwight]

Hi wighty. Welcome to G2G. I think you should try this
that way you will know for sure.


Please go to malware forum and follow the instructions at the top
Specially the CLICK HERE.
That will give you several steps that will help you clean up 70 percent of
all problems by yourself. If at the end of the process you are still having
difficulty and you may not be
Then post a hijackthis log in THAT forum.
Click Here before posting a Hijack This log.
http://geekstogo.com...o_Here-f37.html

Please be patient it may take some time before one of the
experts can address you problem.

If you are still having problems after getting a clean bill of health from
the malware expert, please return to this thread.

[wighty]

Thanks Dwight. I will do that...

[Metallica]

Continued here:
http://www.geekstogo...howtopic=134552

Therefor closing this one.
Thank you Dwight