Win2K pro - Some sort of exploit?

[mucous]

Hi,

We're a win2k pro office. One of my users is having this issue...

On random occasions after she boots up, if she clicks on the desktop, the "getting started" screen opens and no matter how many times she closes it, it opens back up. If she goes to ANY program and opens them, as soon as they load, the help file associated with the program starts also making it impossible to work. Same thing happens with it. Try to close it and it just opens back up. We are running Symantec Antivirus, corporate edition and update it regularly along with keeping up with all critical updates and service packs. The antivirus hasn't detected any viruses. I also installed Spybot a few weeks back. When I run Spybot, it does detect a DSO exploit, however the help file pops up on it, making it impossible to fix the problem. I MAY be able to close the help file to fix the problem, but then the whole program crashes when I try.
Does this behaviour sound familiar to anyone, and if so, any recommendations on how to clean or get rid of it!

Many thanks in advance for your suggestions!

 

[mucous]

I'm not sure if this means anything, however in the running tasks, I'm seeing two processes with the same name running....

one is: Internat.exe

The other: internat.exe

One is in the current user, the other says .DEFAULT

 

[carrr]

Check this out:

http://www.sarc.com/avcenter/venc/data/pwsteal.netsnake.html

You'll also find this thread useful:

http://www.experts-exchange.com/Applications/Viruses/Q_20678065.html

 

[mucous]

Thanks,

I did see that particular article. Checked the registry to see if it was listed in the run section and didn't see it. I think I knocked it out with Spybot, but have the user on the watch to see if it happens again. If so, then I'll check the registry again while it's running.

Thanks for your help

 

[FatesWebb]

your keyboards F1 button is stuck down

FatesWebb

if you do what I suggested it is not my fault...