repair remote code execution

[mitip]

I think I have suffered the remote code execution attack in Outlook 2007. It
means I get a 'command line swith error when starting outlook. I can start
outlook only by going to the outlook.exe and running as administrator. It is
probably just a registry key that needs repairing but which one? Help

 

[Diane Poremsky [MVP]]

mitip wrote on Tue, 30 December 2008 08:49

I think I have suffered the remote code execution attack in Outlook 2007. It
means I get a 'command line swith error when starting outlook. I can start
outlook only by going to the outlook.exe and running as administrator. It is
probably just a registry key that needs repairing but which one? Help

did you check the switch the shortcut you clicked is using? right click on the shortcut and choose properties to view it. Typically, it will be the full path to outlook.exe followed by /recycle - if its anything else its very possible the switch is wrong.

Also, what windows acct type do you use?
--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
mailto:[email protected]

EMO - a weekly newsletter about Outlook and Exchange:
mailto:[email protected]

 

[mitip]

mitip wrote on Tue, 30 December 2008 08:49

I think I have suffered the remote code execution attack in Outlook 2007. It
means I get a 'command line swith error when starting outlook. I can start
outlook only by going to the outlook.exe and running as administrator. It is
probably just a registry key that needs repairing but which one? Help

did you check the switch the shortcut you clicked is using? right click on the shortcut and choose properties to view it. Typically, it will be the full path to outlook.exe followed by /recycle - if its anything else its very possible the switch is wrong.

Also, what windows acct type do you use?
--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
mailto:[email protected]

EMO - a weekly newsletter about Outlook and Exchange:
mailto:[email protected]

No I have gone beyong the shortcut, that has the correct /recycle next to
it. No this happens when I click on the actual .exe inside Program files
Office 12. I gather the remote code execution has altered the commands used
adding extra URLs or something. I have the patches that prevent it happening
again but want to get the normal .exe to work. I have reinstalled Office
twice with no change. It seems to have also altered my regedit.exe also, all
part of making harder to put the virus right. I am guessing but the
outlook.exe points to a registry entry and that is what has been altered. I
have spent hours searching for utilities that might correct this. A few
called RRTs seem to offer help but have had no affect.

 

[mitip]

mitip wrote on Tue, 30 December 2008 08:49

I think I have suffered the remote code execution attack in Outlook 2007. It
means I get a 'command line swith error when starting outlook. I can start
outlook only by going to the outlook.exe and running as administrator. It is
probably just a registry key that needs repairing but which one? Help

did you check the switch the shortcut you clicked is using? right click on the shortcut and choose properties to view it. Typically, it will be the full path to outlook.exe followed by /recycle - if its anything else its very possible the switch is wrong.

Also, what windows acct type do you use?
--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
mailto:[email protected]

EMO - a weekly newsletter about Outlook and Exchange:
mailto:[email protected]

Also you asked about what type of account I use. Iam an administrator
already so in theroy I should not need to run as administrator. I have gone
to the properties of the .exe and checked i have full run and execute rights
for this software but that does not help.

 

[Diane Poremsky [MVP]]

mitip wrote on Tue, 30 December 2008 09:28

:

No I have gone beyong the shortcut, that has the correct /recycle next to
it. No this happens when I click on the actual .exe inside Program files
Office 12. I gather the remote code execution has altered the commands used
adding extra URLs or something. I have the patches that prevent it happening
again but want to get the normal .exe to work. I have reinstalled Office
twice with no change. It seems to have also altered my regedit.exe also, all
part of making harder to put the virus right. I am guessing but the
outlook.exe points to a registry entry and that is what has been altered. I
have spent hours searching for utilities that might correct this. A few
called RRTs seem to offer help but have had no affect.

I have never seen a remote code execution that affected the EXE - its usually something with previewing a message or clicking a URL.

If office diagnostics doesn't fix it and its affecting other applications and altered the registry, it is best to reformat and reinstall. It's the only way to be sure you have cause removed from your hard drive.


--
Diane Poremsky [MVP - Outlook]



Outlook Tips by email:
mailto:[email protected]

EMO - a weekly newsletter about Outlook and Exchange:
mailto:[email protected]