IE 6 Borked after XP SP2

[Tom Felts]

Hi,

I have just installed XP SP2 on a dell laptop, and IE and Outlook Express
are now borked. The specific behavior is that I open IE, and get a blank
page. If I click Help: About, nothing happens. If I enter a url into the
nav bar, it navigates to the site, the main IE window disappears, and I get
a security prompt asking if I want to save the (in this case) .htm file to
disk, as IE cannot open the file.

With Outlook Express, when I open it, I get an error message about not
being able to switch folders (although I only have one identity configured).
Then I can get into the GUI, and access news servers, but after I retreive a
list of messages, and click on one to open, I get an 'Out of Memory" error.

I have tried re-installing SP2...no go. I have tried re-installing using
the inf file method..still no go....


Any ideas?

 

[Jan Il]

Hi Tom

It is not uncommon that hidden malware or hijackers are suddenly exposed
with the installation of the SP2. This is likely the cause of your problem.
Simply uninstalling SP2 will not remove the scumware causing the problem,
however, if you are unable to use the machine, I suggest that you try
uninstalling the SP2, clean your machine thoroughly, then reinstall SP2.

How to remove Windows XP Service Pack 2 from your computer
http://support.microsoft.com/default.aspx?scid=kb;en-us;875350&Product=winxp

To clean your system, in addition to updating and running your AV, download,
install and run the programs below in Safe Mode with Hidden Files enabled.
This will remove the nasty you have and any others it may have let in the
back door. Some malware can replicate itself repeatedly if not removed
properly, so even if you have already run some programs, run them again
according to the information below. Follow all instructions carefully:

First, Clear the TIF's and empty the recycle bin:
http://www.mvps.org/winhelp2002/delcache.htm

If so, then do the following:

WARNING>>>> Backup all documents and files before removing any spyware!!

How to properly scan for scumware (read first, if possible)
http://aumha.org/forum/viewtopic.php?t=5878

Download and install BHODemon from
http://www.definitivesolutions.com/bhodemon.htm
Your problem may be caused by a bad BHO.

Most importantly, download install and run CWShredder here
http://www.majorgeeks.com/download3019.html
and About Buster, which searches for hidden .dlls that recreate the malware.
http://www.majorgeeks.com/download4289.html
Then visit these two sites to test for parasites and help basic cleaning:
On-Line Check
http://aumha.org/a/noads.htm
and
Quick-Fix Protocol.
http://aumha.org/a/quickfix.php
Basically, throw everything here at your "infection".

Then download, install and immediately update these three programs before
running:
AdAware SE - Update immediately after installing
http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button
AdAware Tutorial -
http://www.bleepingcomputer.com/forums/index.php?showtutorial=48
SpyBot S &D - Update immediately after installing
http://www.majorgeeks.com/download2471.html
SpyBot S&D Tutorial -
http://www.bleepingcomputer.com/forums/index.php?showtutorial=43
Microsoft Windows Antispyware Program (Beta)
http://www.microsoft.com/athome/security/spyware/software/default.mspx

Also download, install and run CWShredder:
http://www.majorgeeks.com/downloadget.php?id=3019&file=11&evp=9e0433de9f8fd8e137fd6b3ff02edc90

Next, do an Online scan here (if possible) -
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Make sure that you choose "fix" or "clean".

Download PocketKkillbox from
http://www.thespykiller.co.uk/files/killbox.exe
and put it on the desktop where you can find it easily

Download, install, and run HiJackThis - it is one of the most important
tools to help clean your system of scumware. Follow the instructions
carefully:

How to download and install HiJackThis: (it does not need to be updated)
http://www.bleepingcomputer.com/forums/topict309.html

Please DO NOT post your log to this newsgroup. It is important that you go
to one of the HiJackThis Support Forums below and allow the experts there
to analyze it for youPlease DO NOT post your log to this newsgroup. It is
important that you go to one of the HiJackThis Support Forums below and
allow the experts there to analyze it for you.::
AumHa HiJackThis Forum
http://forum.aumha.org/viewforum.php?f=30
or Bleeping Computer Forum
http://www.bleepingcomputer.com/forums/forum22.html
to allow the experts there to evaluate your log and advise you of any
necessary steps to clean your system.
(Note: You will have to Register before posting on these Forums. Please
follow all posting instructions carefully to avoid having your log deleted
or ignored.)

Also, please post a link to the forum where you post your HJT log back to
this thread so that we can follow your progress there.

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

You should also get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also... From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)
or Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip

How to Restart in Safe Mode
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

How to Show Hidden Files
http://snipurl.com/6rl8

Hope this helps

Jan
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Tom Felts]

Thanks for the tips Jan. Just as a comment, I don't think ANY piece of
software is worth having to go through this kind of BS.....but, I will try,
just for the intellectual exercise. To my mind, it would be FAR easier just
to remove IE completely, and use a different browser.

 

[Don Varnau]

Hi,
For the Outlook express problem, see
http://insideoe.tomsterdam.com/problems/errors.htm#foldersdbx

For the IE problems:
The best course may be a reinstall/repair (after uninstalling SP2) but first
visit these links. Reregistering some DLLs may help- won't hurt- and will be
easier that a reinstall.
http://www.winxptutor.com/ieabout.htm
http://www.mvps.org/sramesh2k/IEFAQ.htm Tips #21 & 46
http://support.microsoft.com/?kbid=281679

As Jan proposed, this may also be a malware issue.

Don
[MS MVP- IE/OE]

 

[jjjjj]

I am posting from a different account.

All the spyware scans came up clean. I un-installed SP2 and IE and OE are
working correctly.


So I will stay away from SP2, and wait for SP3...it just doesn't work for
me.

Hi,
For the Outlook express problem, see
http://insideoe.tomsterdam.com/problems/errors.htm#foldersdbx

For the IE problems:
The best course may be a reinstall/repair (after uninstalling SP2) but first
visit these links. Reregistering some DLLs may help- won't hurt- and will be
easier that a reinstall.
http://www.winxptutor.com/ieabout.htm
http://www.mvps.org/sramesh2k/IEFAQ.htm Tips #21 & 46
http://support.microsoft.com/?kbid=281679

As Jan proposed, this may also be a malware issue.

Don
[MS MVP- IE/OE]

Hi,

I have just installed XP SP2 on a dell laptop, and IE and Outlook Express
are now borked. The specific behavior is that I open IE, and get a blank
page. If I click Help: About, nothing happens. If I enter a url into the
nav bar, it navigates to the site, the main IE window disappears, and I get
a security prompt asking if I want to save the (in this case) .htm file to
disk, as IE cannot open the file.

With Outlook Express, when I open it, I get an error message about not
being able to switch folders (although I only have one identity configured).
Then I can get into the GUI, and access news servers, but after I

retreive

a
list of messages, and click on one to open, I get an 'Out of Memory" error.

I have tried re-installing SP2...no go. I have tried re-installing using
the inf file method..still no go....