Need to repair or reinstall IE6

[BobV]

Unfortunately my browser was hijacked by Incredifind. Using directions I
found on the net I was able to remove it, but it left me a browser that only
gives me the -- can't display page-- message.

I have tried to uninstall and reinstall IE using regedit with no luck. I
also reinstalled XP as an upgrade with no luck. I downloaded a new copy of
IE6 from the net and installed also with no success. I was able install XP
on another partition, and this works fine. I am now using Netscape (Ugh) as
my browser on my original partition, but am not all that happy with either
of the two solutions.

I have spent considerable time searching on the net including MS Knowledge
Base with no fix.

lspfix didn't help either

Any ideas?

Thanks in advance, Bob

 

[Jan Il]

Hi Bob

Hi have provided the information for a repair of the IE, however, you should
also review the information on the link below which may provide additional
information on properly installing and uninstalling IE.

http://www.btinternet.com/~winnoel/ReInIE.htm

*********************************************
Repair IE ( Does not work for XP - For XP see below)

1. Close all Internet windows and programs, then the Click the Start tab
on the bottom task bar.
2. Click Settings
3. Click Control Panel
4. Click on Add/Remove Programs
5. Find and highlight your IE version in the list
6. Click the Add/Remove tab on the dialog box under the window
7. When the Wizard window opens you should see a Repair Internet Explorer
8. Click the radio button or box next to it, then click OK
9. Let it run the repair
10. Reboot you computer

or

If you have not already done so, then you might try a repair of IE6 as
follows:

http://support.microsoft.com/defaul...port/kb/articles/Q194/1/77.asp&NoWebContent=1
or
http://snipurl.com/6s3r

For XP Repair of IE - Courtesy of Robert Aldwinckle

XP users who have installed IE6sp1 before upgrading to XPsp1
will have setupwbv.dll and will be able to do a repair using

rundll32 setupwbv.dll,IE6Maintenance

Otherwise, they have to use

sfc /scannow

etc., or reinstall IE6 (Ref: KB318378)
******************************************************

HTH

Jan

 

[BobV]

Thanks Jan, but I had tried all this, but just tried it again with no
success.
I should have mentioned that I am running XP Pro.

scannow finds nothing wrong, and using regedit to uninstall IE and then
reinstalling IE doesn't change a thing.

I even tried removing all the IE files in the IE folder of Program files and
reinstalling XP, but still no luck. They were replaced, but I still get the
page can't be displayed message.

If I only new which files needed to be replaced..

Any ideas??

Thanks, Bob

 

[Mike Taylor]

I'm finding something in common with you here. I also can't get to any web
pages and Ad Aware found the Incredifind program running on my machine. I've
deleted that directory and quarantined the files using Ad Aware, but don't
know how to go further.

I can get email but can't get to any web sites.

I've just downloaded Hijaack this but won't be able to post my logs to the
forum. I can post them here, but will anyone be able to help?

 

[Jim Byrd]

Hi Bob - Download and run WinSock XP Fix 1.2 from here:
http://www.spychecker.com/program/winsockxpfix.html If you can't download
it from another computer and transfer it by floppy, post back here, and if
your email server will let you accept a 1.4 MB attachment, I'll email it to
you as an attachment. (Since you're on XP, run this even if you've already,
as you say, run lspfix). Since you don't state the steps you took to remove
Incredifind, (and it can be particularly difficult to remove if you miss
even one thing), I would suggest that you do the following in order once you
restore on-line access.

(Run CWShredder then AdAware, SpyBot, and HijackThis (if needed), below, in
that order). Do the following:



Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

http://www.cexx.org/lspfix.htm
http://www.mvps.org/sramesh2k/winsock.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is XP)
The process of removing certain malware may kill your internet connection.
If this should occur, this program, LSPFIX, will enable you to regain your
connection.



Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406>

HOW TO Enable Hidden Files
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339>

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001111912274039>
(WinXP)
<http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001012513122239>
(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions if they've been affected (as they probably will have
been).


Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093

which blocks the exploit upon which this parasite family depends.



However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

Both of these programs should normally be UPDATED and run after doing any
other fix such as CWShredder and, as a minimum, normally at least once a
week.



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b552982a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended


Finally, go to Windows Update and ensure that ALL Critical updates are
installed.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Mike Taylor]

Jim,

I am running Windows 98 with the same problem. Can you possibly email a copy
of lspfix (or any other file you would suggest) to me? I can't download it.
I was able to get Hijack This and posted my log in my thread "Can't load any
pages with IE6" that I posted today.

 

[Jim Byrd]

Ans by email.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[BobV]

Hi Jim

Thanks so much. I did implement many of your suggestions, and now
everything is back to normal.

The WinSock XP Fix got the browser working again, CWShredder found some
infected files, and then SpyBot took care of some SLOTCH hijacking files.
It is very nice after many hours of troubleshooting, and days without IE to
be back to normal.

I will look at the rest of your suggestions, and hopefully will not get
reinfected.

Thanks Again, Bob

--

Hi Bob - Download and run WinSock XP Fix 1.2 from here:
http://www.spychecker.com/program/winsockxpfix.html If you can't download
it from another computer and transfer it by floppy, post back here, and if
your email server will let you accept a 1.4 MB attachment, I'll email it to
you as an attachment. (Since you're on XP, run this even if you've already,
as you say, run lspfix). Since you don't state the steps you took to remove
Incredifind, (and it can be particularly difficult to remove if you miss
even one thing), I would suggest that you do the following in order once you
restore on-line access.

(Run CWShredder then AdAware, SpyBot, and HijackThis (if needed), below, in
that order). Do the following:



Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

http://www.cexx.org/lspfix.htm
http://www.mvps.org/sramesh2k/winsock.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is XP)
The process of removing certain malware may kill your internet connection.
If this should occur, this program, LSPFIX, will enable you to regain your
connection.



Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode

HOW TO Enable Hidden Files

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)

(WinXP)

(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions if they've been affected (as they probably will have
been).


Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093

which blocks the exploit upon which this parasite family depends.



However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

Both of these programs should normally be UPDATED and run after doing any
other fix such as CWShredder and, as a minimum, normally at least once a
week.



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:
http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b5529
82a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?s=d3c2c886d536d57
b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended


Finally, go to Windows Update and ensure that ALL Critical updates are
installed.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Unfortunately my browser was hijacked by Incredifind. Using directions I
found on the net I was able to remove it, but it left me a browser that only
gives me the -- can't display page-- message.

I have tried to uninstall and reinstall IE using regedit with no luck. I
also reinstalled XP as an upgrade with no luck. I downloaded a new copy of
IE6 from the net and installed also with no success. I was able install XP
on another partition, and this works fine. I am now using Netscape

(Ugh)

as
my browser on my original partition, but am not all that happy with either
of the two solutions.

I have spent considerable time searching on the net including MS Knowledge
Base with no fix.

lspfix didn't help either

Any ideas?

Thanks in advance, Bob

 

[Jim Byrd]

YW, Bob - Glad you got things cleaned up.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

Hi Jim

Thanks so much. I did implement many of your suggestions, and now
everything is back to normal.

The WinSock XP Fix got the browser working again, CWShredder found some
infected files, and then SpyBot took care of some SLOTCH hijacking files.
It is very nice after many hours of troubleshooting, and days without IE to
be back to normal.

I will look at the rest of your suggestions, and hopefully will not get
reinfected.

Thanks Again, Bob

Hi Bob - Download and run WinSock XP Fix 1.2 from here:
http://www.spychecker.com/program/winsockxpfix.html If you can't download
it from another computer and transfer it by floppy, post back here, and if
your email server will let you accept a 1.4 MB attachment, I'll email it to
you as an attachment. (Since you're on XP, run this even if you've already,
as you say, run lspfix). Since you don't state the steps you took to remove
Incredifind, (and it can be particularly difficult to remove if you miss
even one thing), I would suggest that you do the following in order once you
restore on-line access.

(Run CWShredder then AdAware, SpyBot, and HijackThis (if needed), below, in
that order). Do the following:



Before you try to remove spyware using any of the programs below, download a
copy of LSPFIX from any of the following sites:

http://www.cexx.org/lspfix.htm
http://www.mvps.org/sramesh2k/winsock.htm
http://www.spychecker.com/program/winsockxpfix.html (if your OS is XP)
The process of removing certain malware may kill your internet connection.
If this should occur, this program, LSPFIX, will enable you to regain your
connection.



Download, UPDATE before running, and run:
http://209.133.47.200/~merijn/files/CWShredder.exe to remove the parasite.
Be sure to close all instances of IE and OE. You may also get it here if
that link is blocked: http://www.zerosrealm.com/downloads/CWShredder.zip

BE SURE that you get v.158 or later!

You will need to show Hidden files first and then at the end clear the
malware garbage from your System Restore backups after you've cleaned up.
It's best to perform CWShredder (and most other malware fixers too) from
Safe mode and then reboot. AFTER cleaning things up, then you can disable
and then re-enable System Restore. See ******** below.

The following links give instructions on how to do these various functions:


HOW TO Restart in Safe Mode

HOW TO Enable Hidden Files

HOW TO Disable/Flush System Restore (do this at the end AFTER cleaning or
use the suggested procedure for XP at the ******'s)

(WinME)



Then download and run:
http://www.kellys-korner-xp.com/regs_edits/iegentabs.reg to restore your
tabs and remove any restrictions that the parasite has put in place.

Now download and run:
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG to restore
your search functions if they've been affected (as they probably will have
been).


Be sure that you also download and install hotfix Q816093, here:

http://support.microsoft.com/?kbid=816093

which blocks the exploit upon which this parasite family depends.



However, this also indicates that you may have acquired some other malware
along the way. If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in Zone
Alarm 3.x, if present or any other Ad Blocking software which interferes
with Java Scripting for this scan to work. You should get a message between
the two lines of **** giving the results of the scan.

Get Ad-Aware 6.0, Build 181 or later, here:
http://www.lavasoftusa.com/support/download/. UPDATE and run this regularly
to get rid of most "spyware/hijackware" on your machine. If it has to fix
things, be sure to re-boot and rerun AdAware again and repeat this cycle
until you get a clean scan. The reason is that it may have to remove
things which are currently "in use" before it can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After UPDATING and fixing things with SpyBot S&D, be
sure to re-boot and rerun SpyBot again and repeat this cycle until you get a
clean "no red" scan. The reason is that SpyBot sometimes has to remove
things which are currently "in use" before it can then clean up others.

Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm

Both of these programs should normally be UPDATED and run after doing any
other fix such as CWShredder and, as a minimum, normally at least once a
week.



If they don't fix it then start here:

Download HijackThis, free, here:
http://209.133.47.200/~merijn/files/HijackThis.exe (Always download a new
fresh copy of HijackThis [and CWShredder also] - It's UPDATED frequently.)
You may also get it here if that link is blocked:

http://www.majorgeeks.com/downloadget.php?id=3155&file=3&evp=3304750663b5529

82a8baee6434cfc13

In Windows Explorer, click on Tools|Folder Options|View and check "Show
hidden files and folders" and uncheck "Hide protected operating system
files". (You may want to restore these when you're all finished with
HijackThis.)

Unzip the downloaded HijackThis to any convenient folder, start it then
press Scan. Click on SaveLog when it's finished which will create
hijackthis.log. Now click the Config button, then Misc Tools and click on
Generate StartupList.log which will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://216.180.233.162/~swicom/forums/

or Net-Integration here:

http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi?s=d3c2c886d536d57

b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here: http://forums.tomcoyote.org/index.php?act=idx

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


*******
ONLY IF you've successfully eliminated the malware, you can now make a new,
clean Restore Point and delete any previously saved (possibly infected)
ones. The following suggested approach is courtesy of Gary Woodruff: For XP
you can run a Disk Cleanup cycle and then look in the More Options tab. The
System Restore option removes all but the latest Restore Point. If there
hasn't been one made since the system was cleaned you should manually create
one before dumping the old possibly infected ones.
*******


Once you get this cleaned up, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:

http://www.javacoolsoftware.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it UPDATED) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed, and it provides information and fixit-links for a variety
of parasites.

http://www.javacoolsoftware.com/spywareguard.html (Monitors for attempts to
install malware) Keep it UPDATED. Both Very Highly Recommended


Finally, go to Windows Update and ensure that ALL Critical updates are
installed.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In