After Uninstalling SP2, IE Opens and Then Shuts

[Guest]

Has anyone an idea of what causes this? It affects IE as well as all of the
IM's....the page starts to come up and then IE closes....uninstalled SP2 for
XP, do not see any more traces except pop up blocker still comes up- I added
sites to allowed sites but still no good- do not have restore disk...

 

[PA Bear]

Did this occur before you installed SP2?

 

[Guest]

No - it started after installing SP2 and has continued after removal of SP2...

 

[PA Bear]

You've been hijacked! Installing SP2 revealed the problem, it did not cause
it.

Dealing with Trojans & Hijackware

A. Trojans

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Run these tools in the following order with nothing else running in
background:

1. CWShredder v2,0 (Run "Fix", not "Scan)
http://forum.aumha.org/downloads/cwshredder.zip

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)
http://www.lavasoftusa.com/support/download/

3. Spybot (RTFM; Immunize then Scan; Generally fix everything in red)
http://www.safer-networking.org/en/index.html

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7.

When all else fails...

HijackThis
http://forum.aumha.org/downloads/hijackthis.zip

....is the preferred tool to use. With advice from experts, it will help you
to both identify and remove any hijackware/spyware. Post your log to, e.g.,
http://forums.spywareinfo.com/, http://computercops.biz/forum67.html or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, **not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

 

[Guest]

Thanks for the info- naturally I can not download ANY virus scans since I can
not get IE to work- hopefully some of the other articles will assist me in
looking at system files for the culprit....thanks

You've been hijacked! Installing SP2 revealed the problem, it did not cause
it.

Dealing with Trojans & Hijackware

A. Trojans

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Run these tools in the following order with nothing else running in
background:

1. CWShredder v2,0 (Run "Fix", not "Scan)
http://forum.aumha.org/downloads/cwshredder.zip

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)
http://www.lavasoftusa.com/support/download/

3. Spybot (RTFM; Immunize then Scan; Generally fix everything in red)
http://www.safer-networking.org/en/index.html

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7.

When all else fails...

HijackThis
http://forum.aumha.org/downloads/hijackthis.zip

....is the preferred tool to use. With advice from experts, it will help you
to both identify and remove any hijackware/spyware. Post your log to, e.g.,
http://forums.spywareinfo.com/, http://computercops.biz/forum67.html or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, **not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

No - it started after installing SP2 and has continued after removal of
SP2...

 

[Guest]

I mean IF the problem is that I can not access the internet, how would I d/l
any of the virus scans, spycheckers, etc.??? I am writing from my PC that
does work, it is actually my daughter's PC that is in question and she is
1200 miles away.....trend micro's housecall is another good one if the trojan
allows it to load....

You've been hijacked! Installing SP2 revealed the problem, it did not cause
it.

Dealing with Trojans & Hijackware

A. Trojans

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Run these tools in the following order with nothing else running in
background:

1. CWShredder v2,0 (Run "Fix", not "Scan)
http://forum.aumha.org/downloads/cwshredder.zip

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)
http://www.lavasoftusa.com/support/download/

3. Spybot (RTFM; Immunize then Scan; Generally fix everything in red)
http://www.safer-networking.org/en/index.html

Important: You must seek updates for Ad-Aware, Spybot, etc., before each and
every use, even "right out of the box". But even they can't catch
everything, 24/7.

When all else fails...

HijackThis
http://forum.aumha.org/downloads/hijackthis.zip

....is the preferred tool to use. With advice from experts, it will help you
to both identify and remove any hijackware/spyware. Post your log to, e.g.,
http://forums.spywareinfo.com/, http://computercops.biz/forum67.html or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, **not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

No - it started after installing SP2 and has continued after removal of
SP2...

 

[PA Bear]

OK, *she's* been hijacked.

Best bet might be for her to take the machine to a *reputable* shop, Rick.
Otherwise, just about all of the anti-malware tools can be saved to CD or a
USB thumb-drive for use on another machine.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

I mean IF the problem is that I can not access the internet, how would I
d/l any of the virus scans, spycheckers, etc.??? I am writing from my PC
that does work, it is actually my daughter's PC that is in question and
she is 1200 miles away.....trend micro's housecall is another good one if
the trojan allows it to load....

You've been hijacked! Installing SP2 revealed the problem, it did not
cause it.

Dealing with Trojans & Hijackware

A. Trojans

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if
directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Run these tools in the following order with nothing else running in
background:

1. CWShredder v2,0 (Run "Fix", not "Scan)
http://forum.aumha.org/downloads/cwshredder.zip

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)
http://www.lavasoftusa.com/support/download/

3. Spybot (RTFM; Immunize then Scan; Generally fix everything in red)
http://www.safer-networking.org/en/index.html

Important: You must seek updates for Ad-Aware, Spybot, etc., before
each and every use, even "right out of the box". But even they can't
catch everything, 24/7.

When all else fails...

HijackThis
http://forum.aumha.org/downloads/hijackthis.zip

....is the preferred tool to use. With advice from experts, it will
help you to both identify and remove any hijackware/spyware. Post your
log to, e.g., http://forums.spywareinfo.com/,
http://computercops.biz/forum67.html or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, **not
here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

No - it started after installing SP2 and has continued after removal
of SP2...

:

Did this occur before you installed SP2?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

Rick wrote:
Has anyone an idea of what causes this? It affects IE as well as
all of the IM's....the page starts to come up and then IE
closes....uninstalled SP2 for XP, do not see any more traces
except pop up blocker still comes up- I added sites to allowed
sites but still no good- do not have restore disk...

 

[Guest]

Thanks Robert, naturally it has also rendered her CD drive useless...I had
some problems with my system not too long ago and had been able to find the
trojan in regedit but it is a little more difficult to do over the phone with
a teenage girl....

OK, *she's* been hijacked.

Best bet might be for her to take the machine to a *reputable* shop, Rick.
Otherwise, just about all of the anti-malware tools can be saved to CD or a
USB thumb-drive for use on another machine.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

I mean IF the problem is that I can not access the internet, how would I
d/l any of the virus scans, spycheckers, etc.??? I am writing from my PC
that does work, it is actually my daughter's PC that is in question and
she is 1200 miles away.....trend micro's housecall is another good one if
the trojan allows it to load....

You've been hijacked! Installing SP2 revealed the problem, it did not
cause it.

Dealing with Trojans & Hijackware

A. Trojans

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow *all* Removal steps, including editing the Registry if
directed.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then:

Disk Cleanup > More options > Delete all but the most recent Restore
Point.

B. Hijackware

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm

Run these tools in the following order with nothing else running in
background:

1. CWShredder v2,0 (Run "Fix", not "Scan)
http://forum.aumha.org/downloads/cwshredder.zip

2. Ad-Aware SE (reconfigure per Post #2 in
http://aumha.org/forum/viewtopic.php?t=5877; fix all found)
http://www.lavasoftusa.com/support/download/

3. Spybot (RTFM; Immunize then Scan; Generally fix everything in red)
http://www.safer-networking.org/en/index.html

Important: You must seek updates for Ad-Aware, Spybot, etc., before
each and every use, even "right out of the box". But even they can't
catch everything, 24/7.

When all else fails...

HijackThis
http://forum.aumha.org/downloads/hijackthis.zip

....is the preferred tool to use. With advice from experts, it will
help you to both identify and remove any hijackware/spyware. Post your
log to, e.g., http://forums.spywareinfo.com/,
http://computercops.biz/forum67.html or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, **not
here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

Rick wrote:
No - it started after installing SP2 and has continued after removal
of SP2...

:

Did this occur before you installed SP2?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)

Rick wrote:
Has anyone an idea of what causes this? It affects IE as well as
all of the IM's....the page starts to come up and then IE
closes....uninstalled SP2 for XP, do not see any more traces
except pop up blocker still comes up- I added sites to allowed
sites but still no good- do not have restore disk...

 

[Don Varnau]

Hi,
There's a possibility that one of these steps will allow IE to work enough
to download the spyware/parasite removal programs recommended by PA Bear:

From Control Panel> Internet Options> Advanced> uncheck "Enable third party
browser extensions." That mayallow IE to work.
You should re-enable browser extensions after the cleanup.

You might also be able to browse and download programs from the address bar
of Windows Explorer.

Start> Run> MSCONFIG> Startup... uncheck suspicious entries. Restart. See if
IE works.

Hope this helps,
Don