It's sounding more and more like a hijwackware problem, John.
Dealing with Trojans & Hijackware
A. Removing Trojans and Trojanware with Sysclean
Create a new folder named Sysclean (e.g., C:\Program files\Sysclean
or just a desktop folder). Download 'Sysclean.com' from
http://www.trendmicro.com/download/dcs.asp to this folder. Download
the latest 'Trend Pattern File' zip (e.g., lpt123.zip) from
http://www.trendmicro.com/download/pattern.asp and extract its
contents to the same folder; see the Readme text file for
instructions.
Delete Temporary Internet Files (IE Tools>Internet Options>General)
accepting the option to delete all offline content. Reboot and delete
contents of TEMP folders and Recycle Bin.
Close all running programs including your anti-virus application, go
offline, and run Sysclean. For best results, do nothing with the
machine until the scan completes.
If the scan shows any infections in System Restore files:
(1) create a new Restore Point (Start>Programs>Accessories>System
Tools>System Restore), then
(2) delete all but the most recent Restore Point
(Start>Programs>Accessories>System Tools>Disk Cleanup>More options
[tab]).
Afterwards, update your own anti-virus application and perform
another full system scan.
B. Hijackware
Help with Hijackware (all are MS MVP sites)
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
Run the following tools in this order with nothing else running in
background:
1. CWShredder v2.0 (no updates available currently; choose Fix, not
Scan)
2. Ad-Aware SE (Reconfigure per
http://aumha.org/forum/viewtopic.php?t=5877;
Fix all found)
3. Spybot (RTFM; Immunize first and then scan; Generally, fix
everything in red)
Important: You must seek updates for Ad-Aware, Spybot, etc., before
each and every use, even "right out of the box". But even they can't
catch everything, 24/7.
When all else fails, HijackThis
(
http://forum.aumha.org/downloads/hijackthis.zip) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to
http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not
here.**
[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]
So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)
John Noble wrote:
One other thing I forogt to mention: The application Event Log
lists and event ID 1000 for IE everytime I launch it after
upgrading to IE 6. Here's the message:
The description for Event ID (1000) in Source (Microsoft Internet
Explorer) could not be found. It contains the following insertion
string(s): iexplore.exe, 6.0.2800.1106, ntdll.dll, 4.0.1381.298,
00028a87
John Noble
Network Office Clearinghouse
Thanks for the reply. I've jsut attempted another re-install. I
stopped the anti-virus and any other services that weren't
necessary. I've run SB S&D and AdAware (although this is a server
that does not receive mail and rarely get's out onto the
internet). Once again, the install seems to proceed fine (no
errors). Upon reboot, I can launch IE and the app loads but
there is nothing but a white background and hour glass. No URL
will load. I've confirmed internet access by connecting to and
ftp site via command prompt.
I've tried uninstalling and reinstalling 4 times now. I've tried
both full install and minimal. I can uninstall back to 4.0 every
time and IE then works fine.
Also, if I attempt to change any IE (IE 6) settings via Internet
Options, the application freezes and I have to End Task it to
close.
I need to have IE 5.5 or higher for an application that I am
going to install. All help appreciated.
John Noble
Network Office Clearinghouse
Did you upgrade to IE6 SP1 via Windows Update?
To assure a clean install, your anti-virus application should be
disabled and all other running processes closed before
installing anything, including Windows Updates.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE)
John Noble wrote:
WinNT 4.0 server sp6a. I upgraded from IE4.0 to IE6 sp1. IE
will launch but won't display any pages (any URL). OE will
attempt to Launch but then generates an application error
(Dr. Watson - msimn.exe).
The first time I attempted the upgrade, the install had errors
regarding comcat.dll - I uninstalled IE6 then renamed
comcat.dll per KB article and re-installed and the
installation completed fine.
Any suggestions? Should I have upgraded to IE5.0 or 5.5 first
before attempting upgrade to 6.0?
Thanks,
John Noble
Network Office Clearinghouse