Spyware has trashed IE, reinstalling doesn't fix it.

  • Thread starter Thread starter Rick
  • Start date Start date
R

Rick

I am having trouble with a Win2k machine on our local
network. The machine had a fair amount of spyware, which
I removed with Adaware, Spybot, and Trendmicro Housecall.
The main problem was ADW_RULEDOR.C (Backdoor.ruledor.c)
which I painstakingly removed from the registry according
to Trendmicro's instructions.

Now IE doesn't work. Any site I try to go to
yields: "Internet explorer cannot open the search page"
and drops me off at the usual "this page cannot be
displayed" message.

I am not using ICS or AOL.

The internet connection works perfectly. Ping and IM work
fine. I can browse the web by using Outlook or even "My
Computer" as a makeshift web browser! The problem is JUST
with IE.

I have already been to:
http://mvps.org/winhelp2002/unwanted.htm
and
http://www.mvps.org/inetexplorer/answers.htm#dns
and I don't have Qhosts either.

I have cleared out the hosts file.
I have deleted all temp files, cookies, objects, folders,
and offline content.
I have reset all web settings.
I have repaired IE6.
I have uninstalled and reinstalled IE6. (Using 5 doesn't
work either)
I have even installed SP4, and every available patch
(using Outlook as a web browser).

I don't have a proxy server and my browser does not use
dial-up networking. DHCP and default settings work for
every other PC in the office. I think that spyware has
tainted my registry in a way that reinstalling IE just
doesn't fix. Can anyone suggest some registry keys to
check, or hidden KB articles to read before I format the
harddrive? I can't be formatting harddrives every time a
user gets some spyware!!
 
I am having trouble with a Win2k machine on our local
network. The machine had a fair amount of spyware, which
I removed with Adaware, Spybot, and Trendmicro Housecall.
The main problem was ADW_RULEDOR.C (Backdoor.ruledor.c)
which I painstakingly removed from the registry according
to Trendmicro's instructions.

Now IE doesn't work. Any site I try to go to
yields: "Internet explorer cannot open the search page"
and drops me off at the usual "this page cannot be
displayed" message.

Sounds like the Qhosts trojan. Read more about it here:

http://vil.nai.com/vil/content/v_100719.htm
 
Back
Top