I'd run a thorough check for hijackware on all machines.
Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/archive/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
When all else fails, HijackThis v1.99.1
(
http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to
http://forums.spywareinfo.com/,
http://castlecops.com/forum67.html or
http://aumha.net/viewforum.php?f=30
for expert analysis, not here.**
When this is all resolved, check in again at Windows Updates. That list is
missing several recent Critical patches.
--
~PA Bear
Andy wrote:
> Hi Robear,
>
> Here's a list of the Hotfixesthat were installed, all 'automatically' via
> the windows update website.
>
> 2000 admin tools
> KB822831
> 823182
> 823559
> 824105
> 824141
> 824146
> 825119
> 826232
> 828028
> 828035
> 828749
> 842773
> 905495
>
> Only one machine connects to the web through this server, but I will check
> on that client to see if any viruses are there.
>
> I haven't tried removing the hotfixes yet to see if that remedies the
> problem. Win 2000 automatically requires a restart after each one is
> removed and so this would take an age to perform!
>
> Again, thanks for your help.
>
> Andy
>
> "PA Bear" wrote:
>
> > And this happens on both Win2K machines?
> >
> > What "relevant Hotfixes from the Windows Update website" did you install
> > (e.g., Win2K SP4, Win2K SP4 Rollup 1) and when? Does uninstalling them
> > resolve the problem? Were they installed via
> > http://windowsupdate.microsoft.com or did you download the Hotfixes
> > from the Windows Update (or Windows) Catalog and install them manually?
> >
> > How many users browse the internet with the Win2K machines? Is their
> > use of the browser restricted in any way? (Pondering whether
> > hijackware/Trojanware is the cause.)
> > --
> > ~Robear Dyer (PA Bear)
> > MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP
> >
> >
> > Andy wrote:
> > > Hi Pa Bear,
> > >
> > > Thanks for the response.
> > >
> > > Internet Explorer will open, but instead of immediately opening the
> > > home page as one would expect it simply displays a white screen as it
> > > trys to load the page. After about 30 seconds it says 'Page Cannot be
> > > Displayed.'
> > >
> > > One thing I notice is that the progress bar of Explorer (bottom left
> > > of the browser) where it would ordinarily tell you 'opening page
> > > www.google.co.uk' now says says seems to display the IP address of the
> > > homepage.
> > >
> > > I haven't touched the connection settings from before I installed the
> > > updates so it can't be that!
> > >
> > > "PA Bear" wrote:
> > > > Care to expand on "Internet Explorer stopped working" (e.g., IE
> > > > doesn't load, IE loads but doesn't connect, IE loads & connects but
> > > > generate errors)?
> > > > --
> > > > Andy wrote:
> > > > > I have two servers, both running Windows 2000 Small Business
> > > > > Server.
> > > > >
> > > > > After routinely downloading the relavent Hotfixes from the Windows
> > > > > Update website, I restarted to find that Internet Explorer stopped
> > > > > working from the server computer.
> > > > >
> > > > > All the client machines work, but I can no longer check the
> > > > > internet from the server.