Tip: Never post or use your real email address when posting to public
newsgroups or forums.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP

Andy wrote:
> Hi Robear,
>
> Thanks again for your help - I have now posted the results of the Hi-Jack
> This log onto the Aumha forum page, as you suggested.
>
> My user name is my email address, andywickes@hotmail.com.
>
> Hopefully we're close to sorting this out!
>
> Fingers crossed!
>
> Andy
>
> "PA Bear" wrote:
>
> > Hijackware infected Windows, not IE itself though IE is very much part
> > and parcel of Windows. It's not unusual for another browser to work in
> > such instances.
> > --
> > ~PA Bear
> >
> > Andy wrote:
> > > I'll give this a go! Interestingly, I discovered that someone had
> > > installed Firefox on the server (the same server in question) and this
> > > works fine!
> > >
> > > So Internet Explorer doesn't work, yet Firefox does! And yet they both
> > > have the same connection settings!
> > >
> > > "PA Bear" wrote:
> > >
> > > > I'd run a thorough check for hijackware on all machines.
> > > >
> > > > Checking for/Help with Hijackware
> > > > http://aumha.org/a/parasite.htm
> > > > http://aumha.org/a/quickfix.htm
> > > > http://aumha.net/viewtopic.php?t=5878
> > > > http://mvps.org/winhelp2002/unwanted.htm
> > > > http://inetexplorer.mvps.org/data/prevention.htm
> > > > http://inetexplorer.mvps.org/archive/tshoot.html
> > > > http://www.mvps.org/sramesh2k/Malware_Defence.htm
> > > > http://defendingyourmachine.blogspot.com/
> > > >
> > > > When all else fails, HijackThis v1.99.1
> > > > (http://aumha.net/downloads/hijackthis.zip) is the preferred tool to
> > > > use. It will help you to both identify and remove any
> > > > hijackware/spyware. **Post your log to
> > > > http://forums.spywareinfo.com/, http://castlecops.com/forum67.html
> > > > or http://aumha.net/viewforum.php?f=30 for expert analysis, not
> > > > here.**
> > > >
> > > > When this is all resolved, check in again at Windows Updates. That
> > > > list is missing several recent Critical patches.
> > > > --
> > > > ~PA Bear
> > > >
> > > > Andy wrote:
> > > > > Hi Robear,
> > > > >
> > > > > Here's a list of the Hotfixesthat were installed, all
> > > > > 'automatically' via the windows update website.
> > > > >
> > > > > 2000 admin tools
> > > > > KB822831
> > > > > 823182
> > > > > 823559
> > > > > 824105
> > > > > 824141
> > > > > 824146
> > > > > 825119
> > > > > 826232
> > > > > 828028
> > > > > 828035
> > > > > 828749
> > > > > 842773
> > > > > 905495
> > > > >
> > > > > Only one machine connects to the web through this server, but I
> > > > > will check on that client to see if any viruses are there.
> > > > >
> > > > > I haven't tried removing the hotfixes yet to see if that remedies
> > > > > the problem. Win 2000 automatically requires a restart after each
> > > > > one is removed and so this would take an age to perform!
> > > > >
> > > > > Again, thanks for your help.
> > > > >
> > > > > Andy
> > > > >
> > > > > "PA Bear" wrote:
> > > > >
> > > > > > And this happens on both Win2K machines?
> > > > > >
> > > > > > What "relevant Hotfixes from the Windows Update website" did you
> > > > > > install (e.g., Win2K SP4, Win2K SP4 Rollup 1) and when? Does
> > > > > > uninstalling them resolve the problem? Were they installed via
> > > > > > http://windowsupdate.microsoft.com or did you download the
> > > > > > Hotfixes from the Windows Update (or Windows) Catalog and
> > > > > > install them manually?
> > > > > >
> > > > > > How many users browse the internet with the Win2K machines? Is
> > > > > > their use of the browser restricted in any way? (Pondering
> > > > > > whether hijackware/Trojanware is the cause.)
> > > > > > --
> > > > > > ~Robear Dyer (PA Bear)
> > > > > > MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP
> > > > > >
> > > > > >
> > > > > > Andy wrote:
> > > > > > > Hi Pa Bear,
> > > > > > >
> > > > > > > Thanks for the response.
> > > > > > >
> > > > > > > Internet Explorer will open, but instead of immediately
> > > > > > > opening the home page as one would expect it simply displays
> > > > > > > a white screen as it trys to load the page. After about 30
> > > > > > > seconds it says 'Page Cannot be Displayed.'
> > > > > > >
> > > > > > > One thing I notice is that the progress bar of Explorer
> > > > > > > (bottom left of the browser) where it would ordinarily tell
> > > > > > > you 'opening page www.google.co.uk' now says says seems to
> > > > > > > display the IP address of the homepage.
> > > > > > >
> > > > > > > I haven't touched the connection settings from before I
> > > > > > > installed the updates so it can't be that!
> > > > > > >
> > > > > > > "PA Bear" wrote:
> > > > > > > > Care to expand on "Internet Explorer stopped working"
> > > > > > > > (e.g., IE doesn't load, IE loads but doesn't connect, IE
> > > > > > > > loads & connects but generate errors)?
> > > > > > > > --
> > > > > > > > Andy wrote:
> > > > > > > > > I have two servers, both running Windows 2000 Small
> > > > > > > > > Business Server.
> > > > > > > > >
> > > > > > > > > After routinely downloading the relavent Hotfixes from the
> > > > > > > > > Windows Update website, I restarted to find that Internet
> > > > > > > > > Explorer stopped working from the server computer.
> > > > > > > > >
> > > > > > > > > All the client machines work, but I can no longer check
> > > > > > > > > the internet from the server.