Removing what I believe is a virus from a friend's PC

[CalvinHobbes]

Symptoms:
IE cannot access Windows Updates
Trying to access a anti-virus site using IE causes IE to crash

What works:
In safe mode, I can access anti-virus sites but Windows update site still won't load
Firefox works fine with any site I go to

What I've scanned with:
Offline scanners (outside of windows):AVG, Bitdefender and AVIRA
Installed: Symantec 360, MalwareBytes, Kaspersky Removal Tool, Windows MRT
Online scanners: Panda

I found a few possible issue right away with different scanners and removed those files. Nothing big or nothing that screamed "Virus infection"

None of the scanners come up with any hits now so I'm not sure what the issue is unless this issue is just a remnant of an infection.

 

[MadScientist]

Could be one of the viruses/malware you removed messed up your winsock settings.
Download Winsock Fix and run it: http://majorgeeks.com/WinSock_XP_Fix_d4372.html

or here:
http://winsockfix.en.softonic.com/

 

[Devilpapaya]

Could be one of the viruses/malware you removed messed up your winsock settings.
Download Winsock Fix and run it: http://majorgeeks.com/WinSock_XP_Fix_d4372.html

or here:
http://winsockfix.en.softonic.com/

Or just run a few quick commands from commands from command prompt (will need to run as admin on vista/7)

netsh winsock reset
netsh winhttp reset proxy
netsh int ip reset
ipconfig /flushdns

You can also try resetting IE by going to internet options, clicking the advanced tab, and choosing "Reset" near the bottom.

 

[CalvinHobbes]

I found the issue. The virus they had deleted some MSXML files that IE was looking for. I replaced them with files from my PC and it's all working just fine now.

 

[Mr. Pedantic]

In future, you could also use HijackThis!, it might find something that those other scanners didn't.

 

[samgau]

Also a good idea to check the host file:

its in windows\syetem32\drivers\etc

unless you use spybot search and destroy and immunize the system, the host file should only contain 1 line 127.0.0.1 localhost

this might be different in vista or win7 in terms of content...

 

[ScrapSilicon]

Also a good idea to check the host file:

its in windows\syetem32\drivers\etc

unless you use spybot search and destroy and immunize the system, the host file should only contain 1 line 127.0.0.1 localhost

this might be different in vista or win7 in terms of content...

same in vista/7 ..one line in hosts ..not if you're running http://www.mvps.org/winhelp2002/hosts.htm 😉