This has really bamboozled me

[Monkey muppet]

It first started as the usuall tech support question from the Parents: "I can't get into Hotmail"

Well to cut a short story long.

The Hotmail login page is being displayed as blank and registering as "done", plus Ebay is only displaying in HTML. Therefore I'm going to assume Java is a fault here.

This is affecting Internet Explorer, Firefox, Netscape & Opera.

I've tried creating new profile under the browsers which support it, I've got the latest versions, I've uninstalled Java, reinstalled it, cleared all browsers of cashe, off-line files, etc, etc.

I've run three different virus scans, anti-spyware and malicious ware programs all in safe mode.

The best I've managed to get is FF telling me that the site requires Java to display (if I disable Java from the options, it doesn't tell me anything if it's enabled - Just a blank page).

Microsoft on-line support suggests installing the scripting thingy - which makes no difference.

All other PC's on the home LAN or not affected

Oh yeah - Can't update Windows either!!! (yes it is a genuine version of XP pro).

Any ideas on what to try next???

 

[mechBgon]

1) What three virus scanners have you tried, brand and version?

2) Any intel on what might've brought this on ("I opened an email and opened the attachment and ran what was inside the zip file" or whatever)

3) Tried WinSockFix?

4) Were there any spywares or viruses detected when you scanned, any meaningful stuff? If so, what was found? (names help here)

 

[Monkey muppet]

1) The PC normally runs with Zonealarm (full version bought - updated to whatever is the latest), AVG free, Spybot and Ad-ware. I've installed Symantec Norton Anti-Virus 2005 and Panda 2004 (both I've bought for tracking down problems like this).

2) Being one of 3 family PC's used by 17yrs sister (MSN, WinMX), 15yrs brother (experimenting with flash), an 8 year old and Parents - the answer is probably yes (but which family computer is ever 100% secure from rogue clicks)

3)No, will investigate it's use and try tomorrow

4) The only thing picked up are the compressed files used by the Java installs by AVG (no tracking cookies or anything else)

 

[mechBgon]

Originally posted by: Monkey muppet
1) The PC normally runs with Zonealarm (full version bought - updated to whatever is the latest), AVG free, Spybot and Ad-ware. I've installed Symantec Norton Anti-Virus 2005 and Panda 2004 (both I've bought for tracking down problems like this).

Let me also suggest this one: right-click this link and Save Target As, it's a text file with further instructions. It runs a one-shot stand-alone McAfee scan and is best in Safe Mode, of course. I think McAfee > NAV2005 in a lot of stuff, so who knows I'm aware of at least one hijacker that affects all Mozilla browsers as well as IE, and McAfee detects that one as Startpage-GT.

2) Being one of 3 family PC's used by 17yrs sister (MSN, WinMX), 15yrs brother (experimenting with flash), an 8 year old and Parents - the answer is probably yes (but which family computer is ever 100% secure from rogue clicks)

WinMX, huh? You could secure it with Limited accounts for all users, my mom's rig is secured beautifully that way... but you'll end up hated by the kids/teens as being the Fun Police :evil:

3)No, will investigate it's use and try tomorrow

4) The only thing picked up are the compressed files used by the Java installs by AVG (no tracking cookies or anything else)

If you didn't try these ones already too, I got links to the Microsoft Antispyware beta, Webroot trialware and WinSockFix on this page. I'd scan with MS AntiSpyware and Webroot in Safe Mode, then run WinSockFix afterwards. Make sure MS AntiSpyware doesn't do any Ignore baloney, and use the Full Scan option. Hopefully that stuff in combination with the McAfee scanner utility will get it sorted. Good luck!

 

[Jeff7]

You might want to tack the standalone version of CWShredder onto the list. I don't know if McAfee is good at killing CoolWebSearch. CWShredder can eliminate most older variants of CWS, and it'll at least cripple the newer variants, allowing for total destruction of the infestation.

 

[Monkey muppet]

thanks for all the replys.

I'll search around for the free versions of what you've been mentioning. and let you know what I find.

I'd like to think that I've missed a little tick box somewhere to enable Java correctly - but I have a feeling that there's something malicious going on.

I'm this > < close from a clean install with limited accounts for everyone - but it's such a pain as I never did get round to doing an image from the first clean install

 

[Monkey muppet]

Originally posted by: mechBgon

Originally posted by: Monkey muppet
1) The PC normally runs with Zonealarm (full version bought - updated to whatever is the latest), AVG free, Spybot and Ad-ware. I've installed Symantec Norton Anti-Virus 2005 and Panda 2004 (both I've bought for tracking down problems like this).

Let me also suggest this one: right-click this link and Save Target As, it's a text file with further instructions. It runs a one-shot stand-alone McAfee scan and is best in Safe Mode, of course. I think McAfee > NAV2005 in a lot of stuff, so who knows I'm aware of at least one hijacker that affects all Mozilla browsers as well as IE, and McAfee detects that one as Startpage-GT.

2) Being one of 3 family PC's used by 17yrs sister (MSN, WinMX), 15yrs brother (experimenting with flash), an 8 year old and Parents - the answer is probably yes (but which family computer is ever 100% secure from rogue clicks)

WinMX, huh? You could secure it with Limited accounts for all users, my mom's rig is secured beautifully that way... but you'll end up hated by the kids/teens as being the Fun Police :evil:

3)No, will investigate it's use and try tomorrow

4) The only thing picked up are the compressed files used by the Java installs by AVG (no tracking cookies or anything else)

If you didn't try these ones already too, I got links to the Microsoft Antispyware beta, Webroot trialware and WinSockFix on this page. I'd scan with MS AntiSpyware and Webroot in Safe Mode, then run WinSockFix afterwards. Make sure MS AntiSpyware doesn't do any Ignore baloney, and use the Full Scan option. Hopefully that stuff in combination with the McAfee scanner utility will get it sorted. Good luck!

Firstly I'd like to say thanks, secondly you've quite a few useful links on your page.

I found nothing else at all (except 2x tracking cookies).

I managed to resolve the issue by removing all the objects loaded up within IE under the temp internet files (IE must've left a config file somewhere when I tried to remove it), then updated Windows.

Now when I visit the sites I couldn't before it loads the appropriate object required to display the page correctly.

No viruses found - it was a click button somewhere whch was overlooked - Arggggg!!!!!!

 

[ITJunkie]

If everything is back to normal than now would be a good time to setup that round of limited accounts