Had a rundll error, was infected, cleaned, attached HJT, still no IE

[CJG]

Log attached

[attachment deleted by admin]

[evilfantasy]

I suggest uninstalling RegCure. It is not a trusted program.

Can you connect now?

[CJG]

RegCure 1.5.2.7 was successfully removed from my computer.

But I still can not access the internet through IE.

[evilfantasy]

Default Security Settings

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press Enter. When Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

NOTE: If it's Grey then it's already at the default level.

----------

How about now?

Also have you tried turning off your firewall and trying to connect?

[CJG]

Still no luck, I turned off the firewall and no change.

I haven't re-booted today - shall I do that?

[evilfantasy]

Yes. I thought you would have done that a few times by now.

Let me know.

[CJG]

 

Still no luck.

[evilfantasy]

Does this behavior persist if you start IE7 in No Add-ons mode?

IE7 in No Add-ons mode

1. Right-click on the blue IE desktop icon and select Start without Add-ons;

2. Start > (All) Programs > Accessories > System Tools > Internet Explorer
(No add-ons).

[CJG]

yup

[evilfantasy]

I'm running out of ideas here...

Download HostsXpert

• Unzip HostXpert to your Desktop
  
• Be sure to Right click HostsXpert and choose 'Run as Administrator'
  
• Open up the HostXpert program.
  
• Make sure that the "Make Hosts Writable?" button in the upper right corner is enabled.
  
• Click Create Back Up
  
• Then click on Restore Microsoft's Host Files
  
• Close the HostXpert program

.
Note: if you use SpywareBlaster, Spybot and/or IE-SPYAD, it will be necessary to re-install the protection they afford. For SpywareBlaster, run the program and select Enable all protection. For Spybot run the program and select Immunize. For IE-SPYAD, run the batch file and reinstall the protection.

Try IE again.

[CJG]

I did the HostXpert and ran as an Administrator.  The Make Hosts Writable button was in the upper left hand corner (might be a different version).

I tried IE again and no luck, but then I tried IE with add-ons disabled and it worked!!!

You may have been running out of ideas . . . , but you were still able to get it to work.

Thank you, thank you, thank you . . . your help was the ticket!!!

(Now what exactly is "add-ons" and can I turn them back on later?)

Crispin

[evilfantasy]

OK you have an add-on that is causing this.

First open IE with no add ons and then go to www.windowsupdate.microsoft.com and check for then install all available updates (if any). Then try again normally. If it doesn't work then you will need to find which add on is causing the issue and remove or disable it.

There is a link HERE that explains how to troubleshoot add ons.

An alternative is to create a new user account and see if IE works OK in it. If so then you can transfer files and settings to the new account.

[CJG]

Appears to be working great. 

You are awesome!

[evilfantasy]

OK once you get set we need to run another scan to be sure there is nothing else hiding. I'm not sure what it is that caused that to happen and usually running the malware removal steps fixes that issue so better safe than sorry.

Use the Kaspersky Lab Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.

• Click on SCAN NOW
  
• Click Accept.
  
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
  
• The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

Copy and paste the Kaspersky Online Scanner Report in your next reply.

Note for Internet Explorer 7 and 8 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

If needed, this animation will guide you through the process.

[CJG]

Before I saw your response, we had updated the machine to IE 8 (could be the new host of issues bellow).  I guess I was in a state of euphoria about having the internet back and it was working (I let that cloud my judgement and I dashed all comon sense and downloaded IE8).

Well Kaspersky did not like my machine.  It stated that I need to have a version of JAVA higher than 1.6 or something (I had installed the latest version prior V6 update 13), but when I went to Sun's website to test Java it did not work.  It said I needed to enable Java through your web browser

Tools --> Internet Options --> Advanced Tab, check the box next to Java . . . here's where it got a little more interesting . . . there is no enable Java section or checkbox.

So I went to the the add remove space and removed all java applications (including older versions) and then reinstalled it.  Thinking this would self correct.  In the middle of Installing Java I get a SECURITY ALERT window that states, "Revocation information for the security certificate for this site is not available.  Do you want to proceed?"  My choices are Yes, No, View Certificate

Under View Certificate it states:

Issued to sjremetrics.java.com
Issued by Sun Micro . . .
Valid from 1/7/2009 to 2/2/2011

I then have two more choices:

Install Certificate . . .
Issuer Statement (this is just an info box)

but the install certificate takes you to an Import Wizard - I chose the defaults and selected import (it responds with import was successful).

So I click Okay and it brings me back to my security alert (mentioned above): revocation information . . Do you want to proceed? - I now choose yes.  It then brings up a box stating that I have successfully installed Java.  Upon Clicking Finish - it says that JAVAFX will automatically install as well.

I then go back to the Java Test window and again it is not working.  I then recheck the internet options --> Advanced --> scoll to find enable java check box.  No beans   

I then go to the manage add-ons and I see that Java is enabled, but the publisher is (NOT VERIFIED).

I have rebooted and checked the Internet Options once again - still no luck.