Internet Explorer 6 - Browser Hijack ?

Lindasue · 13th November 2006

Several weeks ago I had a problem with Internet Explorer 6, a runtime error that was resolved.

Now I have a new problem with Internet Explorer 6. After I restored Internet Explorer 6 by removing the Google toolbar, the Internet Explorer 6 page didn't look right. Words were broken up on two lines, and my bookmarks wouldn't work.

My anti virus program (Norton Anti Virus) did it's scheduled scan and detected a trojan, which was quarantined and repaired. Now when I attempt to go to Internet Explorer 6, I get a message that Norton Antivirus has blocked the page as there was a trojan. It said something about browser hijack.

My Norton Antivirus has not found any other spyware or virus on my computer. I've run Adaware and Spybot and they haven't found any further spyware.

I'm currently using Firefox as a browser and have been for about a year, but I would like to also use Internet Explorer for some functions.

Would downloading and installing Internet Explorer 7 resolve the problems I'm having with Internet Explorer 6?

Any suggestions would be appreciated.

Lindasue · 13th November 2006

As a follow-up to my above post, I found the information on the particular trojan that Norton Anti virus found. It's called "Bloodhound" and here's a definition of it:

Bloodhound is a heuristic detection for the HTML Help File Parsing Buffer Overflow. An attacker who exploits this vunerability could perform a denial of service, or potentially execute arbitrary code with the privileges of the the logged-on user. The exploit is triggered by opening the file or visiting a web page that contains the file.

Affects: Microsoft Windows 2000/XP (including SP2)/2003

Files that are detected as Bloodhound Exploit may be malicious.

Bill Castner · 13th November 2006

Start, Run, cmd

Type:

dir %Windir%\tasks /a h > files.txt

Type:
notepad files.txt

In notepad do a Ctrl-A to highlight all of the text. Then do a Ctrl-C to copy the highlight text to your clipboard. Close notepad.

Type:
Exit

Now restart IE, come back to this note in the Forum, and paste (Ctrl-V) into a reply so that I can see your results.

Lindasue · 13th November 2006

Bill,
Thanks for the response to my problem. I followed your instructions, start, run, and then the command, and got an error message stating "The Parameter is Incorrect."

Lindasue

Bill Castner · 13th November 2006

dir %Windir%\tasks /a /h > files.txt

Forgot the "/" before the "h"

What I am looking for are stopped scheduled tasks from your Norton/Symantec Antivirus program.

Lindasue · 13th November 2006

Hi Bill,
I tried it again using your updated search string. I got this message:
"Windows can't find "dir". Make sure you type the name correctly and then try again. To search for a file, click the Start button, and then click Search."

I did a copy/paste of your search string, so I know I entered the string correctly.

Bill Castner · 13th November 2006

Start, Run, cmd

Type:

dir %Windir%\tasks /a /h > files.txt

Type:
notepad files.txt

In notepad do a Ctrl-A to highlight all of the text. Then do a Ctrl-C to copy the highlight text to your clipboard. Close notepad.

Type:
Exit

Lindasue · 13th November 2006

Hi Bill,
I tried again, using a copy/paste of your search string, and got the same message as above: "Windows can't find "dir".

I wonder if I'm not following correctly........I hit start, then run, and then type in the comman string: dir %Windir%\tasks /a /h > files.txt

Am I doing this correctly, or is there another step? If I'm doing it correctly, why does Windows not recognize the search string?

Edited to add that I did a search for "notepad" and the search came up with 18 items on the notepad, but I tried using control A to highlight, control C to copy and control V to past it in this space, but it won't copy.

Bill Castner · 13th November 2006

Start, Run, and type the word cmd

Then in the command session that opens, type the lines I provided.

Lindasue · 13th November 2006

Hi Bill,
I followed directions - start then run, then typed cmd and inserted the search string, and then "notepad files.txt" and the notepad came up. But, it was empty - completely blank.

I know there's material in the notepad, as I did a search on "notepad" and 18 items came up.

I'm using Firefox as a browser. When I attempt to start Internet Explorer 6, Norton AntiVirus has a pop up saying it's blocked due to malware, and asks if I want to proceed. I got that page once, and now I get a pop-up stating that "the page cannot be displayed."

Bill Castner · 14th November 2006

Please see: http://www.pchell.com/virus/bloodhound.shtml

Could you also post back to the Forum the URL of the web site you are trying to visit?

Lindasue · 14th November 2006

Hi Bill,
The background on this problem: About a year ago I tried to access Internet Explorer 6 and got a runtime error stating "This application has requested to terminate it in an unusual way. Please contact the applications support team for more information." I set the time on my computer back a few days when there wasn't a problem with IE6, and downloaded Firefox to use as a browser while trying to determine what was wrong with the IE6.

I wasn't able to resolve the problem. Then just recently someone gave me a link to this board and the problem was resolved by going into add/remove programs and removing the Google toolbar. That allowed IE6 to work again.

When I accessed IE6 for the first time after not being to access it for a little more than a year, the page looked strange with words beginning on one line and continuing on the next. Nothing worked on the IE6 page.

The next scheduled virus scan with Norton Anti Virus detected Bloodhound and quarantined it. The next time I tried to access IE6, I got a pop-up from Norton Anti Virus stating that IE6 had been blocked as it contained a virus.

This is what brought me back to this forum. I'd like to find a way to repair IE6 so I can use it for some applications.

Would downloading IE7 resolve the problem? Or should I go through the steps on the site you linked above? Can I use Firefox to download any Windows updates since IE6 is blocked?

Bill Castner · 14th November 2006

It is not possible to say with certainty what Norton has done. What does seem clear is that you need to reinstall IE.

If you have Service Pack 2 installed, the way to reinstall Internet Explorer is to reinstall Service Pack 2.

Please advise if you are not using Windows XP and Service Pack 2.
Please advise if you do not have a copy of Service Pack 2.
Please advise how you installed Service Pack 2 if you are using it.
Please advise what recovery resources you have: XP CD, "Recovery" CD, nothing.

Lindasue · 14th November 2006

Hi Bill,
I'm using Windows XP with Service Pack 2. About a year after I purchased the computer at Circuit City, the store offered free copies of Service Pack 2 on CD, so I do have Service Pack 2 on CD. I inserted the Service Pack 2 CD and followed instructions to install it. My computer came pre-loaded with Windows XP and I don't have Windows XP on CD or any recovery program.

NOTE: Although I was unable to use IE6 for more than a year, I still got regular Windows updates. I had set the computer to automatic updates, and I would frequently get a Windows pop-up saying "your computer has been updated."

Bill Castner · 14th November 2006

But Norton is saying that Bloodhound has compromised your installation of Internet Explorer.

That is why be reinstalling Service Pack 2 we will repair the installation of IE. Be sure to head to Windows Update when finished.

You can move to IE 7 when this repair is done as well.