[dba-Tech] Compromised Internet Explorer?

John,

Since I posted that message I've dinked with this system some more. My
money is now on the possibility that my wife's friend has an
unauthorized copy of XP. The Windows CD she gave me was a copy and the
25-digit key was written on it. She said she got it from an IT friend
of hers.

I use Norton Ghost on my C: drive to back up the entire thing to my D:
drive on a regular basis. I was curious to know if I could just swap
the cables, reset the jumpers, and boot up with the Ghosted drive. But
Windows detected that it was a different hard disk and wouldn't let me
start up at all. This situation is different, but I wonder if it isn't
because of the copied Windows XP.

I will certainly try your suggestion of downloading the necessary
updates on another PC and burning them to CD.

You know, there was one other odd behavior I noticed. Yesterday I
thought, well, maybe IE is infected somehow. I couldn't find a way to
un-install it from the list of installed software. So I thought I'd
try renaming the EXE file. I did so; but a few seconds later the
program re-appeared in the program folder before my very eyes. It's
dated sometime in August of last year. I deleted the new copy of
IE...but a few seconds later, there it reappeared again. Is that
normal?

Thanks, John.

Steve Erbach

On 5/5/05, John Bartow <john at winhaven.net> wrote:
> Steve,
> Sounds like you've run the gamut! In really bad cases (I've got two sitting
> here now) I run multiple Spyware detectors (after the initial Trend-Micro,
> MS-AS) and then manually remove the detections (if the free version won't do
> it). Panda, CA, X-Cleaner, Norton, F-Secure, Ad-Aware, Spybot S&D, Webroot,
> CheckPoint(Zone Alarm), Aluria. Can all be run one at a time (or many at the
> same) so I just do that while I'm working on other things.
> 
> Have you booted into safe mode and tried resetting the windows update
> settings as the administrator account? Also try the repair feature of IE.
> Turn off the software firewall and set the IE settings back to the defaults.
> (I'm assuming you're behind a router/HW firewall.) Try running the updates
> after that. Also try a registry optimizer on it if you have one. Systemworks
> or Vcom, etc. or try http://www.pcpitstop.com/pcpitstop/default.asp if you
> don't.
> 
> You could also download the updates from another PC using the Windows Update
> Catalog. I used to make CDs of all the updates once a month or so and then
> use the CD with dial-up customers. It was kind of putsy but better than
> waiting for dialup downloads (Thankfully most of my customers have DSL now!)
> 
> Another possible issue - NAV 2005 has some major quirks about it. Up until
> 2004 it was my top recommendation for home users (or NIS) but I have run
> into many issues with it and unfortunately Symantec's answer always seems to
> come down to "uninstall all Symantec software and re-install". I would
> suggest uninstalling it. I suggest, if its OK with your friend, that you try
> AVG or another free for personal use AV. For home users I now recommend
> AVG/Sygate personal firewall and MS-AS (which I don't care for but hey, its
> free and it works pretty good).
> 
> Anyway, there's my 2 scents...
> 
> John B.
> 
>