Clicking My Computer restarts Explorer

Windows 2000 Pro SP4

Hi, I have a client how got a nasty infection of Spyware (over 200 items). and ever since, any time you click on a link such as My Computer or Internet Explorer, Windows Explorer just seems to restart. i.e. the screen goes blank (not including the background) and then just goes back to the desktop.


I have removed most of the spyware using spybot, and removed a few viruses also..  

I would like to know if anyone has come across this problem before and if a solution is available without Reinstalling Windows.
LVL 1
maughanbAsked:
Who is Participating?
 
jdeclueConnect With a Mentor Commented:
Sometimes these spyware programs will use an "application hook" into explorer. By doing so they can start themselves whenever explorer runs, but they run under the process of explorer, making it very unstable. Look at the following registry key within regedit.  P.S.  When you look in the key, and see BitBucket and NukeOnDelete, leave them alone, everyone thinks they must be bad but they are part of the operating system. ;)

My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

You would typically see 2 entries; the first being default, and the second being a long string with many characters.

Then look in;

My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations

You should see an entry for Applications, intl and XMLLookup, look to see if there are any others.

If there are any others, post them to the site for me to see. Please...
0
 
CrazyOneCommented:
It comes across like there is still a virus

Double Check for viruses
Online Scanners

 Norton Web Services  
Virus Detection provides an analysis of your results and offers suggestions for further action. It does not examine compressed files or fix infected files.

When Symantec receives notification about a new virus, we develop and post a solution as quickly as possible. We are committed to providing swift responses to all virus threats, including Trojan horses.
http://security.symantec.com/sscv6/vc_about.asp?ax=0&langid=ie&venid=sym&plfid=23&pkj=BSZNTGXIBVEMBQAUWZK

======================
 Trend Micro HouseCall        
http://housecall.antivirus.com/housecall/start_corp.asp

======================
eTrust Online antivirus scanner
http://www3.ca.com/virusinfo/virusscan.aspx
======================

PC Pitstop Virus Scan
When the download completes, you will receive an ActiveX security dialog for the PC Pitstop virus scanner. Click Yes to install the scanner and proceed to the virus scan.

If you are currently running an antivirus package such as Norton Antivirus, it may detect our own virus detection file as a virus. If this occurs and you wish to use our scanner, please (temporarily) disable any active background virus checking software before scanning, or add our signature file (PAV.SIG) to the scanner's file exclusion list
http://www.pcpitstop.com/antivirus/AVLoad.asp
0
 
CrazyOneCommented:
You used SpyBot but use it in conjuction with this product AdAware AdAware
http://www.lavasoftusa.com/
0
 
maughanbAuthor Commented:
Thanks Guys..

CrazyOne - I dispise AdAware. I refuse to use it..
For Virsu Scan I have Used Both AVG and Norton. I cannot use any online services, because when I try to execute a program such as IE it does what I explained above... I presume the problem is to do with spyware/hijackers rather than I virus as such.

jdeclue....  This advice sounds good, I will try it soon and let you know..

Regards
0
 
jdeclueCommented:
Split
0
All Courses

From novice to tech pro — start learning today.