Custom Version of Internet Explorer

[Rrrbt202]

One of our servers has loaded custom versions of Internet Explorer onto all the computers in the domain. It is through this server that computers connect to the Internet (WAN). Unfortunately this server has been massively infected with viruses and needs to be removed from the network for repair.
Whenever I remove the server, I can ping via IP and name to any site on the Internet, however, I cannot connect to any site using Internet Explorer.
I have tried the repair option and even tried to hack out Internet Explorer from the registry and no matter what, when I reinstall, Internet Explorer still claims to be a custom version and cannot connect to the Internet unless going through the ailing server.
How do I fix this issue without rebuilding every computer on the domain?
I cannot find the customized version on the ailing server.
The servers are running Win NT Server SP 6a.
Thanks

 

[bcastner]

Using a test client:

1. It unlikely is this easy, but delete the HOSTS file under c:\windows\system32\etc

Under IE, Tools, Connections, LAN Settings, uncheck every box there.

I suspect you have been "hijacked" and this may not prove sufficient. Therefore:

2. Run the "Troubleshooting Trinity" exactly in this order:

Hijack This!
Spybot 1.2
AdAware

For each program, use its "Options" to update the definition files prior to doing an actual scan.

All three can be found here:

http://www.spywareinfo.com/articles/hijacked/#removal

Accept the default "fixes" from each program, and stop between programs to see if the issue is sorted.

This should sort the issue. But you really should do #3:

3. Update for antivurus definitions and do a complete scan of your hard disk drives.

4. Now the hard part. You should have a clean test client workstation at this point. It is your choice as to how to proceeed:

i. If you have available restore points on your workstations, it might be best to use these. Pick a point that is early enough to show when things were fine, but not so early as to lose any custimizations the user may have implemented;

ii. or, use the test bed workstation profile and overwrite (copy) the profile to the workstations. If your default profiles are being enforced, then this is the best solution. cf.:

http://support.microsoft.com/?kbid=811151

http://support.microsoft.com/defaul...port/kb/articles/q305/7/09.asp&NoWebContent=1

http://support.microsoft.com/?kbid=314478

and watch out for this issue:

http://support.microsoft.com/default.aspx?scid=kb;en-us;q321281

 

[Rrrbt202]

Thanks for the links to the troubleshooting Trinity. All the computers on the network have been heavily infected with spyware and viruses. All because the owner didn't want to spend a few bucks to update Norton. Have to rebuild the entire network with clean computers. Thanks Again.

 

[jassnaround]

I was hired as a Temp at a small company here and realized after I was there for a little while that none of the PCs had updated virus protection. After I was there a little longer and completed my MCSE classes, I asked for permission to assist with the system there and found out very soon that there was also no virus protection on the network server. I spoke to the owner a few times and finally he decided to pay for Norton Enterprise with licenses for only 10 on the 18 computers on the network. When the server part of the Norton virus program was installed and run, it immediately found 2 viruses. After the clients were installed, it found 6 more viruses. Even so, the owner is reluctant to spend the money for the other computers to be included. What is with this petty cost of the virus program compared to the cost of lost revenue due to system corruption? Hope your boss has learned a valuable lesson. I am not so sure my boss has but at least he is half-way there now.