not my blog

Been getting a lot of questions recently about a new issue that has been creeping up with calls we have been doing at work regarding spyware removal. The issue, after removing a bunch of spyware and whatnot you start getting a repeating error to the effect of:

Internet Explorer has encountered an error and needs to close.

It looks fairly official, but there is no submit this problem to Microsoft option (I believe this is the case, but it has been two weeks since I ran into this). The other interesting thing is, IE works fine through all of this, even click the OK button that is in the dialog box does not cause it to close. As of this moment, I do not know of any anti-spyware/virus application that can detect this problem. Tools that were used to clean the machine I found this problem on include:

• AV Personal
• Norton 2003 - not used but was installed on the system
• Ad-aware
• Spysweeper
• Microsoft Anti-Spyware
• HijackThis!
• Ewido Security Suite

So none of these removed this issue, so once the machine was finally clean I went searching for the culprit. Checking the event log I found the problem. There were numerous entries in the Application log that mentioned a specific file that had kept erroring out. Looked like a piece of spyware, as the name seemed fairly random.

Ran a check of the registry for any entries relating to this file. Came up blank, nothing there. Ran a search for the file, found it and deleted it. No more error message. YAH! Unfortunately being as how this was during a service call I didn’t have any time to really try to hunt down where this thing was latched into the OS to try and figure out what was going on there, but the issue went away and the client was happy. In the end, that is what is important.

If anyone has any information that could give me a better understanding of where this thing is in the OS it would be greatly appreciated. With any luck I might get this again soon, as 4 of the other guys that I work with have run into since I had my experience with it, so maybe soon there will be more information to share.