Expert: Lorry - 3/14/2006

Question
-------------------------
Followup To
Question -
Something had taken over my Internet Explorer.

These are the symptoms:
- When I search using Google I get redirected to other sites, mostly REDZIP, UPSPIRAL, STOPZILLA and EBAY.
- In many web pages, the top, right corner of my web page curls down to reveal a search engine.  This only happens when my security level not set to high.

I've tried the following remedies while in Safe Mode:
Ad-Aware SE Personal
AVG Free Antivirus
CounterSpy
CWShredder
RegCleaner
CCleaner
SpybotSD
HijackThis

And still it remains!

I'm using Internet Explorer 6.0.

Any help you can give me will be appreciated!

Thanks!


Answer -
Hi Richard,

Did you check for updates before running Spybot and/or Ad-aware SE? If running Windows XP, you might want to disable System Restore also before running scan.

Check out the following for information:

http://spyware-removal.thrcomputer.com/how-to/remove-redzip-toolbar.html

http://www.symantec.com/avcenter/venc/data/adware.upspiralbar.html

Hope this helps!
Lorry

Lorry,

Thanks for your help.  I have used updated versions of all the spyware removal programs.  No use.

I've also used the symantec removal tool.  It didn't help.

I did this with system restore disabled.

I don't have the redzip or upspiral toolbar.  I just keep getting hijacked from Google to those sites (and others).  I also still have the page curl.

Is there a way to remove, then reinstall Internet Explorer?

Any other suggestions?

Thanks, Richard.

Answer
Hi Richard,

Even though you have AVG installed, with Internet Explorer, go to:

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym

Click the GO button, then under Virus Detection, click Start. You might be told that you need to download and install ActiveX Controls for the scan to work, answer Yes.

Write down exactly anything it finds, then go to: http://www.symantec.com/search/  and do a search for what was found. Symantec usually has a removal tool and/or directions for removing manually. Make sure that you follow the instructions for removal, step by step, especially the part regarding disabling System Restore.

Hope this helps!
Lorry