A while back I must have wandered into a bad, bad site. I was browsing on FireFox, checking some old bookmarks when I noticed a graphics tips site acted odd and locked up (it was also no longer what the title in my bookmarks suggested). FireFox appeared to lock up, I killed it and had to take care of something else. While I know the story is always “I didn’t install anything”, I can honestly say that all I did was go to the site which was almost immediately followed by the lockup.

Regardless, a bit later I heard talking coming from my office.  I at first thought I’d lost my mind and my dogs were having a conversation.  Luckily (or maybe not) I found there were multiple Internet Explorer 7 windows opened and I saw tasks in the system tray running and realized I got hit with something while, I assume, on that page.   I did a clean up with several adware apps, Windows Defender and did a full virus scan which gave me multiple references in my registry and files on my drive (most residing in Windows, System32 or my temp folder). I deleted the files, allowed the programs to do the cleaning process of the registry in addition to me removing a few items listed in both the local user and local machine run keys and rebooted. On reboot, my Anti-Virus reported additional files. I rebooted into safe mode (which I should have done to begin with) and did additional cleaning which rendered little additional finds.   I rebooted again and things seemed to be OK until I attempted to launch IE7 for something (which I don’t use that much). I received the message Windows cannot find ‘C:\Program Files\Internet Explorer\iexplore.exe’.   When I right clicked on the icon, it took me to the path and selected the file, so it was still intact.

A few things I tried: Restoring IE default settings, copying the Internet Explorer folder from a working XP system (thinking iexplore.exe or a dll may have been corrupted or compromised), updating to IE8, uninstalling IE7 from Add/Remove programs and reinstalling, downloading IE7 again and allowed automatic update (which still worked) to install patches and when none of this rendered results, I cursed and screamed loudly at my PC but for some reason this too didn’t resolve the issue.

I had quit worrying about it, for the most part, since it’s the system I use as a media player, storage and a utility PC for backups, etc. and don’t really browse on it.  But it was always there laughing at me, pointing at me and making fun of me!!   So tonight I painted my face, stared the monitor down and said “Prepare for war”….

I started reading a bit more (searching for results from the past month or two) and found a site mentioning a key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe.  I checked and iexplore.exe was pointing to a file in my System32 folder.  I checked my main system as well and found that there was no reference to iexplore.exe… I wanted to make sure it shouldn’t have the actual path before I just removed the key.  Sure enough, I deleted the key iexplore.exe key and Internet Explorer began working again.  There was also mention of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Browser Helper Objects.  I didn’t do anything with this key since I didn’t see anything creating any redirection.  I did, however, backup this branch and delete it.  IE7 still launched without issue but I did notice something set for Google, which I assume is something to do with me having it as my primary search.  I ended up restoring the key since that was one of these ‘objects’.

If you’re having this issue and have ran multiple scanning apps, malware apps, etc. and still having this problem, it’s probably because they aren’t picking up this exe redirection.  So my suggestion would be to export (back up) the iexplore.exe key (if it exists) and then delete it.  I didn’t do any rebooting in between and was able to immediately relaunch IE7 without an issue.  If this doesn’t work, you may also want to (again export first) delete the Browser Helper Objects key as well or see if looks like one of the keys are redirecting.  I’d say (as in I have no experience with this key) the worst that could happen with removing this key is you lose add-ons but it didn’t appear to break anything on mine (at least IE7 worked, the goal right?).  I also didn’t have this key on my primary system.

As always, the disclaimer is to proceed at your own risk and if this breaks something else, I’m not responsible.    I highly doubt it will (but it’s still your fault) and you have a backup (right?)…

I just wanted to share my experience with people who may be banging their head against the desk.  I did a quick search and it looks like this type of thing is on the rise the past few months (based on an advanced date search using Google).  Again, I can’t emphasis enough, ALWAYS back up registry keys you’re going to delete.

There are plenty of sites out there that will help you through the clean up process and I’m sure I could never cover all of them nor do I really want to in this post but here’s a few things to check after you do a clean up and before you get back up and running (if they’re not covered in the clean up process):

• Become a man/woman of faith
• Always go into IE’s properties, make sure your homepage isn’t redirected to a malware page
• Reset IE to default settings.  You can do this by right clicking on the IE desktop icon, selecting Advanced and clicking the Reset button.  Not verified but this should also fix the IE homepage but it’s best to verify the homepage anyway.   This resets every setting that’s changed as well as disabling any add-ons.
• Verify that your firewall is still up and running (it shut mine down when it initially kicked off
• Verify that your Anti-Virus is still running (it disabled mine).

My system seems to be running fine but we’ll see… these issues seem to have wreak havoc on a system that can, while may not be infection, cause other issues.  I intend to actually rebuild it soon anyway but I really wanted to win this war and it had been over a month of occasional trial and error.

Hopefully this helps a few people.    <— Now if I can figure out why WordPress doesn’t always do smilies when  I put them in! Argh… Let me know if it does, would like to hear from you…