3

I am getting the above error in IE when trying to download any files.

Steps performed:

  • Reset IE
  • Add-ons disabled
  • Safe mode
  • Run as Administrator
  • Reverted to an older version of IE (8-10) or upgraded to a newer one
  • Removed all security software (AVG, MSE, Norton, Mcafee, etc)
  • Removed Ghost drivers
  • Created/modified Registry Policy for Attachments ("ScanWhenDone" = 1 (off))
  • Scans were done with the following and found NO malicious software (aswMBR, Roguekiller, HitmanPro, MBAR
  • Ran Combofix and I am still unable to download in only IE
  • AdwCleaner, JRT

I am able to download in Chrome or Firefox without issue.

Jan Doggen
  • 4,218
Dan
  • 39
  • Is Windows Defender running? Without any security software installed you obviously can't get such an error. Have you tried resetting IE yet? – Karan May 18 '13 at 15:38
  • Hi Dan! Please register your account here. If you lost your cookie you can't edit your original post anymore, or comment, for that matter. Please see http://superuser.com/help/user-merge once you've signed up here and have the team merge your accounts. Thank you! – slhck May 18 '13 at 20:06
  • Good call on the Windows Defender, never thought of that as who really uses it? All the Windows Defender files have been replaced with shortcuts and the service is messed up. I can fix the registry entries for the service, but how can I reinstall/fix the files?

    sfc /scannow stopped at 96% with Windows Resource protection could not perform the requested operation

    I will see if I can copy the files directly from another Vista x86 machine and what happens with that.

    Any further suggestions are appreciated.

     – Dan May 19 '13 at 02:06
  • 4
    Copying over the files from another Vista x86 machine ended up doing the trick. I was then able to start Windows Defender and downloads were going through. However, I was unable to delete the "en-US" symlinkd folder. Right-click delete returned "access denied" and "rmdir" returned "The directory is not empty" and since the symlinkd points to \System32\config I'm not about to delete that. – Dan May 19 '13 at 02:08
  • possible duplicate of How do I get rid of malicious spyware, malware, viruses or rootkits from my PC? –  Apr 17 '14 at 20:42
  • Did you use rmdir on linkname or the link's target directory? – horatio Apr 17 '14 at 20:48

1 Answers1

1

May be Sirefef infection, see this:

http://deletemalware.blogspot.com/2013/05/file-contained-virus-and-was-deleted.html

steved
  • 49