Dial-up connection and IE problem

[milmar]

Hello,
My OS is Windows 2000 and approximately 3 months ago my internet browser (V5.5) and my dial-up connection started acting up.
- My dial-up connection will lock-up after few minutes being connected, making it impossible to disconect. I have to manualy unplug the phone line or turn off the computer to drop the connection.
- While browsing the internet, some links would not respond, others would take me to a wrong destination...
- Ctrl-V/ctrl-C commads do not function.
I am pretty much frastrated enough to reformat my HD and reinstall everything from scratch. However, this would be a very painfull task. Is there a way to avoid this? I ran the repair function for IE in the control panel, but it did not do the trick. Can anybody help, please?

Milmar

 

[cybertech]

Download Hijackthis.
Create a folder on your hard drive and save it there.
Unzip the file and extract it to the folder you have created.
Scan your machine, then click on Save Log.

Post a copy back here and someone will be happy to review it.

Don't make any changes until instructed to do so.

 

[milmar]

Here it is:
Logfile of HijackThis v1.97.7
Scan saved at 3:49:04 PM, on 4/13/2004
Platform: Windows 2000 SP1 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\WINDOWS\System32\mslaugh.exe
C:\WINNT\SYSTEM32\qxaqs.exe
C:\WINNT\SYSTEM32\cccds.exe
C:\WINNT\SYSTEM32\fsdaP.exe
C:\WINDOWS\System32\fqebvsd.exe
C:\WINDOWS\System32\internat.exe
C:\Program Files\SpyKiller\spykiller.exe
C:\Palm\hotsync.exe
C:\WINDOWS\system32\faxsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\drwtsn32.exe
C:\MyDownloads\Tech Forum\HiJack This\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Quotelf] C:\Program Files\Quotelf\Quotelf.exe /s
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [Windows Automation] mslaugh.exe
O4 - HKLM\..\Run: [SNTP] C:\WINNT\SYSTEM32\qxaqs.exe
O4 - HKLM\..\Run: [NTP Server] C:\WINNT\SYSTEM32\cccds.exe
O4 - HKLM\..\Run: [SMT] C:\WINNT\SYSTEM32\fsdaP.exe
O4 - HKLM\..\Run: [Task Managere] fqebvsd.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [TypingSatellite] C:\Program Files\TypingMaster 2001\KBOOST.EXE
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\hotsync.exe
O16 - DPF: {0D6451B3-FDDA-11D3-BFEC-00D0B725EB0B} (Yahoo! Vision) - http://download.yahoo.com/dl/fv/yv.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BE426DD-3F7E-4596-B4B0-61FB9FC19238}: NameServer = 209.226.175.223 198.235.216.134
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BE426DD-3F7E-4596-B4B0-61FB9FC19238}: NameServer = 209.226.175.223 198.235.216.134

Thanks for helping,

Milmar

 

[cybertech]

You've got the blaster worm.

Get Stinger after you run it you must get out to Microsoft and get the updates for your system.


Click here for update site

Post another HJT log after.

 

[milmar]

First, I ran the stinger, it found several .dll and .exe files.
Than, I tried to update my Windows, but no success. The links for the updates were not responding.
I will download it from my computer at work and I'll see if I can do the update from a CD.

 

[cybertech]

Here's the link for the Microsoft Downloads

 

[milmar]

Hi cybertech,
I ran all updates including a Blaster Worm removal.
Here is my HJT after:
Logfile of HijackThis v1.97.7
Scan saved at 9:18:26 PM, on 4/14/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\WINNT\SYSTEM32\qxaqs.exe
C:\WINNT\SYSTEM32\cccds.exe
C:\WINNT\SYSTEM32\fsdaP.exe
C:\WINDOWS\system32\internat.exe
C:\Palm\hotsync.exe
C:\WINDOWS\system32\faxsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\MyDownloads\Tech Forum\HiJack This\HijackThis.exe

O3 - Toolbar: @msdxmLC.dll,[email protected],&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Quotelf] C:\Program Files\Quotelf\Quotelf.exe /s
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [SNTP] C:\WINNT\SYSTEM32\qxaqs.exe
O4 - HKLM\..\Run: [NTP Server] C:\WINNT\SYSTEM32\cccds.exe
O4 - HKLM\..\Run: [SMT] C:\WINNT\SYSTEM32\fsdaP.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [TypingSatellite] C:\Program Files\TypingMaster 2001\KBOOST.EXE
O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\hotsync.exe
O16 - DPF: {0D6451B3-FDDA-11D3-BFEC-00D0B725EB0B} (Yahoo! Vision) - http://download.yahoo.com/dl/fv/yv.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38091.5918634259
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BE426DD-3F7E-4596-B4B0-61FB9FC19238}: NameServer = 209.226.175.223 198.235.216.134
O17 - HKLM\System\CS1\Services\Tcpip\..\{2BE426DD-3F7E-4596-B4B0-61FB9FC19238}: NameServer = 209.226.175.223 198.235.216.134

Thanks,

Milmar

 

[cybertech]

Windows 2000 SP4

These are leftovers from blaster. You may want to run that again before you fix it with HJT. If you do reboot and run yourself a new log and see if these are still there, if so...
Run HJT again and check:

O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe

O4 - HKLM\..\Run: [SNTP] C:\WINNT\SYSTEM32\qxaqs.exe

O4 - HKLM\..\Run: [NTP Server] C:\WINNT\SYSTEM32\cccds.exe

O4 - HKLM\..\Run: [SMT] C:\WINNT\SYSTEM32\fsdaP.exe

O4 - HKCU\..\Run: [internat.exe] internat.exe

Close all applications and browser windows before you click "fix checked".


Restart in safe mode Click here to see how


Open My Computer. Go to Tools, Folder Options and click on the View tab. Make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files". Now click "Apply to all folders"
Click "Apply" then "OK"

Now find these files and delete them.
teekids.exe
qxaqs.exe
cccds.exe
fsdaP.exe


Do you know what this one is?
O4 - HKLM\..\Run:[Quotelf] C:\Program Files\Quotelf\Quotelf.exe /s

 

[milmar]

Hi Cybertech,
Did everything as you instructed and it all went smooth. All my problems are gone.
You are a briliant tech support.
I will make a financial contribution on Affero website.

Note: Quotelf is an application that I use to download stock prices data onto my PC to do technical analysis. It is OK.

Thanks,

Milmar

 

[milmar]

Hey 'cyber',
I have another task for you, would you be able to help me with this one?
This is my computer at work. It has Windows XP, Office XP, and IE 6.0.
Approximately 3 months ago a "Run-time error '91' - Object variable or With block not set" started to pop out after clicking on a link to any office file on the web. It happens every time the browser needs to use a Word or Excel plug-in to open the document.
My OS is up-to-date and there is a McAfee VirusScan v4.5.1 SP1 running on the machine. (I hate this McAfee with passion, but I must keep it...)
Here is the HJT:
Logfile of HijackThis v1.97.7
Scan saved at 10:08:14 AM, on 4/16/04
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe
C:\WINDOWS\System32\crypserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
C:\Program Files\Compaq\Easy Access Keyboard\MMKeybd.exe
C:\Program Files\Compaq\Easy Access Keyboard\MEDIACTR.EXE
C:\WINDOWS\kdx\KHost.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Compaq\Easy Access Keyboard\MMUSBKB2.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Palm\hotsync.exe
C:\Lotus\Notes\NLNOTES.EXE
C:\Lotus\Notes\naldaemn.EXE
C:\Lotus\Notes\nhldaemn.EXE
C:\Program Files\Adobe\Acrobat 5.0\Acrobat\Acrobat.exe
C:\Program Files\Common Files\Adobe\Web\AOM.exe
C:\Program Files\Microsoft Office\Office10\POWERPNT.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Palm\palm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\MyDownloads\Tech Forum\HiJack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asm.osh.mid.gmeds.com/main.asp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://autoproxy.gm.com
O1 - Hosts: 207.44.240.65 ads.x10.com
O1 - Hosts: 207.44.240.65 images.x10.com
O1 - Hosts: 207.44.240.65 count.exitexchange.com
O1 - Hosts: 207.44.240.65 servedby.netadvertising.com
O1 - Hosts: 207.44.240.65 images.trafficmp.com
O1 - Hosts: 207.44.240.65 ad.uk.doubleclick.net
O1 - Hosts: 207.44.240.65 ad.ca.doubleclick.net
O1 - Hosts: 207.44.240.65 ads.specificpop.com
O1 - Hosts: 207.44.240.65 ads.specificclick.com
O1 - Hosts: 207.44.240.65 ads.popupsponsor.com
O1 - Hosts: 207.44.240.65 adfarm.mediaplex.com
O1 - Hosts: 207.44.240.65 media.fastclick.net
O1 - Hosts: 207.44.240.65 media1.fastclick.net
O1 - Hosts: 207.44.240.65 media19.fastclick.net
O1 - Hosts: 207.44.240.65 media28.fastclick.net
O1 - Hosts: 207.44.240.65 media29.fastclick.net
O1 - Hosts: 207.44.240.65 media39.fastclick.net
O1 - Hosts: 207.44.240.65 adserv.internetfuel.com
O1 - Hosts: 207.44.240.65 www.satellitepop.com
O1 - Hosts: 207.44.240.65 count.exitexchange.com
O1 - Hosts: 207.44.240.65 z1.adserver.com
O1 - Hosts: 207.44.240.65 view.atdmt.com
O1 - Hosts: 207.44.240.65 servedfor.valuead.com
O1 - Hosts: 207.44.240.65 banners.valuead.com
O1 - Hosts: 207.44.240.65 img.mediaplex.com
O1 - Hosts: 207.44.240.65 ln.doubleclick.net
O1 - Hosts: 207.44.240.65 m2.doubleclick.net
O1 - Hosts: 207.44.240.65 m.doubleclick.net
O1 - Hosts: 207.44.240.65 ad.doubleclick.net
O1 - Hosts: 207.44.240.65 media28.fastclick.net
O1 - Hosts: 207.44.240.65 media39.fastclick.net
O1 - Hosts: 207.44.240.65 media.fastclick.net
O1 - Hosts: 207.44.240.65 popuptraffic.com
O1 - Hosts: 207.44.240.65 leader.linkexchange.com
O1 - Hosts: 207.44.240.65 rad.msn.com
O1 - Hosts: 207.44.240.65 view.atdmt.com
O1 - Hosts: 207.44.240.65 iv.doubleclick.net
O1 - Hosts: 207.44.240.65 focusin.ads.targetnet.com
O1 - Hosts: 207.44.240.65 a.tribalfusion.com
O2 - BHO: (no name) - {00F16DC8-1B2A-42F4-B18B-E21DA9D2D7FD} - C:\PROGRA~1\COMMON~1\IESERV~1\01A00.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {31995C64-CB4D-483E-82C2-CCFFE2F66CAB} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ChkAdmin] C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE
O4 - HKLM\..\Run: [EASY ACCESS KEYBOARD] C:\Program Files\Compaq\Easy Access Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\hotsync.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\SW\DTR Royalty Free\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - http://components.metastream.com/MTSInstallers/MetaStream3.cab
O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.solid-edge.com/CFIDE/classes/CFJava.cab
O16 - DPF: {1D870C86-AA3C-4451-81E4-71D480A1A652} - http://216.93.172.116/sub2bc.exe
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://66.163.7.112/activex/AxisCamControl.ocx
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37876.1638773148
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab

Thanks,
Milmar

 

[cybertech]

Sure I'll try to help, but it'll cost you double

Run HJT again and check:

Check all of the O1 entries
O2 - BHO: (no name) - {00F16DC8-1B2A-42F4-B18B-E21DA9D2D7FD} - C:\PROGRA~1\COMMON~1\IESERV~1\01A00.dll
O2 - BHO: (no name) - {31995C64-CB4D-483E-82C2-CCFFE2F66CAB} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {1D870C86-AA3C-4451-81E4-71D480A1A652} - http://216.93.172.116/sub2bc.exe
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab

Close all applications and browser windows before you click "fix checked".

Delete this folder C:\PROGRA~1\COMMON~1\IESERV~1


If it's ok with your company I would suggest running Spybot on this machine.

Download Spybot http://www.sherrylynn.us/privacypolicy.htm

Make sure to follow the instructions for updates prior to running the scan.

Click on "Search For updates" After the search has completed, the available Updates will be listed. Choose which Updates you would like to Download. Click "Download updates." The Updates will self install. The screen will change and the program will come back and be ready to use.

Sometimes the default Download Location will produce an Error. If that happens, look in the right panel. There you will find a small arrow next to the name of the current Download site. Click on it for a list of alternate sites. One of those should be able to retrieve the files you have selected.

Scan, click on fix problems then reboot.

 

[milmar]

Thanks 'Cyber',
The PC works well after I followed your instructions.

Can you tell what went wrong, and what does "Run-time error '91'" means?

Milmar

 

[cybertech]

No I don't know what that error is about. I would look in the event logs and see if there is something more in there to help track it down. Does this happen to other people or just you? Does it happen in other profiles on this same machine or just yours?

 

[milmar]

I am sure it is happening to other people as well. I checked it on Internet via Google. It seems like one of the spy ware had a poorly written VB code. Supposedly it is an error message in Visual Basic.

This answer I found on this website:
http://www.maximal-usa.com/optimax/tutorial/Session1.html

Run-time error '91': Object variable or With block not set
This error message normally means one of two things:

1) That you have forgotten to use the Set keyword before assigning an object variable. For example, in the code you entered, both MPL and planModel are object variables that can only be assigned using the Set keyword. To fix this, press the Debug button and then verify that the assignment in the line starts with the Set keyword.


2) That you are referring to an object variable that was correctly assigned before. Please check to see if the variable was not correctly declared with a Dim statement and then assigned with a Set statement.