1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

IE6 freezing intermittently

Discussion in 'Web & Email' started by aitch, Sep 5, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    Hi guys,

    I'm new to this forum and not the world's most technical expert so if anyone can speak in relatively non tech jargon it would be appreciated:)

    I have IE6.0.2800.1106 and it keeps freezing - it's really annoying because I have to sit and wait for it to unfreeze as there is nothing else to do.

    I've noticed that the little globe at the top right hand corner stops going round when it freezes then it starts again when it unlocks itself.

    I have windows millenium, norton antivirus pro 2004 - have done a scan and no viruses found.

    I don't know why but the problem started a few weeks ago - until then IE6 had been fine and I didn't do anything else around that time e.g. install anything new etc.

    Can anyone help?

    best wishes
    aitch
     
    aitch, Sep 5, 2004
    #1
  3. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,828
    Hi and welcome to TSG,

    Please do this. Click here: http://www.majorgeeks.com/download3155.html to download Hijack This. It’s very important that you save it to its own folder on your hard drive, such as program files (not temporary files or the desktop), so that it can create proper back-ups and be able to restore them if necessary.

    Close all open windows and open Hijack This. Click “Scan”. When the scan is finished (it only takes a second), the scan button will change to “Save Log”. Click on “Save Log” and then save it to NotePad. Click on “Edit” – “Select all” – “copy” and then “paste” into the thread.

    DO NOT FIX ANYTHING YET, most items that appear in the log are harmless or even needed.
     
    Cookiegal, Sep 5, 2004
    #2
  4. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    Hi Cookie,

    Thanks for your help, have done what you suggested and this is the result:-

    Have been surfing around and I think that the culprit may be hotbar which sounds like a malicious little bleep bleep - I would like to get rid of it but most places suggest not using 'unistall, add/remove' but using adware or spybot which sounds a bit complicated to me - Norton antivirus has found 35 threats which all have names like adware but I don't understand enough to get rid of them - it suggests clicking on each one and going to Systemac website which then explains what to do but also says that it might result in some programmes not functioning which all sounds too risky to me and is just getting out of my depth.

    I thought that buying Norton antivirus pro would be enough but it seems not?

    Anyway if you can make sense of the stuff below I would be grateful (and astonished!)

    Logfile of HijackThis v1.98.2
    Scan saved at 20:28:01, on 05/09/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\DEVLDR16.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\SYSTEM\QTTASK.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
    C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\WEATHERONTRAY.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
    C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBINST.EXE
    C:\WINDOWS\SYSTEM\CTFMON.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\WINDOWS\SYSTEM\LEXBCES.EXE
    C:\WINDOWS\SYSTEM\RPCSS.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBSRV.EXE
    C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.dell.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=62.255.0.4:8080
    O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBHOSTIE.DLL
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBHOSTIE.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1629.0\EN-GB\MSNTB.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
    O4 - HKLM\..\Run: [TrayX] C:\WINDOWS\winppr32.exe /sinc
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [WeatherOnTray] C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\WEATHERONTRAY.EXE
    O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
    O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
    O4 - HKLM\..\Run: [Hotbar] C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBINST.EXE /Upgrade
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
    O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
    O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O4 - HKCU\..\Run: [TrayX] C:\WINDOWS\winppr32.exe /sinc
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
    O4 - Startup: DigiGuide.lnk = C:\Program Files\DigiGuide\client.exe
    O4 - Startup: DLHelperEXE.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE10\EXCEL.EXE/3000
    O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
    O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
    O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.euro.dell.com/countries/uk/enu/gen/default.htm (file missing) (HKCU)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O12 - Plugin for .uk/personal/helpandadvice/materials/suppliers/suppliers: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.euro.dell.com/countries/uk/enu/gen/default.htm
    O16 - DPF: {970C7E08-05A7-11D0-89AA-00A0C9054129} (XWebCtl Object) - http://activex.microsoft.com/activex/controls/directx/xweb.ocx
    O16 - DPF: {9EBE0402-27C2-11D6-A9D5-00500413153C} (DFRun Class) - http://webpdp.gator.com/download/iegator_3090B_webpdpgeneric.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...apple.com/qt505/us/win/QuickTimeInstaller.exe
    O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/124a40f913c0928dba01/netzip/RdxIE601.cab
    O16 - DPF: {0EB73E39-8AD4-43E8-8FBA-0165C2CCDB8B} (GameControl Class) - http://www.midasplayer.com/midasa.cab
     
    aitch, Sep 5, 2004
    #3
  5. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,828
    First of all, you have to move Hijack This to its own folder on your hard drive, as I requested. You have it running from your temporary files.

    It’s very important that you save it to its own folder on your hard drive, such as program files (not temporary files or the desktop), so that it can create proper back-ups and be able to restore them if necessary.

    Secondly, its best to use Ad-Aware and Spybot to clean up first and then we'll continue on afterwards. It's not complicated. Just follow the instructions step by step. However, if you really don't want to use them, let me know.

    Please download and run the following programs:

    AD-AWARE

    Go here: http://www.lavasoftusa.com/support/download/
    and download Ad-Aware SE Personal

    Install the program and launch it.

    First, in the bottom right-hand corner of the main window click on Check for updates now then click Connect and download the latest reference files.

    Then, in the main window: Click Start and under Select a scan Mode tick Perform full system scan.

    Then, deselect Search for negligible risk entries.

    To start the scan, click the Next button.

    When the scan is finished mark everything for removal and get rid of it. (Right-click the window and choose select all from the drop down menu and then click Next)

    Restart your computer.

    SPYBOT SEARCH & DESTROY

    http://majorgeeks.com/download2471.html

    Open Spybot Search & Destroy (Click Start, Programs, Spybot S&D (Advanced Mode). Click online, Search for updates, Download all available updates. Close all Browser windows, Click ''Check for Problems''. Anything that needs to be fixed it will show in red and have a green check in the box to the left. Click ''Fix Selected Problems'', Then restart your computer.

    Then, after rebooting, please post another log and we’ll see what’s left to get rid of.
     
    Cookiegal, Sep 5, 2004
    #4
  6. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    Hi cookie,

    Thanks again for all of that:-

    1 - I did save Hijack this to my programme files as you suggested - when I downloaded it it was through realdownload which only offers the option to 'run' - so I didn't do that and instead went into windows explorer and dragged and dropped hijack this into programme files and opened it from there.

    It's a compressed file and shows up in the right hand window of windows explorer but strangely doesn't show up in the left hand side within programme files?

    Sorry for probably asking you what must be simple questions...

    2 - I will download the other stuff now and see what happens.

    THANKYOU:)
    aitch
     
    aitch, Sep 5, 2004
    #5
  7. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,828
    C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

    The above entry says that it's running from the Temporary files.

    Go to the link I provided and you can redownload it from there.
     
    Cookiegal, Sep 5, 2004
    #6
  8. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    Hi,

    I have downloaded and run the adware and spybot and gone through all their processes - it's pretty scarey for less techie people when it says things like 'some programs may not work or be corrupted etc etc' - I just clicked on the back up button and hoped for the best!

    I also prayed whilst telling it to get rid of all that it had found as I wouldn't know which things to save anyway!

    However, all that said - it seems to have improved things and it has got rid of that damn hotbar which I will never go near again!

    I will now redownload the hijack software as you suggest - do I need to uninstall the first download first?

    I'm going to do that tomorrow anyway as I have had my share of anxiety for today:)

    I'll check your advise tomorrow and then do the download and check the log again.

    best wishes
    aitch
     
    aitch, Sep 5, 2004
    #7
  9. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,828
    You can delete the old HJT folder or overwrite it with the new one.
     
    Cookiegal, Sep 5, 2004
    #8
  10. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    Ji,

    I redownloaded hijack this and put it in program files which is where it was before - I don't understand why it was showing up in the temporary files filder.

    It is still a compressed file with a zip on it and doesn't show up in the left hand window of windows explorer. I know nothing about compressed files only that they would take up more room if they were not compressed - before I start opening it and running it can you tell me if I am on track so far and if there is any way I can get it to show up in windows explorer?

    best wishes
    aitch
     
    aitch, Sep 6, 2004
    #9
  11. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,828
    You have to unzip it and then save it.

    When you get the zipped screen, choose "open"

    Then choose "unzip or install from Hijack This zip

    Then click on the box that says "select different folder"

    In the choices that open up double click on C

    Then double click on Program files

    Click on the little folder beside the dialog box to create a new folder and name it Hijack This and save it there.

    Then post the log.
     
    Cookiegal, Sep 6, 2004
    #10
  12. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    Hi,

    I really need some help - I have reached the crying with frustration stage - I have downloaded hijack this so many times now and every time I try to start it it tells me that it is being started from a temporary folder and that I need to copy hijack this exe to another folder i.e. programs.

    I thought I had done that as I downloaded it in realdownload where it automatically goes to my downloads adn then moved it to a new folder in programmes, but it still gives the same message.

    I have tried to delete the bloody thing from wherever I could find it but it's beginning to feel like a virus as it just won't go away so that I can start the download again and I don't have any more technical knowledge - please can you advise?
     
    aitch, Sep 7, 2004
    #11
  13. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,828
    Don't fret about it. We'll go with it the way it is. Please post a current log after running those programs and I'll post further instructions.
     
    Cookiegal, Sep 7, 2004
    #12
  14. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    Thanks for that:)

    But....I am still concerned that there is a programme on my computer that I can't find. When I try to download from the website you suggested it does it really quickly now because it then tells me it is being started from a temporary folder.

    I've uninstalled hijack this - I've done a search via windows explorer and deleted everything named hijack this and my computer can't find anything else - but there obviously is.

    When the programme launches there seems to be no way to delete it directly either. It only appears after I try to open the file I have saved to program files.

    I really would like to know how this can be happening as I do try to learn as I go along and this really worries me that it can happen.

    If the answer is so complicated that you can't explain it then I will do another scan as you suggest but I would prefer to get to the root of the problem.

    best wishes
    aitch
     
    aitch, Sep 7, 2004
    #13
  15. aitch

    aitch Thread Starter

    Joined:
    Sep 5, 2004
    Messages:
    8
    I think I have sorted the problem at last after being up for most of the night!

    I don't have a zip drive so I couldn't do as you suggested - all I could do was click on 'extract all' and hope for the best - it seems to have created a folder within the zipped one which then has a file in it which says it is the application! - all beyond me...

    Anyway it does appear to be in programs now and doesn't tell me that it is launching from a temporary programme et etc.

    However the latest problem is that i didn't get a chance to unclick the box you said before the scan is done as it just seems to have done the scan and I don't know if its the old one or a new one - I've saved the log but the scan is just there - it won't let me do a new scan and uncheck the box you suggest etc.

    Sorry to keep asking you stuff but I don't know what else to do...

    best wishes
    aitch
     
    aitch, Sep 8, 2004
    #14
  16. Cookiegal

    Cookiegal Administrator Malware Specialist Coordinator

    Joined:
    Aug 27, 2003
    Messages:
    114,828
    Can you post the log you have please.
     
    Cookiegal, Sep 9, 2004
    #15

  17. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/270394

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice