IE6 freezing intermittently

[aitch]

Hi guys,

I'm new to this forum and not the world's most technical expert so if anyone can speak in relatively non tech jargon it would be appreciated

I have IE6.0.2800.1106 and it keeps freezing - it's really annoying because I have to sit and wait for it to unfreeze as there is nothing else to do.

I've noticed that the little globe at the top right hand corner stops going round when it freezes then it starts again when it unlocks itself.

I have windows millenium, norton antivirus pro 2004 - have done a scan and no viruses found.

I don't know why but the problem started a few weeks ago - until then IE6 had been fine and I didn't do anything else around that time e.g. install anything new etc.

Can anyone help?

best wishes
aitch

 

[Cookiegal]

Hi and welcome to TSG,

Please do this. Click here: http://www.majorgeeks.com/download3155.html to download Hijack This. It’s very important that you save it to its own folder on your hard drive, such as program files (not temporary files or the desktop), so that it can create proper back-ups and be able to restore them if necessary.

Close all open windows and open Hijack This. Click “Scan”. When the scan is finished (it only takes a second), the scan button will change to “Save Log”. Click on “Save Log” and then save it to NotePad. Click on “Edit” – “Select all” – “copy” and then “paste” into the thread.

DO NOT FIX ANYTHING YET, most items that appear in the log are harmless or even needed.

 

[aitch]

Hi Cookie,

Thanks for your help, have done what you suggested and this is the result:-

Have been surfing around and I think that the culprit may be hotbar which sounds like a malicious little bleep bleep - I would like to get rid of it but most places suggest not using 'unistall, add/remove' but using adware or spybot which sounds a bit complicated to me - Norton antivirus has found 35 threats which all have names like adware but I don't understand enough to get rid of them - it suggests clicking on each one and going to Systemac website which then explains what to do but also says that it might result in some programmes not functioning which all sounds too risky to me and is just getting out of my depth.

I thought that buying Norton antivirus pro would be enough but it seems not?

Anyway if you can make sense of the stuff below I would be grateful (and astonished!)

Logfile of HijackThis v1.98.2
Scan saved at 20:28:01, on 05/09/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\ADVTOOLS\NPROTECT.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\WEATHERONTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBINST.EXE
C:\WINDOWS\SYSTEM\CTFMON.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBSRV.EXE
C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/uk/enu/gen/default.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.hotbar.com/dyn/hotbar/3.0/sb_searchPageHome.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = iexplore
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=62.255.0.4:8080
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBHOSTIE.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Hotbar - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBHOSTIE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1629.0\EN-GB\MSNTB.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [TrayX] C:\WINDOWS\winppr32.exe /sinc
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WeatherOnTray] C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\WEATHERONTRAY.EXE
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\ADVTOOLS\ADVCHK.EXE
O4 - HKLM\..\Run: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\Run: [Hotbar] C:\PROGRAM FILES\HOTBAR\BIN\4.5.1.0\HBINST.EXE /Upgrade
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [NPROTECT] C:\PROGRA~1\NORTON~1\ADVTOOLS\NPROTECT.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [TrayX] C:\WINDOWS\winppr32.exe /sinc
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\REALDOWNLOAD.EXE
O4 - Startup: DigiGuide.lnk = C:\Program Files\DigiGuide\client.exe
O4 - Startup: DLHelperEXE.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Dell Home - {EE117DAA-A30B-40FC-945C-38AE1B80C1FA} - http://www.euro.dell.com/countries/uk/enu/gen/default.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .uk/personal/helpandadvice/materials/suppliers/suppliers: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.euro.dell.com/countries/uk/enu/gen/default.htm
O16 - DPF: {970C7E08-05A7-11D0-89AA-00A0C9054129} (XWebCtl Object) - http://activex.microsoft.com/activex/controls/directx/xweb.ocx
O16 - DPF: {9EBE0402-27C2-11D6-A9D5-00500413153C} (DFRun Class) - http://webpdp.gator.com/download/iegator_3090B_webpdpgeneric.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...apple.com/qt505/us/win/QuickTimeInstaller.exe
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/124a40f913c0928dba01/netzip/RdxIE601.cab
O16 - DPF: {0EB73E39-8AD4-43E8-8FBA-0165C2CCDB8B} (GameControl Class) - http://www.midasplayer.com/midasa.cab

 

[Cookiegal]

First of all, you have to move Hijack This to its own folder on your hard drive, as I requested. You have it running from your temporary files.

It’s very important that you save it to its own folder on your hard drive, such as program files (not temporary files or the desktop), so that it can create proper back-ups and be able to restore them if necessary.

Secondly, its best to use Ad-Aware and Spybot to clean up first and then we'll continue on afterwards. It's not complicated. Just follow the instructions step by step. However, if you really don't want to use them, let me know.

Please download and run the following programs:

AD-AWARE

Go here: http://www.lavasoftusa.com/support/download/
and download Ad-Aware SE Personal

Install the program and launch it.

First, in the bottom right-hand corner of the main window click on Check for updates now then click Connect and download the latest reference files.

Then, in the main window: Click Start and under Select a scan Mode tick Perform full system scan.

Then, deselect Search for negligible risk entries.

To start the scan, click the Next button.

When the scan is finished mark everything for removal and get rid of it. (Right-click the window and choose select all from the drop down menu and then click Next)

Restart your computer.

SPYBOT SEARCH & DESTROY

http://majorgeeks.com/download2471.html

Open Spybot Search & Destroy (Click Start, Programs, Spybot S&D (Advanced Mode). Click online, Search for updates, Download all available updates. Close all Browser windows, Click ''Check for Problems''. Anything that needs to be fixed it will show in red and have a green check in the box to the left. Click ''Fix Selected Problems'', Then restart your computer.

Then, after rebooting, please post another log and we’ll see what’s left to get rid of.

 

[aitch]

Hi cookie,

Thanks again for all of that:-

1 - I did save Hijack this to my programme files as you suggested - when I downloaded it it was through realdownload which only offers the option to 'run' - so I didn't do that and instead went into windows explorer and dragged and dropped hijack this into programme files and opened it from there.

It's a compressed file and shows up in the right hand window of windows explorer but strangely doesn't show up in the left hand side within programme files?

Sorry for probably asking you what must be simple questions...

2 - I will download the other stuff now and see what happens.

THANKYOU
aitch

 

[Cookiegal]

C:\WINDOWS\TEMP\TD_0001.DIR\HIJACKTHIS.EXE

The above entry says that it's running from the Temporary files.

Go to the link I provided and you can redownload it from there.

 

[aitch]

Hi,

I have downloaded and run the adware and spybot and gone through all their processes - it's pretty scarey for less techie people when it says things like 'some programs may not work or be corrupted etc etc' - I just clicked on the back up button and hoped for the best!

I also prayed whilst telling it to get rid of all that it had found as I wouldn't know which things to save anyway!

However, all that said - it seems to have improved things and it has got rid of that damn hotbar which I will never go near again!

I will now redownload the hijack software as you suggest - do I need to uninstall the first download first?

I'm going to do that tomorrow anyway as I have had my share of anxiety for today

I'll check your advise tomorrow and then do the download and check the log again.

best wishes
aitch

 

[Cookiegal]

You can delete the old HJT folder or overwrite it with the new one.

 

[aitch]

Ji,

I redownloaded hijack this and put it in program files which is where it was before - I don't understand why it was showing up in the temporary files filder.

It is still a compressed file with a zip on it and doesn't show up in the left hand window of windows explorer. I know nothing about compressed files only that they would take up more room if they were not compressed - before I start opening it and running it can you tell me if I am on track so far and if there is any way I can get it to show up in windows explorer?

best wishes
aitch

 

[Cookiegal]

You have to unzip it and then save it.

When you get the zipped screen, choose "open"

Then choose "unzip or install from Hijack This zip

Then click on the box that says "select different folder"

In the choices that open up double click on C

Then double click on Program files

Click on the little folder beside the dialog box to create a new folder and name it Hijack This and save it there.

Then post the log.

 

[aitch]

Hi,

I really need some help - I have reached the crying with frustration stage - I have downloaded hijack this so many times now and every time I try to start it it tells me that it is being started from a temporary folder and that I need to copy hijack this exe to another folder i.e. programs.

I thought I had done that as I downloaded it in realdownload where it automatically goes to my downloads adn then moved it to a new folder in programmes, but it still gives the same message.

I have tried to delete the bloody thing from wherever I could find it but it's beginning to feel like a virus as it just won't go away so that I can start the download again and I don't have any more technical knowledge - please can you advise?

 

[Cookiegal]

Don't fret about it. We'll go with it the way it is. Please post a current log after running those programs and I'll post further instructions.

 

[aitch]

Thanks for that

But....I am still concerned that there is a programme on my computer that I can't find. When I try to download from the website you suggested it does it really quickly now because it then tells me it is being started from a temporary folder.

I've uninstalled hijack this - I've done a search via windows explorer and deleted everything named hijack this and my computer can't find anything else - but there obviously is.

When the programme launches there seems to be no way to delete it directly either. It only appears after I try to open the file I have saved to program files.

I really would like to know how this can be happening as I do try to learn as I go along and this really worries me that it can happen.

If the answer is so complicated that you can't explain it then I will do another scan as you suggest but I would prefer to get to the root of the problem.

best wishes
aitch

 

[aitch]

I think I have sorted the problem at last after being up for most of the night!

I don't have a zip drive so I couldn't do as you suggested - all I could do was click on 'extract all' and hope for the best - it seems to have created a folder within the zipped one which then has a file in it which says it is the application! - all beyond me...

Anyway it does appear to be in programs now and doesn't tell me that it is launching from a temporary programme et etc.

However the latest problem is that i didn't get a chance to unclick the box you said before the scan is done as it just seems to have done the scan and I don't know if its the old one or a new one - I've saved the log but the scan is just there - it won't let me do a new scan and uncheck the box you suggest etc.

Sorry to keep asking you stuff but I don't know what else to do...

best wishes
aitch

 

[Cookiegal]

Can you post the log you have please.