1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Iexplore Not Responding

Discussion in 'Earlier Versions of Windows' started by GOOF, Feb 4, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    I have been having several issues with my computer lately. System performs was running low so I added memory. This did not seem to change the system performance. When the memory was first installed IE ran fine.
    Now when I launch internet explorer it takes forever to load. If I check it in task manager it shows as not responding. It will eventually load and works ok once it is up. If I try to open a link that opens a new window the same thing happens.
    Email is also slow to load (outlook express). The program will open quickly without messages & then finally loads them. On occasion my tab key will change function and when pressed opens & closes windows rather than performing a tab function.
    This is probably more than you need to know, but wanted to give as much info as possible. I am running windows ME.
    Any help would be greatly appreciated.

    After I posted this I ran ad-aware, Spybot & ActiveScan.

    IE seems to be a bit better but I figured I would post the ActiveScan & hijack this for input.
    Thanks for your help.

    ActiveScan Results:


    Incident Status Location

    Adware:adware/windowenhancer Not disinfected c:\windows\system\SBUtils
    Spyware:Cookie/RealMedia Not disinfected C:\WINDOWS\Cookies\hp authorized [email protected][1].txt
    Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\WINDOWS\Cookies\hp authorized [email protected][1].txt
    Spyware:Cookie/Searchportal Not disinfected C:\WINDOWS\Cookies\hp authorized [email protected][1].txt
    Spyware:Cookie/BurstNet Not disinfected C:\WINDOWS\Cookies\hp authorized [email protected][2].txt
    Spyware:Cookie/BurstBeacon Not disinfected C:\WINDOWS\Cookies\hp authorized [email protected][1].txt
    Spyware:Cookie/Com.com Not disinfected C:\WINDOWS\Cookies\hp authorized [email protected][1].txt
    Adware:Adware/WindowEnhancer Not disinfected C:\WINDOWS\SYSTEM\SBUtils\SBWebCtl.dll
    Virus:Trj/Clicker.WX Disinfected C:\WINDOWS\115252174116.exe
    Virus:Trj/Clicker.WX Disinfected C:\WINDOWS\winsys.exe
    Potentially unwanted tool:Application/KillApp.B Not disinfected C:\HP\bin\KillIt.exe
    Hacktool:HackTool/ProcLog.A Not disinfected C:\HP\bin\ProcessLogger.exe
    Virus:Trj/Reboot.F Disinfected C:\HP\bin\Rebooter.exe
    HiJack This Log:

    Logfile of HijackThis v1.99.1
    Scan saved at 11:43:42 PM, on 2/4/2007
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\PROGRAM FILES\MCAFEE.COM\VSO\MCSHLD9X.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
    C:\PROGRAM FILES\MCAFEE.COM\VSO\OASCLNT.EXE
    C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
    C:\PROGRAM FILES\MCAFEE.COM\MPS\MSCIFAPP.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
    C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
    C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
    C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
    C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCTSKSHD.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\PROGRAM FILES\MCAFEE\SPAMKILLER\MSKAGENT.EXE
    C:\PROGRAM FILES\MCAFEE\SPAMKILLER\MSKSRVR.EXE
    C:\PROGRAM FILES\CANON\MULTIPASS\MONITR32.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE
    C:\UPS\UOWS\MESSAGES\WSDMESSAGING.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\BACKWEB\BACKWEB\PROGRAM\BACKWEB.EXE
    C:\WINDOWS\SYSTEM\SPOOL32.EXE
    C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us2.hpwis.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us2.hpwis.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://us2.hpwis.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us2.hpwis.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us2.hpwis.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us2.hpwis.com
    O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - C:\PROGRAM FILES\MCAFEE.COM\MPS\MCBRHLPR.DLL
    O2 - BHO: McAfee PopupKiller - {3EC8255F-E043-4cae-8B3B-B191550C2A22} - C:\PROGRAM FILES\MCAFEE.COM\MPS\POPUPKILLER.DLL
    O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - C:\PROGRAM FILES\MCAFEE\SPAMKILLER\MCAPFBHO.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [Delay] C:\WINDOWS\delayrun.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
    O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
    O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
    O4 - HKLM\..\Run: [MCTskShd] C:\PROGRA~1\MCAFEE.COM\AGENT\mctskshd.exe
    O4 - HKLM\..\Run: [MPSExe] C:\PROGRA~1\MCAFEE.COM\MPS\mscifapp.exe /embedding
    O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\MCAFEE\SPAMKI~1\MSKAGENT.EXE
    O4 - HKLM\..\Run: [MSKServerExe] C:\Program Files\McAfee\SpamKiller\MSKSrvr.exe
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\MCAFEE\SPAMKI~1\MSKDETCT.EXE /startup
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [McShld9x] C:\Program Files\McAfee.com\VSO\mcshld9x.exe
    O4 - HKLM\..\RunServices: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
    O4 - Startup: Canon MultiPASS Server.lnk = C:\Program Files\Canon\MultiPASS\monitr32.exe
    O4 - Startup: UPS WorldShip PLD Reminder Utility.lnk = C:\UPS\UOWS\PldReminder.exe
    O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Startup: UPS WorldShip Messaging Utility.lnk = C:\UPS\UOWS\Messages\WSDMessaging.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
    O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\PROGRAM FILES\MCAFEE\SPAMKILLER\MCAPFBHO.DLL
    O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\PROGRAM FILES\MCAFEE\SPAMKILLER\MCAPFBHO.DLL
    O14 - IERESET.INF: START_PAGE_URL=http://hp.my.yahoo.com
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
     
  2. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    Please download the Killbox by Option^Explicit.

    Note: In the event you already have Killbox, this is a new version that I need you to download.
    • Save it to your desktop.
    • Please double-click Killbox.exe to run it.
    • Select:
      • Delete on Reboot
      • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


      C:\WINDOWS\115252174116.exe
      C:\WINDOWS\winsys.exe


    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

    If your computer does not restart automatically, please restart it manually.

    If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.
     
  3. cwolfe98

    cwolfe98

    Joined:
    Jul 11, 2001
    Messages:
    606
    I am having the 100% exact same issues with IE & OE. I have not noticed the TAB key changing functions or anything like that.

    I am running Win XP sp2 & IE 7 ...... just wanted to be sure KillBox is ok with XP before I download & run it.

    Thanks
     
  4. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    Cheesball,
    Thank you for your response. I downloaded killbox & tried to cut and paste the copied files. When I copy the files & use "paste from clipboard" nothing pastes. I tried control c as well as right click & copy.
    If I right click to paste it only places one of the files in the box. Also, in the lower right corner of killbox (under single file/all file button) there are several files listed. Is this right? Why did you suggest deleating these files? I thought active scan took care of them.
    Since running the other programs (spybot, ad-aware & active scan) IE is comming up a little better. I see that the files you spoke about were listed as viruses in active scan & disinfected, is this why the performace is better?
    System resourses continues to be a problem. As an example-On clean boot today system was at 77%. I now have email (outlook express) as well as IE open. System resource is now at 33%. I added 256mb of RAM to correct this with no change. Any ideas on this?
    I appologise for the long post-Just tring to give you whatever info you might need & trying to understand what is going on. I really appreciate your help.
     
  5. cwolfe98

    cwolfe98

    Joined:
    Jul 11, 2001
    Messages:
    606
    Cheeseball,
    I just wanted to be sure I can run KillBox with XP and if the same cut/paste file names apply?? C:\WINDOWS\115252174116.exe C:\WINDOWS\winsys.exe ?? I looked in C:\WINDOWS dir and did not see those in there, or is it something KillBox will create/need??
    Thanks
    CW
     
  6. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    GOOF, please do this...

    1. Please download The Avenger by Swandog46 to your Desktop.
    • Click on Avenger.zip to open the file
    • Extract avenger.exe to your desktop

    2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):


    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


    3. Now, start The Avenger program by clicking on its icon on your desktop.
    • Under "Script file to execute" choose "Input Script Manually".
    • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
    • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
    • Click Done
    • Now click on the Green Light to begin execution of the script
    • Answer "Yes" twice when prompted.
    4. The Avenger will automatically do the following:
    • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    • On reboot, it will briefly open a black command window on your desktop, this is normal.
    • After the restart, it creates a log file that should open with the results of Avenger¬ís actions. This log file will be located at C:\avenger.txt
    • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
    5. Please copy/paste the content of c:\avenger.txt into your reply.

    cwolfe98, if the same files are present on your system then yes.
    But you may very well have a different infection.
    You should make a new thread of your own in our Security forum.
     
  7. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    Cheeseball,
    I followed you steps & downloaded Avenger. When I tried to start avenger I recieved a fatal error: "unsupported version of windows! This progrom will run only on windows 2000 or XP". I clicked ok & then recieved "Error code: 0 could not log error aboprting now!". The computer is acting up today, slow in general and got a "blue screen" when running Spybot. I rebooted and then Spybot ran fine. System is still running slow. Any other ideas ideas?
    Thanks again for your help.
    Goof
     
  8. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    Ack I forgot you were running ME.

    How much memory does this system have?
     
  9. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    Cheesball,
    Good to catch you online. This system came with 128mb of Ram. I recently added 256mb which did not seem to help at all. As an example, It had 67% of resourses at startup before memory & system resouses at startup went to 69%. Not much improvement...
     
  10. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    Cheeseball,
    Oops, guess I should have used spellchecker on my last post...I forgot to mention to you. The % I gave you are with nothing open. Right now I have e-mail & Ie open & system resources are at 36%.
    Also, MCaffee has been comming up with "PUP" errors the last couple of days. The files are as follows:

    HP\internet\surfboard\killwind.exe
    HP\bin\fondle\window.exe
    HP\bin\killwind.exe
    HP\bin\terminator.exe

    It also has picked up things like prockill-t, hidewindow, prockill-term. I have not taken action on these files because I was not sure what they were especially with HP being in the filename. Some of them may have been removed with the scans with Adaware, Spybot & Activescan. I must confess that Mcaffe is currently expired and has not been updated.
     
  11. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    Cheeseball,
    A couple more questions for you. I am not the brightest bulb when it comes to computer issues. Can you tell me why, if active scan removed these viruses why do we still need to delete those files (C:\WINDOWS\115252174116.exe C:\WINDOWS\winsys.exe)? Are theey still lurking somewhere?
    Also, what is the best way to delte the avenger program that you had me download?
    Thanks again,
    Goof
     
  12. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    It disinfected them but I wanted to be sure they actually got removed too.

    All of those HP tools get detected by AV programs mainly because they are applications that can terminate other applications. They are not viruses or anything. Just 'risk tools' but nothing to be concerned about. They were bundled with HP.
     
  13. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    Cheesball,
    Thanks for the info on the HP files. How do I remove Killbox & Avenger?

    Next, Computer running slow again. I removed mcaffe & downloaded AVG. It found the following problems:

    C:\Restore\Temp\A0130497.CPY
    C:\Restore\Temp\a0130500.CPY

    Both are listed as trojan horse clicker.EBL
    AVG listed them as "infected"

    AVG also found:
    C\windows\svhost.dll
    AVG lists this as deleted

    I am now lost. Where do I go from here?

    Thanks for your help.
    Goof
     
  14. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    You can manually delete KillBox and Avenger.

    Now turn off System Restore:

    Click Start, Settings, and then click Control Panel.
    Double-click the System icon. The System Properties dialog box appears.

    NOTE: If the System icon is not visible, click "View all Control Panel options" to display it.

    Click the Performance tab, and then click File System.
    Click the Troubleshooting tab, and then check Disable System Restore.
    Click Apply then OK.
    Click Yes, when you are prompted to restart Windows.

    Once you have cleaned the virus or other problem from the computer, reenable System Restore by following these directions

    To enable Windows Me System Restore:

    Click Start, point to Settings, and then click Control Panel.
    Double-click System, and then click the Performance tab.
    Click File System, and then click the Troubleshooting tab.
    Uncheck Disable System Restore.
    Click OK. Click Yes, when you are prompted to restart Windows.
     
  15. GOOF

    GOOF Thread Starter

    Joined:
    Feb 4, 2007
    Messages:
    23
    Cheeseball,
    Virus scan ran before I saw your post today. It found the same Trojan horse clicker, now there were 5 instead of the 2 it found yesterday. Windows\svhost.dll was also found. These are now in the "virus vault" of AVG.

    I went ahead and turned off system restore & ran adaware, spybot, & AVG virus scan-these files did not show up this time. Maybe because they had been removed earlier?

    Anyway, system resourses is still a problem. 80-85% at startup. Drops to 48% with email & explorer open. Explorer slow but opens and is slow to run. Not sure what I should do now...

    Thanks again,
    Goof
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/541151

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice