Ms Internet Explorer 7.0 Problem

[leicster25]

Hello, Could you help please. When I try to use my internet browser, which is MS Internet Explorer 7.0, I now get a fatal error that stops me in my tracks. It says an un-handled exception has occured and points to WIN32. The system tries to bring up a debugger ( from visual studio ) but i cancel out of that. I have tried to use my Windows update manager to see if I could download any patches for my system, but that fails to connect to the internet.

Have you any ideas ?

Thanks,
Dave.

[TSKThilak]

Since you have IE7.0, I feel there would be a shortcut to start it in safe mode (without plug-in). Give a try :)

[speedster123]

are you using firefox? try aol if you can, firefox reports ie7 as ie5 at times.

[Fren Banklin]

I wouldn't spend too much time troubleshooting the specific issue, rather I would uninstall IE7 and then reinstall it on reboot.

[leicster25]

hello. I have uninstalled ie7 and the re-installed it from microsoft site. But have the same problem. I have made a not of the exact error now, it says :- An unhandled win32 exception occured in iexplorer.exe [868].

Does this help anyone to solve this problem ?

Thanks,
Dave.

[leicster25]

Hello. I have got some logs to display after reading the anti spyware / malware section. hope they help.

dds.txt is as follows :-

DDS (Version 1.1.0) - FAT32x86
Run by Dave at 23:08:05.10 on 18/12/2008
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.521 [GMT 0:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Jessops\Picture Suite\InsDetect.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\Dave\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.bbc.co.uk/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
BHO: {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.5.0_11\bin\ssv.dll
BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll
BHO: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll
TB: {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - c:\program files\canon\easy-webprint\Toolband.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll
TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - c:\program files\windows live toolbar\msntb.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [Jessops Insert Detect] c:\program files\jessops\picture suite\InsDetect.exe
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"
mRun: [<NO NAME>]
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.0\apps\apdproxy.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [BigDog303] c:\windows\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
StartupFolder: c:\docume~1\dave\startm~1\programs\startup\imvu.lnk - c:\program files\imvu\IMVUClient.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dslmon.lnk - c:\program files\sagem\sagem f@st 800-840\dslmon.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\lumixs~1.lnk - c:\program files\panasonic\lumixsimpleviewer\PhLeAutoRun.exe
IE: &Search - ?p=ZJxdm143YYGB
IE: &Windows Live Search - c:\program files\windows live toolbar\msntb.dll/search.htm
IE: Add to Banner Ad Blocker - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\dave\start menu\programs\imvu\Run IMVU.lnk
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_11\bin\ssv.dll
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\dave\start menu\programs\imvu\Run IMVU.lnk
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: klogon - c:\windows\system32\klogon.dll
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd.dll,c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\adialhk.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll

============= SERVICES / DRIVERS ===============

R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 32784]
R1 klif;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2008-7-18 213008]
R2 avp;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe -r []
R2 SocketLock;Raw Socket Lock Driver;\??\c:\windows\system32\socketlock.sys [2008-12-18 3712]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2007-12-13 24592]
R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2008-2-2 517632]
S3 FXDRV;FXDRV;\??\D:\Fxdrv.sys []
S3 vmfilter303;vmfilter303;c:\windows\system32\drivers\vmfilter303.sys [2008-1-17 428160]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys []
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe" /service msvsmon80 [2005-9-23 2799808]

=============== Created Last 30 ================

2008-12-18 21:04 <DIR> --d----- C:\@ie7
2008-12-18 20:41 <DIR> --dsh--- C:\FOUND.055
2008-12-18 20:26 3,712 a------- c:\windows\system32\socketlock.sys
2008-12-17 19:19 196,608 -------- C:\UDPV264.exe
2008-12-17 19:03 1,231,179 a------- c:\windows\setupapi.log.0.old
2008-12-14 10:24 <DIR> --dsh--- C:\FOUND.054
2008-12-13 20:19 54,067 a------- c:\windows\system32\%LocalXml%
2008-12-13 20:12 <DIR> --dsh--- C:\FOUND.053
2008-12-12 20:06 <DIR> --d----- c:\program files\FunWebProducts
2008-12-11 21:43 25,600 a------- C:\seiko watch.doc
2008-12-11 21:15 <DIR> --d----- C:\@xml footy
2008-12-11 21:00 <DIR> --d----- C:\@concert tickets
2008-11-30 21:19 <DIR> --dsh--- C:\FOUND.052
2008-11-30 18:19 <DIR> --dsh--- C:\FOUND.051
2008-11-28 10:15 <DIR> --d----- C:\@bacs xml work
2008-11-24 21:29 54,156 a---h--- c:\windows\QTFont.qfn
2008-11-24 21:29 1,409 a------- c:\windows\QTFont.for
2008-11-23 13:04 <DIR> --d----- c:\windows\Watson
2008-11-22 15:40 <DIR> --dsh--- C:\FOUND.050
2008-11-21 16:13 <DIR> --d----- C:\@@@chris
2008-11-20 19:10 <DIR> --dsh--- C:\FOUND.049

==================== Find3M ====================

2008-12-18 21:44 32 a--sh--- c:\windows\system32\drivers\fidbox2.idx
2008-12-18 21:44 32 a--sh--- c:\windows\system32\drivers\fidbox2.dat
2008-12-18 21:44 32 a--sh--- c:\windows\system32\drivers\fidbox.idx
2008-12-18 21:44 32 a--sh--- c:\windows\system32\drivers\fidbox.dat
2008-12-04 21:10 140,656 a------- c:\docume~1\dave\applic~1\GDIPFONTCACHEV1.DAT
2008-11-28 16:05 11,376 a------- c:\windows\system32\drivers\secdrv.sys
2007-04-20 17:12 773,460 ---sh--- c:\windows\system32\bdeeg.bak1
2007-05-03 21:25 812,348 ---sh--- c:\windows\system32\bdeeg.bak2

============= FINISH: 23:08:23.29 ===============

I've also attached arc and attach logs to help.

Thanks, dave

[Fren Banklin]

A standard HJT log would be more helpful.

First, do you have full functionality with Mozilla ?

Does the "basic" version of IE7 work, the one without any add-ons ?

Start>Progarms>Accesories>System Tools>Internet Explorer (no add ons)

[leicster25]

Hello. I have not got mozilla, i am using opera to get to the internet. I have included a HJT log for you as you said it would be better. The basic IE is not working.

HJT Log :-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:18, on 19/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Jessops\Picture Suite\InsDetect.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar6.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - (no file)
O3 - Toolbar: (no name) - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar6.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Jessops Insert Detect] C:\Program Files\Jessops\Picture Suite\InsDetect.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'NETWORK SERVICE')
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O8 - Extra context menu item: &Search - ?p=ZJxdm143YYGB
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Dave\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17D667BA-5675-4AAB-9221-08B9379384D4} (Image Uploader Control) - http://cdnimg.piczo.com/images/uploa...t_uploader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5...ndows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Internet Security (avp) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

--
End of file - 9351 bytes

[Fren Banklin]

Forum rules prohibit non-experts (me) from giving specific malware-removal help, but a scan of your HJT log indicates that you have been infected several times, and while it appears the .exe files have been removed by your AV software, the damage that has been caused may not have been repaired.

I suggest you go to the "securities" sub-forum. There are several stickies you should read before following the steps contained within them.

Does Opera work correctly ?

[leicster25]

Hello,

opera works fine. I've read alot of the securities forum stuff. I've done an online scan which says i have several infections that need to be cleared up, but i need to pay for th efull product to remove them, which i won't be doing. I've ran a chkdisk routine as well. I have tried to download ie version 7, but it appears microsoft needs you to be using internet explorer before you can download internet explorer, and as i've only got opera and firefox i can't do that. Have you any ideas how i can get my ie v7 working again please.

Thanks,
dave.

[Fren Banklin]

How did you uninstall IE7. Reinstalling should have fixed it.

[leicster25]

Hello,

No, I'm still having the same problems with IE 7.0

Sorry

[Fren Banklin]

How did you uininstall IE7 ?

[leicster25]

I think i went to add / remove programs

[Fren Banklin]

Because Opera works fine, and IE7 does not, I am thinking that the WinXP "support" structure around the internet browser is 100% functional, which means that the only thing that COULD be wrong is IE7 itself.

Since you have reinstalled it, I have to wonder if perhaps whatever corrupted data IE7 may have may bethe result of an incomplete uninstall. Remnants leftover are causing problems now, maybe.

So, I think it would be a good idea for you to do a complete uninstall of IE7, with a reboot afterwards in order to make certain it is completely gone. You might even consider using a 3rd-party uninstaller like Perfect Uninstaller or Revo.

Then, after making certain IE7 is completely gone, try to reinstall and see if it works.

I'm not sure about IE7, but previous versions of IE were uninstalled by Start>Settings>Control Panel>Add/Remove Programs>Add/Remove Windows Components> and untick Internet Explorer. Let the uninstall complete, then reboot.

Then reinstall. It would be a good idea to have the standalone package of IE7 ready to do the reinstall, because I don't think you are going to be able to run Windows Update in order to get IE7 with Opera. You may not be able to browse at all, so it would be a good idea to have that standalone version of IE7 ready for after the reboot.

http://www.microsoft.com/downloads/d...displaylang=en

[Fren Banklin]

Originally Posted by leicster25

I have made a note of the exact error now, it says :- An unhandled win32 exception occured in iexplorer.exe [868].

I did some extensive Googling to no result. I can find no mention of error "868" at all. Please re-post the exact text of the error message. A screen shot would be ideal.

When Google has NO hits for certain text, I have to start thinking about malware.

[leicster25]

Hello fren,

I have managed somehow to revert back to ie 6.0. Since then I re-installed ie 7.0 from th elnk you gave on a previous post. It all seems to be ok now with ie 7.0. I still think i have some malware issues to sort out but I am keeping kaspersky on and running scans regularly now to try to get my system as clear as possible.

Thanks for all your help on this.

Dave

[Fren Banklin]

(I just now managed to swap my Microsoft Natural keyboard for the trashy one I found on the side of the road that I use for troubleshooting. Unfortunately, during all the changing of the gear around, the test computer got my good keyboard, and I was the one that had the flat, crappy keyboard with the paint and drywall mud all over it. I pulled the cord on the cheapie, and jammed the Natural's plug in within 2 seconds.

Beep! went the BIOS speaker. But then a couple bangs on teh spacebar, and seeing the cursor moving obediently, I knew I WON ONE. For once, lol...)

I would not put too much faith in your AV software's ability to keep you safe. There is an entire PIE of things you MUST do in order to be (more or less) "safe". And the AV software is about 10 - 75 percent of it, depending on your computing habits, and those of those around you, i.e. you KIDS, your WIFE (or) HUSBAND, girlfriend/boyfriend, room-mates, siblings, and even if you let your cat walk across a live keyboard.

How like do you think it is that a series of random strokes, ending with a space bar, just might land at a site that picks up spurious communication from computers around the world, and uses them; incorporates them into the BORG ?

Your cat is the reason you are sending spam to millions of people around the world, idiot, and the only reason why it won't stop is because you are too stupid to recognize the fact that someone else is controlling your computer, and it's not you.

It's your cat, lol. So have him arrested or something, will ya ?

Okay, back to this reality.

You are better-off spending your energies learning your computer. What it does and why. What affects it and how. How you affect it, and what happens as a result. Meaning your personal computing habits.

OCD can manifest itself in many, unexpected ways. Like excessive reg cleaning, defragging, etc... They become meaningless rituals that give little in return other than a sense of stability and structure.

So, invest your faith in yourself, and not the mindless tools.

Look for unusal things, and consider causality. Also learn to deal with the random nature of the electronic universe. Somethings aren't worth paying attention to, and some things are so far beyond your ability to understand that, even if you started doing your academic career which results in recieving a Doctorate in the subject, you'd STILL not be able to understand how it truly happened. In some ways, and in some places in the universe, causality only exists as a joke.

Getting SP3 installed, and getting XP fully-updated is the single-most important Security Measure you can implement. By doing this, you automatically exclude from potential threat all but the most-recent exploits that have been turned for Dark Purposes.

You can rely, to some degree, on fully-updated virus definition files to protect you from most of the rest.

Practicing Safe Computing Habits will limit your exposure to those few still further, by reducing the level of risk of the right malware hitting your box at the right time. It's under contant attack. The fact that you are (or may be) unaware of this does not change this fact, and the less you know about it, the more dangerous it becomes.

Finally, KNOW your system. All of those things have meaning, and all of that "confusion" that you see from some people is the cumulative result of them putting great effort into refusing to learn anything about what they are doing. Which is why I have to put effort into not treating some "confused" people with contempt.

People that tell me that they aren't going to get infected from their P2P file sharing activities because they get their torrents from "clean" (the idiot's words) sites like "Mini-Nova", do not get to then tell me about what their opinion is regarding the comparitive qualities of anti-virus software.

Don't be one of THOSE people, whose only use for their own ignrance (rather than a motivator to LEARN) instead it is used as a shield, to protect themselves from the truth of their own arrogance.