Can't create object

Discussion in 'adware, spyware & hijack cleaning' started by MarkG, Feb 15, 2004.

Thread Status:
Not open for further replies.
  1. MarkG

    MarkG Registered Member

    Joined:
    Feb 15, 2004
    Posts:
    3
    I keep getting this message every time I open IE and many websites. I know spyblaster is doing its job and all that. My computer is clear of any spyware. I currently use spybot, adaware, and trojan remover along with NAV 2004 and a firewall. These messages are quickly becoming a pain. Anyone know how to at least silence these messages? I'm this close to uninstalling spyware blaster! Some advise on this would be apreciated. o_O
     
    MarkG, Feb 15, 2004
    #1
  2. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    There are a couple of different errors that end with the words "can't create object". Is there more to the error message than that? Can you tell us the whole thing or maybe take a screen image of it and post it here?

    This thread shows one of them, (ActiveX component can't create object
    ), while it's about SpywareGuard, this error occurs with a lot of different programs. On some systems, they have an out of date Windows Script version...

    http://www.wilderssecurity.com/showthread.php?t=12089

    Then there's the 'mainAutomation server can't create object' message which may occur with all SpywareBlaster protections enabled, and doesn't occur if you go into SpywareBlaster and "deselect all" and "remove protections..."

    If this is the error you have, take a look here:

    http://www.wilderssecurity.com/showthread.php?t=16213

    At this point, we believe this occurs when there is spyware already installed on a system, and when you enabled SpywareBlaster's protection it disables the spyware - but, that spyware is so deeply embedded that disabling it causes these errors. You could disable SpywareBlaster to prevent the errors, but the spyware would remain there, if this is actually what is happening.

    You'll see in the referenced thread that the recommendation is to post a HijackThis log, which is also explained in that thread.
     
    LowWaterMark, Feb 15, 2004
    #2
  3. MarkG

    MarkG Registered Member

    Joined:
    Feb 15, 2004
    Posts:
    3
    You are correct. The rest of the message starts with Main automation server....

    So here is the hijackthis log for the experts to check out:


    Logfile of HijackThis v1.97.7
    Scan saved at 6:10:21 PM, on 2/15/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\mHotkey.exe
    C:\WINDOWS\Dit.exe
    C:\Program Files\ISP50\bin\bartshel.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Mark Gravelle\Desktop\framxpro\FreeRAM XP Pro 1.40.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Tiger Technologies\DeskFlag\deskflag.exe
    C:\WINDOWS\DitExp.exe
    C:\PROGRA~1\ISP50\bin\ppshared.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\DOCUME~1\MARKGR~1\LOCALS~1\Temp\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.emachines.com/
    N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Mark Gravelle\Application Data\Mozilla\Profiles\default\xgoi5nk1.slt\prefs.js)
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
    O2 - BHO: (no name) - {3DE88907-3E38-11D4-BEB2-CBE76C0598DD} - C:\Program Files\ISP50\bin\BandObject.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Arrow Search - {1D9B10E0-E90C-11D7-A399-B7BAC8911A3F} - C:\PROGRA~1\ARROWS~1\Toolbar.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
    O4 - HKLM\..\Run: [Dit] Dit.exe
    O4 - HKLM\..\Run: [Bart Station] C:\Program Files\ISP50\hta\station.sbrt
    O4 - HKLM\..\Run: [PPCRunonce] C:\WINDOWS\System32\PPCRunOnce.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Mark Gravelle\Desktop\framxpro\FreeRAM XP Pro 1.40.exe" -win
    O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
    O4 - Startup: DeskFlag.lnk = C:\Program Files\Tiger Technologies\DeskFlag\deskflag.exe
    O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    O4 - Global Startup: PowerReg SchedulerV2.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O9 - Extra button: Search (HKLM)
    O9 - Extra 'Tools' menuitem: Search with Arrow Search (HKLM)
    O9 - Extra 'Tools' menuitem: Search with Arrow Search (HKLM)
    O9 - Extra button: ICQ (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ (HKLM)
    O9 - Extra button: MoneySide (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/066c489dc13b0ce2a521/netzip/RdxIE601.cab
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38010.4748148148
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

    Hope this helps.
     
    MarkG, Feb 15, 2004
    #3
  4. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Ok, then I'll move this over to the hijack this forum section (at least until the review is done)...
     
    LowWaterMark, Feb 15, 2004
    #4
  5. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Hi MarkG,

    Two options to end this:

    1) In SpywareBlaster Find eStart(2), uncheck that item in SpywareBlaster and click "Remove Protection for Unchecked Items"

    2) In HijackThis put a checkmark before:
    O2 - BHO: (no name) - {3DE88907-3E38-11D4-BEB2-CBE76C0598DD} - C:\Program Files\ISP50\bin\BandObject.dll

    These need fixing for sure, check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

    O4 - Global Startup: PowerReg SchedulerV2.exe

    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/066c489dc13b0ce2a521/netzip/RdxIE601.cab

    Then to satisfy my curiosity. I notice you have this toolbar installed:
    http://www.rt-software.co.uk/arrow_search/
    but I couldn't find a privacy policy for it. Maybe you can point me in the right direction?

    Regards,

    Pieter
     
    Pieter_Arntz, Feb 16, 2004
    #5
  6. MarkG

    MarkG Registered Member

    Joined:
    Feb 15, 2004
    Posts:
    3
    Good News!

    Your advice has seemed to work. No messages have popped up since. Step #1 did not seem to have any effect, but #2 did work.

    Arrow Search is a freeware program that searches multiple search engines at a time. Its not a tool bar. I open a seperate window when I do a search. It acts like any normal search engine(Yahoo etc) In Other words it has a built in browser. Here is the address:

    www.rt-software.co.uk

    Once again thanks for the help!! :)
     
    MarkG, Feb 16, 2004
    #6
  7. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    You're welcome and thanks for the information on Arrow Search.

    Regards,

    Pieter
     
    Pieter_Arntz, Feb 16, 2004
    #7
  8. davejay

    davejay Registered Member

    Joined:
    Feb 22, 2004
    Posts:
    2
    Had the problem. Went to IE tools and cleared all cookies and objects - Java,Activex,Macromedia,etc. Problem disappeared right now! Have disabled third party plugins for now. I believe that someone is distributing a helpful plugin that IE can't digest. Maybe if someone cleared an object at a time, we might find out which one is gagging IE!

    Just a thought.
     
    davejay, Feb 22, 2004
    #8
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...