Explorer Bug

Discussion in 'other security issues & news' started by wildman, Feb 18, 2004.

Thread Status:
Not open for further replies.
  1. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    Anyone have an answer to this Explorer bug?
     

    Attached Files:

  2. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    That's generally a sign of spyware, normally Xupiter

    Follow advice here
    http://www.wilderssecurity.com/showthread.php?t=15913
     
  3. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    :mad: :( :p :'(

    Adaware indicates no problem.

    SpyBot indicates no problem.

    Repair of Internet Explorer 6.0 SP1 did not reslove the problem.

    Reinstall of Internet Explorer 6.0 SP1 did not take care of the problem.

    Here is the log.

    Still looking for the answer.
     

    Attached Files:

  4. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Actually wildman, we can't decode stack dumps from aborting programs. Unless a specific dump signature (and how to resolve it) can be found via a web search, there's not much anyone outside Microsoft can do.

    But, in the thread referenced above there is more than just a recommendation to run Ad-aware and Spybot. If this is actually being caused by spyware which those products miss, posting a HijackThis Log here might help. See steps 2 & 3 there:

    http://www.wilderssecurity.com/showthread.php?t=15913
     
  5. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    *puppy*

    At long last I figured how to get and install hijackthis. Here is the results. Still looking for a fix. All that Microsoft has provided thus far has not worked.

    Thanks

    Wildman
     
  6. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    I don't see your HJT log wildman. Did u try to paste it into your post? ;)





    snowbound
     
  7. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    I,m having a h&l$ of a time inserting the log into this post, it is over 100 kb. I'll keep trying! Hey I,m new at this kind of stuff.

    Thanks

    Wildman
     
  8. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    O.K. I give up. How the he^^ do you post the log to this B.B.? I have it saved as a log file. It is approx. 128 kb.

    Thanks

    Wildman

    :p :doubt: :(
     
  9. snapdragin

    snapdragin Registered Member

    Joined:
    Feb 16, 2002
    Posts:
    8,415
    Location:
    Southern Ont., Canada
    Hi Wildman,

    When the *Save Log* button appears in HijackThis, save it as a .txt file instead. Then open the .txt file and copy the contents and paste it in the body of your post here.

    snap

    fixed typos
     
  10. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    Logfile of HijackThis v1.96.1
    Scan saved at 9:00:13 AM, on 2/23/04
    Platform: Windows 98 Gold (Win9x 4.10.199:cool:
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\SA3DSRV.EXE
    C:\COMPAQ\ACCESS\ENCOMPASS\MONITOR.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\BITWARE\CBWHOST.EXE
    C:\PROGRAM FILES\BITWARE\CBWATTN.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\COMPAQ\INTERNET\CISRVR.EXE
    C:\WINDOWS\SYSTEM\SXGDSENU.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\EVNTSVC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
    C:\PROGRAM FILES\MOUSEWARE\SYSTEM\EM_EXEC.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\PROGRAM FILES\SOFTWARE BY DESIGN\STAYLIVE.EXE
    C:\PROGRAM FILES\DAP\DAP.EXE
    C:\WINDOWS\TEMP\HIJACKTHIS.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tmisnet.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.presario.net/scripts/redirectors/presario/srchredir.dll?c=1c99&s=search&query=%s&i=enu
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Aureal A3D Interactive Audio Init] A3dInit.exe
    O4 - HKLM\..\Run: [CISrvr Program] C:\COMPAQ\INTERNET\CISRVR.EXE
    O4 - HKLM\..\Run: [SXGDSENU] SXGDSENU.exe
    O4 - HKLM\..\Run: [EACLEAN] C:\Program Files\Compaq\Easy Access Button Support\eaclean.exe /NORESTART
    O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
    O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
    O4 - HKLM\..\Run: [CriticalUpdate] c:\windows\SYSTEM\wucrtupd.exe -startup
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb05.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
    O4 - HKLM\..\Run: [Compaq Internet Setup] C:\Compaq\Internet\InetWizard.exe /RUN
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [Aureal A3D Interactive Audio] sa3dsrv.exe
    O4 - HKLM\..\RunServices: [CBWHost] C:\PROGRA~1\BITWARE\CBWEXEC.EXE /Run C:\PROGRA~1\BITWARE\CBWHOST.EXE
    O4 - HKLM\..\RunServices: [CBWAttn] C:\PROGRA~1\BITWARE\CBWEXEC.EXE /Run C:\PROGRA~1\BITWARE\CBWATTN.EXE
    O4 - HKLM\..\RunServices: [EncMonitor] c:\compaq\access\Encompass\Monitor.exe
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\System\reminder.exe
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37870.3767708333
    O16 - DPF: {F5C90925-ABBF-4475-88F5-8622B452BA9E} (Compaq System Data Class) - http://www29.compaq.com/falco/SysQuery.cab
    O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?312
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab

    At last looks as if I posted my hijackthis list!

    Thanks

    Wildman

    o_O :p :)
     
  11. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    :mad: I still have the problem. Microsoft hasn't been much of a help.

    Does anyone have a list of agencies to which one can render a complaint?

    I did update to MDAC 2.6 and cleaned up a few other items, but this did not get rid of the problem.

    SpyBot, Adaware and AVG 6.0 are all current and up to date, none of these indicate any problems on my machine.

    Thanks

    Wildman
    :p ;) :D
     
  12. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    :D At long last I think I solved this problem. First I used all the checks (SpyBot, AdAware, Hi Jack This and AVG 6.0) to make sure there was nothing bad on my machine. This in and of itself did not reslove the problem however. Second I started to look at MFC42.dll, it was when I recovered this file from CAB, that the problem seemed to be fixed. I pass this along for others that may have this or a similiar problem.

    Thanks

    Wildman

    *puppy* :D
     
  13. wildman

    wildman Registered Member

    Joined:
    Feb 18, 2004
    Posts:
    2,185
    Location:
    Home on the range.
    :(

    Additional Info on this situation:

    I have now had other indications that MFC42.dll is corrupted or can not be located.

    I have recovered or reinstalled all the applications that have been indicated. This has been a slow and tedious process.

    I had installed Easy Office Suite, and it became corrupted. I did not reinstall this, as it is a (7) Seven hour download, figured I could do without it.

    I pass this information along in hopes that others take action to not get in this situation. Also if one does have this type situation, look at the *.dll as well as the browser.

    Thanks

    Wildman

    :) :cool: :p :-*
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.