IE, AOL Browser crashing on most Web sites...Help please??

I'm not sure if I'm posting this in the right place, but I've seen others get help from moderators that seem very knowladgable so I'm hoping to find some answers here.

Earlier this week or late last week, IE began giving me error report messages and shutting itself down when I was attempting to log onto Yahoo! In a day or so, the problem grew and Internet Explorer is crashing on many sites, seemingly at random (luckily I'm able to browse this site). I've read posts on this site and others which tell users with these symptoms to run programs like Adaware and Spybot Search & Destroy, but I've not read anything saying that these solutions have done the trick. With my dial-up connection, it's also not very realistic for me to go downloading these and other utilities. Any help would be greatly appreciated.

I'm running a Dell P3 550 with Windows 98 SE and IE 6 SP1.

Thanks very much,
Owen

 

Hi Owen,

Please follow the instructions here:
https://www.wilderssecurity.com/showthread.php?t=15913

Trust me when I tell you that downloading unwanted stuff takes just as long as downmloading the things you need. The choice is, as ever, yours.

Regards,

Pieter

 

Hi OwenJI,

Seems u have started 2 duplicate threads here,

https://www.wilderssecurity.com/showthread.php?p=190063#post190063

and here,

https://www.wilderssecurity.com/showthread.php?p=190042#post190042

Please refrain from starting duplicate threads as it makes things confusing for people trying to help u.

Please keep all replies to this subject in this thread.

I will close your other threads and remove them later.

No offense intended.


snowbound

 

My apologies for duplicating the thread.

Here is a copy of the log generated by Hijack This:

Logfile of HijackThis v1.97.7
Scan saved at 7:03:57 PM, on 6/6/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\ACS495\MIXGHOST.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
D:\INSTALLERS\HIJACKTHIS.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Provided by Owen...You're Welcome
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Mixghost] C:\ACS495\MixGhost.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - User Startup: PowerReg SchedulerV2.exe
O4 - User Startup: PowerReg Scheduler.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: ATI TV (HKLM)
O9 - Extra button: Dell Home (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/setup/RiffLick.cab
O16 - DPF: {498A0AC2-A3AC-11D4-80A9-0050DA680987} (HearMe (Firewall) Voice Control) - http://www.brainfuse.com/tfjava2/HearME2.5.2/hmvcfe.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2e529727a6ef04/housecall.antivirus.com/housecall/xscan53.cab

Thanks very much for the help

Owen

 

Hi OwenJI,

Check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm

O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - User Startup: PowerReg SchedulerV2.exe
O4 - User Startup: PowerReg Scheduler.exe

Download and run: http://www.spywareinfoforum.com/~merijn/files/CWShredder.exe
Use the Fix button and follow the instructions you will receive.

Regards,

Pieter

 

I've followed the directions above and am still having IE crash instantly when loading Yahoo.com and seemingly at random on many or most other Web sites

Owen

 

PS: CWShredder said my system was completely clean.

Also,

After running Spybot S&D again, the following entry came up again:

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

Two or three times I told Spybot to fix this problem, but it came up again and again.

For good measure, here is an updated log from HijackThis, after re-running Spybot and CWShredder:

Logfile of HijackThis v1.97.7
Scan saved at 1:06:16 PM, on 6/7/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\ACS495\MIXGHOST.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
D:\INSTALLERS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Provided by Owen...You're Welcome
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [OEMCleanup] C:\WINDOWS\OPTIONS\OEMRESET.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Mixghost] C:\ACS495\MixGhost.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: ATI TV (HKLM)
O9 - Extra button: Dell Home (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.aol.com
O16 - DPF: {0EC4C9E3-EC6A-11CF-8E3B-444553540000} (WaveTab Control) - http://www.riffinteractive.com/setup/RiffLick.cab
O16 - DPF: {498A0AC2-A3AC-11D4-80A9-0050DA680987} (HearMe (Firewall) Voice Control) - http://www.brainfuse.com/tfjava2/HearME2.5.2/hmvcfe.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2e529727a6ef04/housecall.antivirus.com/housecall/xscan53.cab

Thanks again,
Owen

 

About the DSO Exploit by Spybot S&D: http://forums.net-integration.net/index.php?showtopic=15308

Have you tried repairing IE?

Your log is clean now, so the timing would be perfect to check if it is fully updated and repair if necessary.

Regards,

Pieter

 

I've downloaded all the critical updates for Windows and IE and rapaired Explorer, and the problem persists. I wounder if I'm just barking up the wrong tree with these Spyware solutions? On the other hand, the problem appeared to just show up like a virus or program. Any more ideas? Thanks for all the help.

Owen

 

Do you get any error reports when IE crashes?

Regards,

Pieter

 

Yes, the error message appears with the option to restart IE and send an error report to Microsoft.

 

When it happens again, click on Details and post them.

Regards,

Pieter

 

When looking at the details of the error last night, I noticed the file msvcrt.dll was mentioned prominently under "Modname" at the top of the error report. For the heck of it, I downloaded a new version of msvcrt.dll from the Web and replaced it in DOS (c:\windows\system\msvcrt.dll). To my surprise, this seems to have been the fix. I've been able to surf normally for nearly a whole day now with no crashes or error messages to speak of. Do you know of anything relating to problems/curruptions with this file? Is this a known issue?

Thanks much for the help and info.

Owen

 

Good job, Owen.

Not only did you find the information but you acted accordingly.

There is a long list of errors with that file:
http://www.generation.net/~hleboeuf/ermsvcrt.htm

Regards,

Pieter