Going nuts with IE 6 hangs

[Guest]

I recently purchased a new computer. Until now I was using a 400MHz 256MB
system with W2KPro. I how have a 3GHz 512MB system with XP Home and I'm
beginning to miss my old system.

I'm running SP2 with all the most recent updates. I am religious about
checking for spyware and have even posted my Hijackthis log elsewhere to
confirm that my problem isn't maleware related. I use Microsoft's beta was
well as 2 other scanners. My anti virus is up to date. And I've preformed
online scans at additional AV, spyware, and trojan scanning sites.
Everything reports my system is clean.

I've emptied my IE cache, passwords, history and recycle bin several times.
I've thought about uninstalling and then reinstalling IE 6, but that doesn't
look possible. I'd rather not jump to another browser, but the number of
hangs and slowness is just not acceptable. I've even had to reboot the
system to clear the hang, and until now, I can't remember the last time I've
had to do that (post 98SE).

I've gone through pages and pages on the knowledgebase but can't find an
answer. I'm hoping to get some help here or I'll have to investigate another
browser. When I report the error and ask for technical info, I'm told that
the problem does not match anything in the DB.

Here is the information listed in the application log (there are 2 logs per
event see both below):

Event Type: Error
Event Source: Application Hang
Event Category: None
Event ID: 1001
Date: 3/20/2005
Time: 4:15:03 PM
User: N/A
Computer: xxxxx
Description: xxxxx
Fault bucket 126637809.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 42 75 63 6b 65 74 3a 20 Bucket:
0008: 31 32 36 36 33 37 38 30 12663780
0010: 39 0d 0a 9..

Details
Product: Windows Operating System
ID: 1001
Source: Application Hang
Version: 5.2
Symbolic Name: DW_BUCKET_LOG
Message: Fault bucket %1.

Explanation
The indicated program stopped responding. The message contains details on
which program and module stopped responding. A matching event with Event ID
1001 might also appear in the event log. This matching event displays
information about the specific error that occurred.


User Action
No user action is required.
--------------------------------------------------------------------------------
Currently there are no Microsoft Knowledge Base articles available for this
specific error or event message. For information about other support options
you can use to find answers online, see
http://support.microsoft.com/default.aspx.


Event Type: Error
Event Source: Application Hang
Event Category: (101)
Event ID: 1002
Date: 3/20/2005
Time: 4:14:11 PM
User: N/A
Computer: DC84HV51
Description:
Hanging application IEXPLORE.EXE, version 6.0.2900.2180, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 49 45 58 50 4c 4f IEXPLO
0018: 52 45 2e 45 58 45 20 36 RE.EXE 6
0020: 2e 30 2e 32 39 30 30 2e .0.2900.
0028: 32 31 38 30 20 69 6e 20 2180 in
0030: 68 75 6e 67 61 70 70 20 hungapp
0038: 30 2e 30 2e 30 2e 30 20 0.0.0.0
0040: 61 74 20 6f 66 66 73 65 at offse
0048: 74 20 30 30 30 30 30 30 t 000000
0050: 30 30 00

Details
Product: Windows Operating System
ID: 1002
Source: Application Hang
Version: 5.2
Symbolic Name: ER_HANG_LOG
Message: Hanging application %1, version %2, hang module %3, version %4,
hang address 0x%5.

Explanation
The indicated program stopped responding. The message contains details on
which program and module stopped responding. A matching event with EventID
1001 might also appear in the event log. This matching event displays
information about the specific error that occurred.

User Action
No user action is required.

 

[Jan Il]

Hi Helpingout

The problem is probably due to some kind of scumware on your system. Try
the following and see if it helps. Even if you have already run some
programs, run them again according to the instructions in the information
below to thoroughly clean you system. Some variants of malware can
replicate itself and return repeatedly if not cleaned properly. It is best
to read through all the information before you start to know before hand
what you need to do and how. Follow all instructions to letter as much as
possible.

WARNING>>>> Backup all documents and files before removing any spyware!!

First, Go to Start | Run and type CMD
In the command window type
netsh winsock reset

Then download and install BHODemon from
http://www.definitivesolutions.com/bhodemon.htm
Your problem may be caused by a bad BHO.

If this does not resolve the problem, the do the following. Run all programs
in Safe Mode:

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx
What you can do about spyware and other unwanted software
http://www.microsoft.com/athome/security/spyware/spywarewhat.mspx
Most importantly, be sure to run CWShredder here
http://www.majorgeeks.com/download3019.html
Also this program searches for hidden .dlls that recreate the malware.
About Buster:
http://www.majorgeeks.com/download4289.html
Then visit these two sites to test for parasites and help basic cleaning:
On-Line Check
http://aumha.org/a/noads.htm
and
Quick-Fix Protocol.
http://aumha.org/a/quickfix.php
Basically, throw everything here at your "infection".

Also download and install HiJackThis -

How to download and install HiJackThis:
http://www.bleepingcomputer.com/forums/topict309.html

Please DO NOT post your log to this newsgroup. It is important that you go
to one of the HiJackThis Support Forums below and allow the experts there
to analyze it for youPlease DO NOT post your log to this newsgroup. It is
important that you go to one of the HiJackThis Support Forums below and
allow the experts there to analyze it for you.::
AumHa HiJackThis Forum
http://forum.aumha.org/viewforum.php?f=30
or Bleeping Computer Forum
http://www.bleepingcomputer.com/forums/forum22.html
to allow the experts there to evaluate your log and advise you of any
necessary steps to clean your system.
(Note: You will have to Register before posting on these Forums. Please
follow all posting instructions carefully to avoid having your log deleted
or ignored.

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

You should also get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also... From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)
or Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip


Hope this helps

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Guest]

Hi Jan I! Thanks for your response. Yes I’ve done most of those and more,
but I am heading down your list and doing them again. Thank for the info
about BHODemon as I hadn’t heard of it before. I’ve always used HiJackThis
to report the BHO’s etc.

So far nothing is showing up. I’ve completed 2 full system scans from
PandaSoft tonight as well. Buster says the system is clean as well. I’ve
run programs to list all of the executables, but nothing looks bad.
I’m down to the On-Line Check and Quick-Fix that you mentioned and will
work on those tomorrow as it is late here.

I have posted the HiJackThis log at one of the locations but no one has
found a problem at this point. So if anyone else has some suggestions, please
let me know!

 

[siljaline]

Where did you post your HijackThis log?
Please post back the URL.

Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security (AH-VSOP)
__________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)

 

[Guest]

The second HiJackThis log is the one that looks completely clean. The first
one had a couple of BHO's that were shown as "no file" and were associated to
Money 2004.

http://www.dslreports.com/forum/remark,12921040~mode=flat~days=9999

 

[siljaline]

The second HiJackThis log is the one that looks completely clean. The first
one had a couple of BHO's that were shown as "no file" and were associated to
Money 2004.

http://www.dslreports.com/forum/remark,12921040~mode=flat~days=9999

Thanks for posting back!
You are in ( _very_ ) good hands at DSL Reports.
Several MS - MVP's post there including; Calamity Jane, among many experts.

Regards,
Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security (AH-VSOP)
__________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)

 

[Guest]

Yes, I am very impressed with the forum and Clamity. Since it is not a
"security thing", I need to move towards a different group for help. This
felt like an appropriate board. If you know of somewhere else that would be
a better fit, please let me know.

 

[siljaline]

Yes, I am very impressed with the forum and Clamity. Since it is not a
"security thing", I need to move towards a different group for help. This
felt like an appropriate board. If you know of somewhere else that would be
a better fit, please let me know.

If you would like your HijackThis log analysed elsewhere, please feel free
to post it here; http://aumha.net/viewforum.php?f=30
If you choose this route, please clearly identify yourself as having been directed
to the above forum by me. You will be helped forthwith.

If this is an IE issue and not Spyware-related, please post your query here;
http://aumha.net/viewforum.php?f=7

I am a moderator at AumHa Forums, hope to see you there.
Again, if you choose that route, it is your option.

Regards,
Silj

--
siljaline

MS - MVP Windows (IE/OE) & Security (AH-VSOP)
__________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31

(Reply to group, as return address
is invalid - that we may all benefit)

 

[Guest]

I don't think it is spyware related unless it is a new one that no one knows
about. I'll head over to the other forum (aumha.net) and post there too. I
just spoke with a friend who is having the same problem so I'll have more
data tomorrow.

Thanks!

 

[Jan Il]

Hi Helpingout

I don't think it is spyware related unless it is a new one that no one
knows
about. I'll head over to the other forum (aumha.net) and post there too.
I
just spoke with a friend who is having the same problem so I'll have more
data tomorrow.

Thanks!

Glad to see you are going to the AumHa forum....they support team there is
excellent there as well. I am a Gold Member at AumHa fourms so I will check
your progress from there.

Jan
Smiles are meant to be shared,
that's why they're so contagious.