IE6 - MSHTML.DLL browser keeps crashing!

[MaxZ]

Hiya,

I have a WindowsXP SP2 installation on a computer that keeps crashing.
There error reads identical to that in MS's support article ID: 816506
(http://support.microsoft.com/default.aspx?scid=kb;en-us;816506)

AppName AppVer ModName ModVer offset
--------------------------------------------------------------
iexplore.exe 6.00.2800.1106 mshtml.dll 6.0.2800.1141 varies


I'm not sure what exactly is causing the crash, but the browser does not
last long until it happends.

I have tried various solutions. System restore, SFC, and such have not
worked. A reinstall of XP via upgrade DID work, however. Then, after the
automatic updates updated the system, the problem came back.

I'm not sure what is triggering it but it is definately a MS update that is
causing the problem. I manually uninstalled all updates done and the
problem was still there.

Any Ideas? I'd hate to wipe the system and relay it.

Many Thanks!

 

[MaxZ]

I should say:

I have tried Pestpatrol and Adaware with no traces of spyware. I am running
Symantec antivirus and all is up to date. I have cleared cache and cookies.
The problem persists. Thanks.

 

[Jan Il]

Hi Max

Try the following and see if it helps:

Internet Explorer or Outlook Express quits unexpectedly with an error in
Mshtml.dll
http://support.microsoft.com/?kbid=816506

It is also possible that you have some form of malware on your system. In
addition to updating and running your AV, download, install and run the
programs below in Safe Mode with Hidden Files enabled. This will remove
the nasty you have and any others it may have let in the back door. Some
malware can replicate itself repeatedly if not removed properly, so even if
you have run some of the programs listed here, it is important that you run
them again according to the information below so that Windows is not
operating to hide any files 'in use' Follow all instructions carefully:

First, Clear the TIF's and empty the recycle bin:
http://www.mvps.org/winhelp2002/delcache.htm

Also…empty your Recycle bin.

Then do the following:

WARNING>>>> Backup all documents and files before removing any spyware!!

Most importantly, download install and run CWShredder here
http://www.majorgeeks.com/download3019.html
and About Buster, which searches for hidden .dlls that recreate the malware.
http://www.majorgeeks.com/download4289.html
Then visit these two sites to test for parasites and help basic cleaning:
On-Line Check
http://aumha.org/a/noads.htm
and
Quick-Fix Protocol.
http://aumha.org/a/quickfix.php
Basically, throw everything here at your "infection".

Then download, install and immediately update these three programs before
running:
AdAware SE - Update immediately after installing
http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button
AdAware Tutorial -
http://www.bleepingcomputer.com/forums/index.php?showtutorial=48
SpyBot S &D - Update immediately after installing
http://www.majorgeeks.com/download2471.html
SpyBot S&D Tutorial -
http://www.bleepingcomputer.com/forums/index.php?showtutorial=43
Microsoft Windows Antispyware Program (Beta)
http://www.microsoft.com/athome/security/spyware/software/default.mspx

Next, do an Online scan here (if possible) -
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Make sure that you choose "fix" or "clean".

Download Pocket Killbox from
http://www.thespykiller.co.uk/files/killbox.exe
and put it on the desktop where you can find it easily

Download, install, and run HiJackThis - it is one of the most important
tools to help clean your system of scumware. Follow the instructions
carefully:

How to download and install HiJackThis: (it does not need to be updated)
http://www.bleepingcomputer.com/forums/topict309.html

Please DO NOT post your log to this newsgroup. It is important that you go
to one of the HiJackThis Support Forums below:
CastleCops HiJackThis Forum
http://castlecops.com/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html
or Bleeping Computer HiJackThis Forum
http://www.bleepingcomputer.com/forums/forum22.html
to allow the program experts there to evaluate your log and advise you of
any
necessary steps to clean your system.
(Note: Look for and read the "Important- Read This First" messages in the
sections for HiJackThis logs so that you follow proper procedure. You will
have to Register before posting on these Forums. Please follow all posting
instructions carefully to avoid having your log deleted or ignored.)

Also, please post a link to the forum where you post your HJT log back to
this thread so that we can follow your progress there.

CAUTION!!!!! Before you try to remove spyware using any of the programs
below, download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

You should also get a copy of WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also... From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)
or Winsock Fix Utility
http://www.dfwonline.net/files/WinsockFix.zip

How to Restart in Safe Mode
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

How to Show Hidden Files
http://snipurl.com/6rl8

Hope this helps.

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[Jan Il]

Hi Max

I am sorry to say that it takes more than those programs to detect and
remove all types of scumware that can infect your system. That is why I
provided the list of programs for you to use to fully clean your system.
There are many types of malware, parasites and hijackers, and variants of
each, that take specific programs to both detect and remove them. Some
types can reproduce themselves repeatedly if not fully removed properly. It
is important that you follow the steps that I have provided, running them in
Safe Mode, with Hidden files enabled, in order for them to fully clean your
system.

You can also try a Repair of IE and see if that will help.

How to reinstall or repair Internet Explorer and Outlook Express in Windows
XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;318378

Hope this helps.

Jan
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm

 

[PA Bear]

Try visiting Windows Update and installing all Critical Updates offered.

NB: The error may point to hijackware so best not install SP2 just yet.

 

[MaxZ]

Jan,

I followed your instructions. Ran Safe mode, ran CWSHREDDER, Kill2Me,
Bugoff, and AdAware.

CWSHREDDER gave me a positive on cws.kill2me on one run. I cleaned it using
the software and cleaned it again using Kill2me just to be safe. It then
agve me a positive on cws.msconfig. I cleaned that as well.

I am still getting the same problems. I will try once more to run SFC. If
that doesn work, I will again try to reinstall windows xp w/ sp2.

I am not optimistic and believe i will have to reinstall the OS and all
software. I am still not certain if the culprit was malware/adware/etc or
simply a corruption of one of my DLLs (which SFC SHOULD fix, no?).

As i said before, it is the recent windows updates that bring out this
crashing problem. Any other suggestions?

Thanks.

 

[Jan Il]

Hi Max

Have you posted your HiJackThis log yet with one of the forums that I listed
for you? It is one of the most valuable troubleshooting tools and it can
often point to still existing residual files that are left behind or broken
by the malware or even sometimes removal tools. Some residual files will
also allow the malware to continue to replicate itself repeatedly if not
fully removed. This may be the problem, that you have a variant of the the
Coolwebsearch that is continuing to replicate itself over and over as all
the tendrils are not being totally removed. This is not unsual and may take
a more aggressive method of removal. I must advise you that just doing a
repair of the IE or reinstalling SP2 will not remove any malware or other
scumware on your system, and could, as PA Bear has also mentioned, perhaps
cause more problems.

If you have already posted a HijackThis log, please post the link here in
this thread to the forum where you posted it so that we can take a look and
see what is happening and follow along with the progress. If you have not
yet done so, please install and run the HiJackThis in Safe Mode with Hidden
files enabled, create a log and post it to one of the following forums. The
program experts there will review your log and advise you of any further
cleaning steps needed to get your system back in order:

Download, install, and run HiJackThis - it is one of the most important
tools to help clean your system of scumware. Follow the instructions
carefully:

How to download and install HiJackThis: (it does not need to be updated)
http://www.bleepingcomputer.com/forums/topict309.html

It is important that you go to one of the HiJackThis Support Forums below:
CastleCops HiJackThis Forum
http://castlecops.com/f67-Hijackthis_Spyware_Viruses_Worms_Trojans_Oh_My.html
or Bleeping Computer HiJackThis Forum
http://www.bleepingcomputer.com/forums/forum22.html
to allow the program experts there to evaluate your log and advise you of
any
necessary steps to clean your system.
(Note: Look for and read the "Important- Read This First" messages in the
sections for HiJackThis logs so that you follow proper procedure. You will
have to Register before posting on these Forums. Please follow all posting
instructions carefully to avoid having your log deleted or ignored.) They
are busy forums, so please be patient.

Feel free to tell them that I sent you from this newsgroup.

Hope this helps.

Jan
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm