XP SP2 hangs when shuting down IE

[kahout]

I am experiencing a complete hang of XP when I shut down IE. This lasts for
about 40 seconds; afterwards everything returns to normal. I installed XP
SP2 with the network install file. That is when this developed.

I am also experiencing "not responding" conditions of IE more frequently.
It used to be an occasional annoyance with IE; now it's frequent but not
consistent.

Anyone else experiencing this or have a solution?

Kevin

 

[PA Bear]

Check your system for "hijackware":

Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/Darnit.htm

CoolWebSearch Chronicles
http://www.spywareinfo.com/~merijn/cwschronicles.html

Run these tools in the following order with nothing else running in
background:

1. CWShredder (fix all found)

2. Ad-Aware (fix all found)

3. Spybot (RTFM but generally fix everything in red)

Important: You *must* seek updates for Ad-Aware, Spybot, etc., before each
and every use, even "right out of the box". But even they can't catch
everything, 24/7. When all else fails, HijackThis
(http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the preferred
tool to use. It will help you to both identify and remove any
hijackware/spyware. **Post your files to http://forums.spywareinfo.com/ or
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**

[Alternate download pages for many of the above tools may be found at
http://aumha.org/a/parasite.htm.]

Also:

1. Download and run Stinger (http://vil.nai.com/vil/stinger/); then...

2. Update your virus definitions, enable Show Hidden Files
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
and then run a full system scan in Safe Mode
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
with nothing else running in background. Note the files identified and
removed then find the corresponding page for the file at your AV maker's
online support pages (e.g.,
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
and follow all Removal steps.

WinXP Only (WinME similar): If this scan finds anything, create a new
Restore Point then Disk Cleanup > More options > Delete all but the most
recent Restore Point.

3. Check in at Windows Update.

So How Did I Get Infected Anyway?
http://boards.cexx.org/viewtopic.php?t=957

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE), AH-VSOP

Are You Ready for WinXP SP2?
http://support.microsoft.com/default.aspx?pr=windowsxpsp2

What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

AumHa Forums
http://forum.aumha.org

 

[kahout]

PA Bear,

Spybot found two things missed by the other programs. 1) A DyFuCA registry
entry which was trying to install a file that was to be downloaded. The
download had been stopped by my firewall at some point. 2) A DSO exploit of
questionable relevance but I manually corrected the registry keys to a
dword=3 for zone 0 in several keys.

Thanks for the long list of suggestions. I had been running AdAware, but to
be fair I had not upgraded to the SE version. At Spybot's suggestion I also
got rid of the eBay toolbar for privacy concerns.

It is either an odd coincidence or just bad luck that problems only
developed after the SP2 upgrade.

Thanks again,

Kevin

PA Bear wrote:
| Check your system for "hijackware":
|
| Help with Hijackware
| http://aumha.org/a/parasite.htm
| http://aumha.org/a/quickfix.htm
| http://mvps.org/winhelp2002/unwanted.htm
| http://inetexplorer.mvps.org/Darnit.htm
|
| CoolWebSearch Chronicles
| http://www.spywareinfo.com/~merijn/cwschronicles.html
|
| Run these tools in the following order with nothing else running in
| background:
|
| 1. CWShredder (fix all found)
|
| 2. Ad-Aware (fix all found)
|
| 3. Spybot (RTFM but generally fix everything in red)
|
<SNIP>
| kahout wrote:
|| I am experiencing a complete hang of XP when I shut down IE. This
|| lasts for about 40 seconds; afterwards everything returns to normal.
|| I installed XP SP2 with the network install file. That is when this
|| developed.
||
|| I am also experiencing "not responding" conditions of IE more
|| frequently. It used to be an occasional annoyance with IE; now it's
|| frequent but not consistent.
||
|| Anyone else experiencing this or have a solution?
||
|| Kevin

 

[PA Bear]

The DSO exploit is a well-known bug in the current version of Spybot. You
may ignore it as long as your default homepage and search is what you've
chosen them to be.

Did dealing with the DyFuCA entry take care of your problem? If not,
consider posting to a WinXP group such as