Big problems with IE6

[Gary Burton]

This may be the most difficult computer problem I have had in years. Internet Explorer version 6 has been invaded by something evil. I am running WinXP Home Edition, Service Pack 1. I have 2 machines sharing the same network connection. One is infected and the other is not. Most websites load fine on either machine. Only certain sites are affected, and only on one machine. But the affected sites are very important to me. This evil has two basic symptoms.
1) When I log on to certain web pages, the CPU gets bogged down, and if I try to close out the browser, it overloads the processor and slows to a crawl. If I try to close out the browser before the page finishes loading, the browser stops responding and refuses to close.
2) When I try to go to the Windows Update site (http://windowsupdate.microsoft.com) on the infected machine, I get a "This page cannot be displayed." message. If I do the same thing on the other machine, I get the correct page.

I have run scandisk, Norton Antivirus 2002 with the latest definitions, and AdAware Professional SE with the latest definitions. I did another full virus scan with the Trend Micro online scan. I cleaned the registry with RegSupreme.

I also did a poor-man's reinstall of Internet Explorer by installing with a right-click from the IE.INF file, but I did not overwrite newer files with the originals because I was afraid of what might happen. I may get up the courage to do that, if I don't get a better idea.

I tried to log on to Windows Update with another browser, hoping that the new security updates would correct the problem. I downloaded and installed both Opra and FireFox, but neither one of them would log on to anything. With FireFox, I got "The connection was refused when attempting to contact xxxx) where xxxx is the name of whatever site I typed into the address field. Opra gave me a similar result, but the error message was "Could not connect to remote server xxxx." I suspect that this is just another symptom of the same problem.

I installed Service Pack 2 about a month ago, but I had to uninstall it again because of problems it created with my video cards on both machines. I couldn't install it now if I wanted to because I can't get to the update site.

I could not find any clues in the MS Knowledge Base, or with various Google searches.

 

[Drew Tognola]

Gary,

I would download and run PestPatrol. PestPatrol finds a lot of adware & spyware Ad-Aware Pro SE doesn't find. I've had great results running both of those programs together. Sounds like you have some kind of spyware blocking your Windows Update link. Try the free scan from here: http://www.pestscan.com/ .

Drew
This may be the most difficult computer problem I have had in years. Internet Explorer version 6 has been invaded by something evil. I am running WinXP Home Edition, Service Pack 1. I have 2 machines sharing the same network connection. One is infected and the other is not. Most websites load fine on either machine. Only certain sites are affected, and only on one machine. But the affected sites are very important to me. This evil has two basic symptoms.
1) When I log on to certain web pages, the CPU gets bogged down, and if I try to close out the browser, it overloads the processor and slows to a crawl. If I try to close out the browser before the page finishes loading, the browser stops responding and refuses to close.
2) When I try to go to the Windows Update site (http://windowsupdate.microsoft.com) on the infected machine, I get a "This page cannot be displayed." message. If I do the same thing on the other machine, I get the correct page.

I have run scandisk, Norton Antivirus 2002 with the latest definitions, and AdAware Professional SE with the latest definitions. I did another full virus scan with the Trend Micro online scan. I cleaned the registry with RegSupreme.

I also did a poor-man's reinstall of Internet Explorer by installing with a right-click from the IE.INF file, but I did not overwrite newer files with the originals because I was afraid of what might happen. I may get up the courage to do that, if I don't get a better idea.

I tried to log on to Windows Update with another browser, hoping that the new security updates would correct the problem. I downloaded and installed both Opra and FireFox, but neither one of them would log on to anything. With FireFox, I got "The connection was refused when attempting to contact xxxx) where xxxx is the name of whatever site I typed into the address field. Opra gave me a similar result, but the error message was "Could not connect to remote server xxxx." I suspect that this is just another symptom of the same problem.

I installed Service Pack 2 about a month ago, but I had to uninstall it again because of problems it created with my video cards on both machines. I couldn't install it now if I wanted to because I can't get to the update site.

I could not find any clues in the MS Knowledge Base, or with various Google searches.

 

[Guest]

This may be the most difficult computer problem I have had in years. Internet Explorer version 6 has been invaded by something evil. I am running WinXP Home Edition, Service Pack 1. I have 2 machines sharing the same network connection. One is infected and the other is not. Most websites load fine on either machine. Only certain sites are affected, and only on one machine. But the affected sites are very important to me. This evil has two basic symptoms.
1) When I log on to certain web pages, the CPU gets bogged down, and if I try to close out the browser, it overloads the processor and slows to a crawl. If I try to close out the browser before the page finishes loading, the browser stops responding and refuses to close.
2) When I try to go to the Windows Update site (http://windowsupdate.microsoft.com) on the infected machine, I get a "This page cannot be displayed." message. If I do the same thing on the other machine, I get the correct page.

I have run scandisk, Norton Antivirus 2002 with the latest definitions, and AdAware Professional SE with the latest definitions. I did another full virus scan with the Trend Micro online scan. I cleaned the registry with RegSupreme.

I also did a poor-man's reinstall of Internet Explorer by installing with a right-click from the IE.INF file, but I did not overwrite newer files with the originals because I was afraid of what might happen. I may get up the courage to do that, if I don't get a better idea.

I tried to log on to Windows Update with another browser, hoping that the new security updates would correct the problem. I downloaded and installed both Opra and FireFox, but neither one of them would log on to anything. With FireFox, I got "The connection was refused when attempting to contact xxxx) where xxxx is the name of whatever site I typed into the address field. Opra gave me a similar result, but the error message was "Could not connect to remote server xxxx." I suspect that this is just another symptom of the same problem.

I installed Service Pack 2 about a month ago, but I had to uninstall it again because of problems it created with my video cards on both machines. I couldn't install it now if I wanted to because I can't get to the update site.

I could not find any clues in the MS Knowledge Base, or with various Google searches

Download "hijack this" and scan, save the file with notepad and post the
results
in the forums here
http://spywareinfo.com/

Hijack this - http://www.majorgeeks.com/download3155.html\
Something else you may need,
Reg lite
http://www.resplendence.com/reglite

 

[Gary Burton]

I still have the problem. Please stick with me a little longer. I
really appreciate your help. I got good suggestions from 3 people, of which
you were one. The information in this combined response will be relevant to
all three of you, if you are still willing to help me.

Here is what I have tried:
I have run all of the following scumware scanners. I have updated the
definitions unless otherwise stated. In the cases when I didn't update, it
was because I got a "Can't find server" error when I tried to update.
AdAware
SpyBot S&D
Pest Patrol. (Couldn't update). This was very encouraging because it
found several problems the other programs didn't find a problem with
references to Windowsupd2, but removing all of them did not allow me to log
on to the Windows Update site. A second scan with Pest Patrol found
nothing.
BHO Demon 2.0 (Couldn't update)
CW Shredder (Couldn't update)
HijackThis: I could only muster the courage to attempt to fix the O10
items (Hijacks of Winsock). I had 6 entries, and they were all the same:
"O10-Unknown file in Winsock LSP: c:\Windows\system32\jdmmbc.dll". My
courage was wasted because HijackThis never really deleted the entries. the
first time I tried, I was told that HijackThis could not delete the entries.
I tried it again several times anyway. On the repeat tries I wasn't not
told anything, but a re-scan showed them to still be there. I also had a
hits in the R0, R1, R3, O2, O4, O8, and O16 entries, but I did nothing about
them because the type descriptions did not seem to relate to my problem.

It seems like HijackThis could have been on the right track, but I was
not able to make it work.

I'm stumped again. Can you take me to another step?

Internet Explorer version 6 has been invaded by something evil. I am
running WinXP Home Edition, Service Pack 1. I have 2 machines sharing the
same network connection. One is infected and the other is not. Most
websites load fine on either machine. Only certain sites are affected, and
only on one machine. But the affected sites are very important to me. This
evil has two basic symptoms.and if I try to close out the browser, it overloads the processor and slows
to a crawl. If I try to close out the browser before the page finishes
loading, the browser stops responding and refuses to close.(http://windowsupdate.microsoft.com) on the infected machine, I get a "This
page cannot be displayed." message. If I do the same thing on the other
machine, I get the correct page.definitions, and AdAware Professional SE with the latest definitions. I did
another full virus scan with the Trend Micro online scan. I cleaned the
registry with RegSupreme.with a right-click from the IE.INF file, but I did not overwrite newer files
with the originals because I was afraid of what might happen. I may get up
the courage to do that, if I don't get a better idea.that the new security updates would correct the problem. I downloaded and
installed both Opra and FireFox, but neither one of them would log on to
anything. With FireFox, I got "The connection was refused when attempting
to contact xxxx) where xxxx is the name of whatever site I typed into the
address field. Opra gave me a similar result, but the error message was
"Could not connect to remote server xxxx." I suspect that this is just
another symptom of the same problem.it again because of problems it created with my video cards on both
machines. I couldn't install it now if I wanted to because I can't get to
the update site.

 

[Gary Burton]

I still have the problem. Please stick with me a little longer. I really appreciate your help. I got good suggestions from 3 people, of which you were one. The information in this combined response will be relevant to all three of you, if you are still willing to help me.

Here is what I have tried:
I have run all of the following scumware scanners. I have updated the definitions unless otherwise stated. In the cases when I didn't update, it was because I got a "Can't find server" error when I tried to update.
AdAware
SpyBot S&D
Pest Patrol. (Couldn't update). This was very encouraging because it found several problems the other programs didn't find a problem with references to Windowsupd2, but removing all of them did not allow me to log on to the Windows Update site. A second scan with Pest Patrol found nothing.
BHO Demon 2.0 (Couldn't update)
CW Shredder (Couldn't update)
HijackThis: I could only muster the courage to attempt to fix the O10 items (Hijacks of Winsock). I had 6 entries, and they were all the same: "O10-Unknown file in Winsock LSP: c:\Windows\system32\jdmmbc.dll". My courage was wasted because HijackThis never really deleted the entries. the first time I tried, I was told that HijackThis could not delete the entries. I tried it again several times anyway. On the repeat tries I wasn't not told anything, but a re-scan showed them to still be there. I also had a hits in the R0, R1, R3, O2, O4, O8, and O16 entries, but I did nothing about them because the type descriptions did not seem to relate to my problem.

It seems like HijackThis could have been on the right track, but I was not able to make it work.

I'm stumped again. Can you take me to another step?

Gary,

I would download and run PestPatrol. PestPatrol finds a lot of adware & spyware Ad-Aware Pro SE doesn't find. I've had great results running both of those programs together. Sounds like you have some kind of spyware blocking your Windows Update link. Try the free scan from here: http://www.pestscan.com/ .

Drew
This may be the most difficult computer problem I have had in years. Internet Explorer version 6 has been invaded by something evil. I am running WinXP Home Edition, Service Pack 1. I have 2 machines sharing the same network connection. One is infected and the other is not. Most websites load fine on either machine. Only certain sites are affected, and only on one machine. But the affected sites are very important to me. This evil has two basic symptoms.
1) When I log on to certain web pages, the CPU gets bogged down, and if I try to close out the browser, it overloads the processor and slows to a crawl. If I try to close out the browser before the page finishes loading, the browser stops responding and refuses to close.
2) When I try to go to the Windows Update site (http://windowsupdate.microsoft.com) on the infected machine, I get a "This page cannot be displayed." message. If I do the same thing on the other machine, I get the correct page.

I have run scandisk, Norton Antivirus 2002 with the latest definitions, and AdAware Professional SE with the latest definitions. I did another full virus scan with the Trend Micro online scan. I cleaned the registry with RegSupreme.

I also did a poor-man's reinstall of Internet Explorer by installing with a right-click from the IE.INF file, but I did not overwrite newer files with the originals because I was afraid of what might happen. I may get up the courage to do that, if I don't get a better idea.

I tried to log on to Windows Update with another browser, hoping that the new security updates would correct the problem. I downloaded and installed both Opra and FireFox, but neither one of them would log on to anything. With FireFox, I got "The connection was refused when attempting to contact xxxx) where xxxx is the name of whatever site I typed into the address field. Opra gave me a similar result, but the error message was "Could not connect to remote server xxxx." I suspect that this is just another symptom of the same problem.

I installed Service Pack 2 about a month ago, but I had to uninstall it again because of problems it created with my video cards on both machines. I couldn't install it now if I wanted to because I can't get to the update site.

I could not find any clues in the MS Knowledge Base, or with various Google searches.

 

[Gary Burton]

I just noticed that if I enter the url www.windowsupdate.microsoft.com into my address bar, it gets converted to
http:///? www.windowsupdate.microsoft.com. Note the giberish between "///" and "www". That must be an important clue, but I'm not smart enough to figure it out. I'm hoping that one of you is.

Here are the things I have tried since my original posting:

I have run all of the following scumware scanners. I have updated the definitions unless otherwise stated. In the cases when I didn't update, it was because I got a "Can't find server" error when I tried to update.
AdAware
SpyBot S&D
Pest Patrol. (Couldn't update). This was very encouraging because it found several problems the other programs didn't find a problem with references to Windowsupd2, but removing all of them did not allow me to log on to the Windows Update site. A second scan with Pest Patrol found nothing.
BHO Demon 2.0 (Couldn't update)
CW Shredder (Couldn't update)
HijackThis: I could only muster the courage to attempt to fix the O10 items (Hijacks of Winsock). I had 6 entries, and they were all the same: "O10-Unknown file in Winsock LSP: c:\Windows\system32\jdmmbc.dll". My courage was wasted because HijackThis never really deleted the entries. the first time I tried, I was told that HijackThis could not delete the entries. I tried it again several times anyway. On the repeat tries I wasn't not told anything, but a re-scan showed them to still be there. I also had a hits in the R0, R1, R3, O2, O4, O8, and O16 entries, but I did nothing about them because the type descriptions did not seem to relate to my problem.

It seems like HijackThis could have been on the right track, but I was not able to make it work.

I'm stumped again. Please take me to another step?

 

[Frank Saunders, MS-MVP IE/OE]

I just noticed that if I enter the url
www.windowsupdate.microsoft.com into my address bar, it gets
converted to
http:///? www.windowsupdate.microsoft.com. Note the giberish
between "///" and "www". That must be an important clue, but I'm not
smart enough to figure it out. I'm hoping that one of you is.

Here are the things I have tried since my original posting:

I have run all of the following scumware scanners. I have updated
the definitions unless otherwise stated. In the cases when I didn't
update, it was because I got a "Can't find server" error when I tried
to update.
AdAware
SpyBot S&D
Pest Patrol. (Couldn't update). This was very encouraging
because it found several problems the other programs didn't find a
problem with references to Windowsupd2, but removing all of them did
not allow me to log on to the Windows Update site. A second scan
with Pest Patrol found nothing.
BHO Demon 2.0 (Couldn't update)
CW Shredder (Couldn't update)
HijackThis: I could only muster the courage to attempt to fix
the O10 items (Hijacks of Winsock). I had 6 entries, and they were
all the same: "O10-Unknown file in Winsock LSP:
c:\Windows\system32\jdmmbc.dll". My courage was wasted because
HijackThis never really deleted the entries. the first time I tried,
I was told that HijackThis could not delete the entries. I tried it
again several times anyway. On the repeat tries I wasn't not told
anything, but a re-scan showed them to still be there. I also had a
hits in the R0, R1, R3, O2, O4, O8, and O16 entries, but I did
nothing about them because the type descriptions did not seem to
relate to my problem.

It seems like HijackThis could have been on the right track, but
I was not able to make it work.

I'm stumped again. Please take me to another step?

**Post your HijackThis log to
http://forums.spywareinfo.com/ or the Spyware forum at
http://forum.aumha.org/ for expert analysis.**

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com/security/protect/