Help! "There was an internal error and one of the windows....."

[njbruin]

I'm in desparate need of help. Basically, I have no Web access with
my home computer (despite Norton anti-Virus and AdAware 6.0 both
installed and running). A few days ago, while running Internet
Explorer, I encountered very sluggish linking that within minutes
became a total block of access to the internet. An error message came
on that I had never seen before "There was an internal error and one
of the windows you were using will be closed." That "closing" led to
IE shutting down. Since then, this behavior has been repeated for
several days, despite running both Norton anti-virus and AdAware
programs. Something I've noticed during the problem is that some
mysterious IE windows start to appear along my lower task bar,
although selecting these tabs never does open a window.
During one session of battling this problem, I eventually induced the
message "IEXPLORE.exe has generated errors and will be closed by
Windows. You will need to restart the program." Of course, restarting
or rebooting did not help. This latter message became frequent about
a year ago, when I eventually had to reformat my drive! I hope I'm
not headed in that direction!
Can anyone help me with this problem???? thanks!!!

 

[Steve Duff [MVP]]

You either have malware (virus, trojan, adware) which seems
most likely.

Or you have a hardware problem -- possibly a bad spot on
your hard disk that is failing the application when it runs.

I would try to eliminate the hardware question first. Look in
the system event log for disk errors or other indications of
driver or hardware problems. Download and run the hard
drive manufacturer's fitness tester.

The 'popping' IE windows are admittedly a bad sign, though
they can occur for all kinds of reasons unrelated to infection.

You need to do a system scan with something that has
current signatures and is more suitable for spyware disinfection
than Norton.

Spybot 1.3 is good, the online scan at pandasoftware.com I've
found is excellent. And I'd also download and run CWShredder --
though the latest CWS mutations can not be cleaned out but
at least will be detected. (If you've got one of these latest ones
you're in for a real nightmare, but the symptoms don't really
match up with what you've said.)

Of course all of this is moot since you can't get your
browser running. If you can get a download of
Mozilla Firefox on to a CD on another computer, you can try
installing that which may bypass your IE problem and
allow you to access the network.

In the office here when someone brings in an infested
system we will usually take out and attach the machine's
hard drive to a dedicated workstation and scan it that way. You
can do this too if you have another computer. There is
actually little risk of cross-infection as the other machine won't
be booting from or using programs from the added drive. Still
you always have to be alert for that possibility.

Otherwise I'd suggest -- assuming you have enough free
space on your drive -- that you install a second, clean copy
of Windows. This will give you a 'dual boot system' where you
choose which version to boot when you start the computer.
(The first one on top will be the default boot, clean o/s.)

You can then get Internet access running in the clean
copy - hopefully, and then use that to scan and
scrub the system. In most cases malware
will not be attached to the new copy of Windows.

And if you do have one of the newer, scrubber-resistant
strains of CWS the second Windows copy is also very
handy as it gives you a way to easily delete its active files.

When you get finished, I'd advise that you configure the
optional "TeaTimer" component of Spybot 1.3, and
also perform its optional "immunization". Make sure
your Windowsupdates and antivirus signatures
are current. These steps will help curb future problems.

Steve Duff, MCSE, MVP
Ergodic Systems, Inc.

 

[njbruin]

Thanks for your detailed response. I will be trying to implement
these fixes. Your one suggestion sounds like I will need to section
my hard drive. I just wonder how easy that is to do? For exmaple,
can you do that while the drive retains its current files, prgrams,
etc.?