IE has encountered a problem and needs to close

G

Guest

I constantly get this message (IE has encountered a problem and needs to
close) when I am on-line and then IE closes (I am sending this from another
computer). There is help on the Microsoft Internet site for this problem but
not for the codes I get which are: Mod Name: unknown; ModVer: 0.0.0.0; and
Offset: 00000000. I have downloaded all the IE and Microsoft updates and have
run all the virus, spyware, etc., programs to no avail. Any other
suggestions?
 
F

Frank Saunders, MS-MVP IE/OE

bikerick said:
I constantly get this message (IE has encountered a problem and needs
to close) when I am on-line and then IE closes (I am sending this
from another computer). There is help on the Microsoft Internet site
for this problem but not for the codes I get which are: Mod Name:
unknown; ModVer: 0.0.0.0; and Offset: 00000000. I have downloaded all
the IE and Microsoft updates and have run all the virus, spyware,
etc., programs to no avail. Any other suggestions?
Click to expand...

First eliminate any spyware.
What You Should Know About Spyware
http://www.microsoft.com/athome/security/spyware/devioussoftware.mspx

CAUTION!!!!! Removing some spyware can damage the Winsock stack and you may
not be able to connect to the Internet. Before you try to remove spyware,
download a copy of LSP-Fix - a free program to repair damaged Winsock 2
stacks (all Windows versions)
http://www.cexx.org/lspfix.htm
Winsockfix for W95, W98, ME, NT, 2000, XP
http://www.tacktech.com/pub/winsockfix/WinsockFix.zip
Directions here: http://www.tacktech.com/display.cfm?ttid=257
WinXP:
Get WinSockxpFix
http://www.spychecker.com/program/winsockxpfix.html
How to Reset Internet Protocol (TCP/IP) in Windows XP
http://support.microsoft.com/kb/299357
In WinXP SP2: You can fix Winsock by going to Start | Run and typing
CMD
In the command window type
netsh winsock reset

See
Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm
Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/data/tshoot.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/
 
J

Jan Il

Hi bikerick :)

You likely have a hijacker and/or malware on your system. Follow the
instructions below to fully clean your system:

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm

Courtesy of PA Bear -

'Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/data/tshoot.htm
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/

Hope this helps.

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
 
G

Guest

Have you fixed it cause I'm having the same problem and don't knowhow to fix
it,
new on the computer Karen
 
G

Guest

I am still having this problem and need HELP. I couldn't get to this response
page using my Internet Explorer. So far I have done all of the following and
the problem remains:
1. turned off third-party browser extensions
2. Ran Spybot 1.4 & made corrections
3. Ran Ad-aware & made corrections
4. Ran Norton anti-virus & made corrections
5. Ran Hijack this & made corrections
6. Ran LSP-Fix
7. did this:Control Panel | Internet Options | Click on the "Security" tab
Highlight the "Internet" icon, click "Default Level"
8. did this: Control Panel | Internet Options | Click on the "Content" tab,
Click the "Publishers" button Highlight and click "Remove" any unknowns,
click Ok
9. did this: Control Panel | Internet Options | Advanced" tab Uncheck:
"Install on demand (other)", click Apply\Ok
 
J

Jan Il

Hi bikerick :)

Please post the link to the forum where you posted your HiJackThis log so
that we can review the log and thread there.

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
 
G

Guest

Here is the log with comments on those that looked suspicious and notations
after the two that were fixed. I did not post this anywhere, but went through
each entry with an friend who maintains a computer network for a living:
Logfile of HijackThis v1.98.2
Scan saved at 7:27:43 PM, on 7/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PowerPanel\upssrv.exe OK part of Dell
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\PowerPanel\upsio.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\BCMSMMSG.exe OK That's driver software for Broadcomm's BCM
Voicemodems
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Virtual Account Numbers\CitiUCS.exe
C:\WINDOWS\System32\WDBtnMgr.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Discover Deskshop\Deskshop.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe OK Scotty
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Photoleap\Photoleap.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BHOPPToolbar Class - {34F09BB8-7850-4560-ABDF-A3A0C0C17A9D} -
C:\Program Files\Photoleap\PLShell.DLL
O2 - BHO: CitiUS Shared Browser Helper Object -
{387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\System32\BhoCitUS.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -
C:\WINDOWS\system32\dla\tfswshx.dll OK tfswshx.dll is a module belonging
Veritas and Sonic software
O2 - BHO: Discover deskshop Browser Helper Object -
{8DB3D69D-DA5E-4165-B781-72A761790672} - C:\WINDOWS\System32\BhoDshop.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: UCS Shared Browser Helper Object -
{F1D49A84-8656-43ce-AE3D-AABC1A12243E} - C:\WINDOWS\System32\BhoUCS.dll
DELETED
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx OK msdxm.ocx is an ActiveX Control module used
by the Windows Media Player
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup OK NvCplDaemon (NvQTwk.dll) is a
module related to Nvidia graphics cards
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe OK tfswctrl.exe
is an essential process for HP's packet writing software which burns data
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update
Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec
Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton
SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [CitiUCS] C:\Program Files\Virtual Account
Numbers\CitiUCS.exe /dontopenmycards
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe OK WD Button Manager
application manages the dual-option backup functionality
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft
Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program
Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program
Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer
OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [DiscoverDeskshop] C:\Program Files\Discover
Deskshop\Deskshop.exe /dontopenmycards
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP
Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CitiVAN] C:\Program Files\Citi Virtual Account
Numbers\CitiVAN.exe /dontopenmycards
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton
SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE
CfgWiz
O4 - HKCU\..\Run: [Photoleap] C:\Program Files\Photoleap\Photoleap.exe -silent
O8 - Extra context menu item: &Search -
http://bar.mywebsearch.com/menusearch.html?p=ZNxdm117YYUS DELETED
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} -
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
O9 - Extra button: UCS - {4C730923-3961-439b-83D5-F4E445520422} - C:\Program
Files\Virtual Account Numbers\CitiUCS.exe
O9 - Extra button: Photoleap - {749A7E5B-0C26-47b2-B6B3-E1F811D6643B} -
C:\Program Files\Photoleap\PLShell.DLL
O9 - Extra 'Tools' menuitem: Photoleap -
{749A7E5B-0C26-47b2-B6B3-E1F811D6643B} - C:\Program
Files\Photoleap\PLShell.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Deskshop - {F74E75A5-96BF-40ef-A1C8-88EAEBB82AB6} -
C:\Program Files\Discover Deskshop\Deskshop.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) -
http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab OK
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) -
https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {21F16767-8DA7-4113-BEB0-F161B313407F} -
http://www.myfamily.com/plugins/ue/Install_UE.exe
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) -
https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} -
C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll
 
F

Frank Saunders, MS-MVP IE/OE

bikerick said:
Here is the log with comments on those that looked suspicious and
notations
after the two that were fixed. I did not post this anywhere, but went
through
each entry with an friend who maintains a computer network for a
living:
Logfile of HijackThis v1.98.2
Scan saved at 7:27:43 PM, on 7/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PowerPanel\upssrv.exe OK part of Dell
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\PowerPanel\upsio.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\BCMSMMSG.exe OK That's driver software for Broadcomm's BCM
Voicemodems
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Virtual Account Numbers\CitiUCS.exe
C:\WINDOWS\System32\WDBtnMgr.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Discover Deskshop\Deskshop.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe OK Scotty
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Photoleap\Photoleap.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BHOPPToolbar Class - {34F09BB8-7850-4560-ABDF-A3A0C0C17A9D}
-
C:\Program Files\Photoleap\PLShell.DLL
O2 - BHO: CitiUS Shared Browser Helper Object -
{387EDF53-1CF2-4523-BC2F-13462651BE8C} -
C:\WINDOWS\System32\BhoCitUS.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -
C:\WINDOWS\system32\dla\tfswshx.dll OK tfswshx.dll is a module
belonging
Veritas and Sonic software
O2 - BHO: Discover deskshop Browser Helper Object -
{8DB3D69D-DA5E-4165-B781-72A761790672} -
C:\WINDOWS\System32\BhoDshop.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: UCS Shared Browser Helper Object -
{F1D49A84-8656-43ce-AE3D-AABC1A12243E} -
C:\WINDOWS\System32\BhoUCS.dll
DELETED
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx OK msdxm.ocx is an ActiveX Control
module used
by the Windows Media Player
O3 - Toolbar: Norton AntiVirus -
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup OK NvCplDaemon (NvQTwk.dll)
is a
module related to Nvidia graphics cards
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe OK
tfswctrl.exe
is an essential process for HP's packet writing software which burns
data
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common
Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common
Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton
SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [CitiUCS] C:\Program Files\Virtual Account
Numbers\CitiUCS.exe /dontopenmycards
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe OK WD Button
Manager
application manages the dual-option backup functionality
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common
Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program
Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program
Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer
OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [DiscoverDeskshop] C:\Program Files\Discover
Deskshop\Deskshop.exe /dontopenmycards
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program
Files\Hewlett-Packard\HP
Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol]
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program
Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CitiVAN] C:\Program Files\Citi Virtual Account
Numbers\CitiVAN.exe /dontopenmycards
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton
SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A}
/MODE
CfgWiz
O4 - HKCU\..\Run: [Photoleap] C:\Program
Files\Photoleap\Photoleap.exe -silent
O8 - Extra context menu item: &Search -
http://bar.mywebsearch.com/menusearch.html?p=ZNxdm117YYUS DELETED
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
-
C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} -
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
O9 - Extra button: UCS - {4C730923-3961-439b-83D5-F4E445520422} -
C:\Program Files\Virtual Account Numbers\CitiUCS.exe
O9 - Extra button: Photoleap - {749A7E5B-0C26-47b2-B6B3-E1F811D6643B}
-
C:\Program Files\Photoleap\PLShell.DLL
O9 - Extra 'Tools' menuitem: Photoleap -
{749A7E5B-0C26-47b2-B6B3-E1F811D6643B} - C:\Program
Files\Photoleap\PLShell.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Deskshop - {F74E75A5-96BF-40ef-A1C8-88EAEBB82AB6} -
C:\Program Files\Discover Deskshop\Deskshop.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
-
C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) -
http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
OK O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class)
- https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {21F16767-8DA7-4113-BEB0-F161B313407F} -
http://www.myfamily.com/plugins/ue/Install_UE.exe
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj
Class) - https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo
Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) -
https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} -
C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll


Jan Il said:
Hi bikerick :)

Please post the link to the forum where you posted your HiJackThis
log so that we can review the log and thread there.

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies posted only to the newsgroup for the benefit or other
readers. How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
Click to expand...
Click to expand...

This is not the right place to post your HijackThis log.
Register here: http://aumha.net/profile.php?mode=register
Once you have received your registration confirmation, post your HJT
log here: *(for expert analysis)*
http://aumha.net/viewforum.php?f=30

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/
 
J

Jan Il

Hi bikerick :)

As Frank stated, you should post your log to the HJT forums so that it can
be fully analyzed by the experts at the forum. Unless you are a trained
expert with HJT, it is important that you don't remove any files or you can
seriously damage your system. Please post the link to the forum where you
post your log so that we can follow your progress.

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm


Here is the log with comments on those that looked suspicious and
notations
after the two that were fixed. I did not post this anywhere, but went
through
each entry with an friend who maintains a computer network for a living:
Logfile of HijackThis v1.98.2
Scan saved at 7:27:43 PM, on 7/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PowerPanel\upssrv.exe OK part of Dell
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe
C:\PowerPanel\upsio.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\BCMSMMSG.exe OK That's driver software for Broadcomm's BCM
Voicemodems
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\GhostTray.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Virtual Account Numbers\CitiUCS.exe
C:\WINDOWS\System32\WDBtnMgr.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Discover Deskshop\Deskshop.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe OK Scotty
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Photoleap\Photoleap.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: BHOPPToolbar Class - {34F09BB8-7850-4560-ABDF-A3A0C0C17A9D} -
C:\Program Files\Photoleap\PLShell.DLL
O2 - BHO: CitiUS Shared Browser Helper Object -
{387EDF53-1CF2-4523-BC2F-13462651BE8C} - C:\WINDOWS\System32\BhoCitUS.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -
C:\WINDOWS\system32\dla\tfswshx.dll OK tfswshx.dll is a module belonging
Veritas and Sonic software
O2 - BHO: Discover deskshop Browser Helper Object -
{8DB3D69D-DA5E-4165-B781-72A761790672} - C:\WINDOWS\System32\BhoDshop.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: UCS Shared Browser Helper Object -
{F1D49A84-8656-43ce-AE3D-AABC1A12243E} - C:\WINDOWS\System32\BhoUCS.dll
DELETED
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx OK msdxm.ocx is an ActiveX Control module
used
by the Windows Media Player
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup OK NvCplDaemon (NvQTwk.dll) is a
module related to Nvidia graphics cards
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe OK
tfswctrl.exe
is an essential process for HP's packet writing software which burns data
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common
Files\Sonic\Update
Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec
Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Norton Ghost 9.0] C:\Program Files\Norton
SystemWorks\Norton Ghost\Agent\GhostTray.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [CitiUCS] C:\Program Files\Virtual Account
Numbers\CitiUCS.exe /dontopenmycards
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe OK WD Button Manager
application manages the dual-option backup functionality
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft
Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program
Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program
Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer
OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [DiscoverDeskshop] C:\Program Files\Discover
Deskshop\Deskshop.exe /dontopenmycards
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program
Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program
Files\Hewlett-Packard\HP
Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe"
-atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program
Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [CitiVAN] C:\Program Files\Citi Virtual Account
Numbers\CitiVAN.exe /dontopenmycards
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton
SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE
CfgWiz
O4 - HKCU\..\Run: [Photoleap] C:\Program
Files\Photoleap\Photoleap.exe -silent
O8 - Extra context menu item: &Search -
http://bar.mywebsearch.com/menusearch.html?p=ZNxdm117YYUS DELETED
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Citi - {4C730913-3961-439b-83D5-F4E445520422} -
C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
O9 - Extra button: UCS - {4C730923-3961-439b-83D5-F4E445520422} -
C:\Program
Files\Virtual Account Numbers\CitiUCS.exe
O9 - Extra button: Photoleap - {749A7E5B-0C26-47b2-B6B3-E1F811D6643B} -
C:\Program Files\Photoleap\PLShell.DLL
O9 - Extra 'Tools' menuitem: Photoleap -
{749A7E5B-0C26-47b2-B6B3-E1F811D6643B} - C:\Program
Files\Photoleap\PLShell.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Deskshop - {F74E75A5-96BF-40ef-A1C8-88EAEBB82AB6} -
C:\Program Files\Discover Deskshop\Deskshop.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\MSMSGS.EXE
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) -
http://www.lizardtech.com/download/files/win/djvuplugin/en_US/DjVuControl_en_US.cab
OK
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) -
https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {21F16767-8DA7-4113-BEB0-F161B313407F} -
http://www.myfamily.com/plugins/ue/Install_UE.exe
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) -
https://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -
https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) -
https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} -
C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll


Jan Il said:
Hi bikerick :)

Please post the link to the forum where you posted your HiJackThis log so
that we can review the log and thread there.

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
Click to expand...
Click to expand...
 
J

Jan Il

Hi bikerick :)

Thank you for the link. Did you run the HiJackThis scan in Safe Mode with
Hidden Files enabled?
That is the surest way to get a good full scan. If you didn't then please
do so and then repost the new log to the same post you have at the forum
now, and be sure to say it is a new log.

How to Show Hidden Files
http://snipurl.com/6rl8

How to Restart in Safe Mode
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

The folks at the forum are very busy and it might take a bit for them to get
to your log, so please be patient. If you did not click the box for email
notification at the bottom when you submitted your original post, you can
click the Edit button at the top of your original post and then check the
box at the bottom where is says to notify you when there is a response. Then
you will get an email notice when someone posts a reply and you can go
check.

Hope this helps.

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
 
F

Frank Saunders, MS-MVP IE/OE

Jan Il said:
Hi bikerick :)

Thank you for the link. Did you run the HiJackThis scan in Safe Mode
with Hidden Files enabled?
That is the surest way to get a good full scan. If you didn't then
please do so and then repost the new log to the same post you have at
the forum now, and be sure to say it is a new log.

How to Show Hidden Files
http://snipurl.com/6rl8

How to Restart in Safe Mode
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

The folks at the forum are very busy and it might take a bit for them
to get to your log, so please be patient. If you did not click the
box for email notification at the bottom when you submitted your
original post, you can click the Edit button at the top of your
original post and then check the box at the bottom where is says to
notify you when there is a response. Then you will get an email
notice when someone posts a reply and you can go check.

Hope this helps.

Jan :)
MS MVP - IE/OE
Click to expand...

No, HijackThis has to be run after a normal boot, otherwise the processes
won't be running. It's anti-virus and anti-spyware programs that benefit
from being run in Safe Modr.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/
 
P

PA Bear

This conversation should be confined to the Aumha Forums thread now.

Jan, why are you suggesting that Rick scan in Safe Mode/ShowHiddenFiles
environment?
 
J

Jan Il

PA Bear said:
This conversation should be confined to the Aumha Forums thread now.

Jan, why are you suggesting that Rick scan in Safe Mode/ShowHiddenFiles
environment?
Click to expand...

Sorry...Rick, my bad. I forgot HiJackThis does not need to be run in Safe
Mode as many other scan programs do.

Jan :)
MS MVP - IE/OE
 
P

PA Bear

Jan said:
Sorry...Rick, my bad. I forgot HiJackThis does not need to be run in Safe
Mode as many other scan programs do.
Click to expand...

There are instances when running HT in Safe Mode/ShowHiddenFiles environment
is called for. I thought maybe you knew something I didn't regarding Rick's
infections/logs.
 
J

Jan Il

PA Bear said:
There are instances when running HT in Safe Mode/ShowHiddenFiles
environment is called for. I thought maybe you knew something I didn't
regarding Rick's infections/logs.
Click to expand...

No. I just like to cross all the t's and dot all the i's.....just in case.
If I had believed AdAware...I'd likely still have the IST.BAR. <s>

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.
 
G

Guest

I have installed a new hard drive and so far in limited use Internet Explorer
has not crashed, but I won't get a chance to really test it out until I
return from vacation in a few weeks, Rick
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Internet Explorer has encountered a problem and needs to close. W 5
Encountered a problem and needs to close 2
Internet explorer has encountered an error and needs to close 2
"Internet Explorer error. IE has encountered a problem needs to cl 4
"IE has encountered a problem and needs to close" 3
IE6 needs to close 3
IE has encountered a problem and needs to close... 3
"Internet Explorer has encountered a problem and needs to close 5

Top