IE problem (error message, display wrong pages)

[JP]

hi everyone,

I got infected with trojan virus that messed up my pc. I needed to do a
reinstall of win xp pro. Ever since when I start IE7, I have 2 problems

1. error message (see attach my event log explaination). If I don't close
the box I can continue that I was doing.
Event Type: Error
Event Source: Application Error
Event Category: None
Event ID: 1000
Date: 11/28/2007
Time: 2:14:31 PM
User: N/A
Computer: PETITMONSTRE
Description:
Faulting application iexplore.exe, version 7.0.6000.16544, faulting module ,
version 0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 69 65 78 ure iex
0018: 70 6c 6f 72 65 2e 65 78 plore.ex
0020: 65 20 37 2e 30 2e 36 30 e 7.0.60
0028: 30 30 2e 31 36 35 34 34 00.16544
0030: 20 69 6e 20 20 30 2e 30 in 0.0
0038: 2e 30 2e 30 20 61 74 20 .0.0 at
0040: 6f 66 66 73 65 74 20 30 offset 0
0048: 30 30 30 30 30 30 30 0d 0000000.
0050: 0a .

2. I browse the internet and I have two more issues. I search something and
I get direct to the wrong page. I refresh to origin of the search. click
again on the link and get directed to the right page. sometime i get a blank
page with connection error message. run diagnostic apllication: no problem
detecteed.

I have tried to reinstall Ie7, remove adds-on like google toolbar, clean
cookies,...
I don't see anything close to my problem on the newsgroup. can anyone help?
thanks

 

[PA Bear]

Did you do a Repair Install or a format & reinstall of Windows?

What anti-virus application is installed? Is the Windows Firewall or a
third-party firewall enabled? Is the machine fully patched at Windows
Update?

 

[JP]

i did an install repair

Did you do a Repair Install or a format & reinstall of Windows?

What anti-virus application is installed? Is the Windows Firewall or a
third-party firewall enabled? Is the machine fully patched at Windows
Update?
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L.ORG http://66.39.69.143/

 

[JP]

hi
I use norton 360. I have windows firewall disabled. I use norton firewall.
and yes the machine is fully patched

 

[PA Bear]

A Repair Install would NOT have fixed the infection. IOW, the machine's
still infected and chances are that your Norton software still isn't
working/protecting you.

Either do a format & reinstall or run a /thorough/ check for hijackware,
including posting your hijackthis log to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L.ORG http://66.39.69.143/

 

[JP]

hi ,

I did what you have recommended me to remove hijacker and other trojan. It
seems to work I don't get the IE7 error message and the browser seems to take
me where I need. However, I think I was not carefull enough I must have
messed up my reg key I get two load error
_regsvr32 /u "C:\Documents and Settings\All Users\Application
Data\pgjcxohy.dll"
_ regsvr32 /u "C:\Documents and Settings\All Users\Application
Data\qtwdexiz.dll"
I don't understand I had set a backup setttings throught system restore in
accessorie. but I can not restore this backup.
what am I doing wrong?

 

[PA Bear]

The reply of mine that you quote doesn't include any recommendations.

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

 

[JP]

I was talking about the message where you sent me all the recommendation to
remove hijacker and spyware on 11/28 at 5:52 Pm.
thanks for your Pa Bear

 

[Elmo]

hi ,

I did what you have recommended me to remove hijacker and other Trojan. It
seems to work I don't get the IE7 error message and the browser seems to take
me where I need. However, I think I was not careful enough I must have
messed up my reg key I get two load error
_regsvr32 /u "C:\Documents and Settings\All Users\Application
Data\pgjcxohy.dll"
_ regsvr32 /u "C:\Documents and Settings\All Users\Application
Data\qtwdexiz.dll"
I don't understand I had set a backup settings through system restore in
Accessories. but I can not restore this backup.
what am I doing wrong?

Do this, once for each of the two files:

Click Start, Run, type REGEDIT, click OK. Press the Home key, press F3,
type the name of the file into the search pane. Click "Find Next", and
when located, delete the reference to the file. Press F3 to continue
the search.

You can click File, Export, and save the entry to the Desktop. If you
remove it and there's a problem, double-click the .reg file you exported
to the Desktop and it'll be added to the registry again. You can create
a restore point before editing the registry too.

 

[PA Bear]

Please post a link to the forum where you posted your HijackThis log for
review by an expert.

 

[Genehackman]

thanks to Pa Bear and Elmo. I think I fix those problems.