I.E. 6.0 Browser problems... can't view..

Hi tate, its lots better now. :D

Just one entry left to fix and you can use Hijack This to fix it. Run Hijack This again and select the below entry and then click on Fix Selected.

F1 - win.ini: load=C:\ETRENDS\etrend32.exe

Then run a search for etrend32.exe and delete it.

Did you run LSPFix? If not, do so, there are still problems with your winsock layers.

I just saw your last post, have you rebooted tate?

Ok, here is the latest log...

I have to say though, I didnt want to get rid of my ebay toolbar, and my etrends.exe program. That company pays me to keep that link up all the time. I've had it up for several years now.
Ebay toolbar I've only had for 8 months. Is it really possible that those particular programs could have caused these problems??
Because I am still having no luck. Everything is still the same.

One strange thing too, once I finished all the things we did, as soon as i signed on my norton came up and found a virus q159920.exe which I quarintined. Strange,,,

Watch, now I'll start having all these problems after all this...
So.... what should we try next???

I really appreciate all of your help!!! I just get very nervous and frusturated, please try to bear with me!!


Logfile of HijackThis v1.92.1
Scan saved at 10:10:04 PM, on 3/18/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title=Microsoft Internet Explorer provided by Gateway 2000
O2 - BHO: (no name) - {004A5840-FF59-11d2-B50D-0090271D3FD4} - (no file)
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar_en_1.1.70-deleon.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WinPoET] c:\BANetDSL\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LicCtrl] runservice.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - Startup: Update LeaseWizard.lnk = C:\Program Files\LeaseWizard 3.4\WiseUpdt.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmtrans.html
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O15 - Trusted Zone: http://free.aol.com
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/game...ts/y/tt0_x.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://router.squirrelmonkey.com/act...CamControl.ocx
O16 - DPF: {47F591A2-8783-11D2-8343-00A0C945A819} (RFXPlayer Class) - http://download.richfx.com/player/me...t/twophase.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...617.7129398148

Hi tate - dont worry, I will stick with the thread until the problem is solved. I have to go out soon though so this will be my last post for a few hours.

OK, are you still getting the popup ads? If so, what ads are they and what site are you on when it happens?

If you are still having problems opening links in IE, try this next:

Close IE and go to Start > Run, and run the following commands one after the other, each line followed by 'enter':

regsvr32 shdocvw.dll
regsvr32 urlmon.dll
regsvr32 comcat.dll
regsvr32 actxprxy.dll
regsvr32 Oleaut32.dll
regsvr32 Mshtml.dll
regsvr32 shdoc401.dll

Run each line individually. After each run, you should see a short message stating the command was successful. Now reboot.

Ok I did all the runs you requested. The only error I received was
on the actxprxy.dll run
here was the error:

RegSvr32
Load Library ("actprxy.dll") falied to get last error returns Ox00000485.

Ok, so now what??

Thanks,
Tate;)

Hi tate - it looks like we have found the culprit for your links not opening. Check your spelling though first and try to run the command again (for actxprxy.dll only). If you get the same message, the file is either missing or corrupt.

OK, we will try restoring actxprxy.dll from the Win98 cab files on your CD using the System File Checker. Put your Win98 installation CD in your CD ROM drive and follow the instructions below:

1. Go to Start > Run and enter SFC and click OK
2. Check "Extract one File"
3. Enter the file name and click on "Start"
4. In the "Restore from" field enter:: D:\WIN98 (if 'D' is letter of your CD-Rom drive or change accordingly). In the "Save File In" box type C:\Windows\System.
5. When prompted to create a backup of the file, note the location of the Backup folder and click OK.
6. You then see the message "The file has been successfully extracted." Click OK to complete the process and restart your computer when prompted.

Post back and let us know how you get on.

Hello again,

Ok, I tried re running the problem .dll
It did work this time.
So I did not try restoring the file.

I also checked my example website that I used in the beginning of this posting inception. Everything seems to be working fine now, no problems viewing pages within pages on websites. No small pop up windows at my top left corner of the screen.

Looks as if I'm doing ok. Do you think I'm out of the clear??
I have a few other questions, if I am...

1. Am I always going to run into this problem sooner or later down the line??
2. Is there something I can do to prevent this from ever happening again??
3. Since I deleted ebays toolbar program and my etrends program, which I use on a daily basis,were these the central roots of the problem??
4. Can I reinstall these programs without running the risk of this happening again??
5. Was there some strange reason why last night when I booted up my computer found that virus all of a sudden?

Funny thing I never did mention that was also an ongoing problem, that seems to have now fixed itself, was I always had a problem printing on webpages sometimes it would print no problem, most times I would get an error message asking me if I wanted to run cgi scripts on the page, no matter whether I hit yes or no, it wouldn't let me print. The page would get stuck in my cue until I restarted the computer. Do you think this was the cause??

One last thing... what do you recommend for a program to rid spam from my email?? One person recommended mailwasher.

So in summary, my computers browser was hijacked??
can we find out exactly who hijacked it and how??

Again, thank you so much for all of your help!! Seems as if my computer is one big mess!!
Tate :rolleyes:

Hi Tate - your computer is just fine now. Your problem was caused by Spyware on your PC but all the junk has now been removed :D

1. Am I always going to run into this problem sooner or later down the line??

Not necessarily. Here is a great freeware program that you can install to prevent spyware being downloaded onto your PC. SpywareBlaster. You now have Spybot as well, update it regularly and run it every couple of weeks or so, just to be sure.

2. Is there something I can do to prevent this from ever happening again??

See my previous answer

3. Since I deleted ebays toolbar program and my etrends program, which I use on a daily basis,were these the central roots of the problem??

I dont know tate. You can try reinstalling them if you wish. You now know what to do if the problem reoccurs.

4. Can I reinstall these programs without running the risk of this happening again??

See above

5. Was there some strange reason why last night when I booted up my computer found that virus all of a sudden?

Sorry, I dont know but I suspect that it was a recent arrival on your PC or perhaps it had been there for a while and you just updated your definitions?

You are very welcome for the help. Happy surfing :D

Thank you so very very much for saving my computer!!!

:D

Quote:

---

One last thing... what do you recommend for a program to rid spam from my email?? One person recommended mailwasher.

---

Sorry, I just noticed that last question. Yes, absolutely, I think Mailwasher is a fantastic program. In fact I like it so much that I donated to the author when the only available version was free.

Well I'm back again, just ran the hijacking program my log below is the result.

Any suggestions on what to do when I run this program and a bunch of stuff comes up like this?? I mean really?? This is ridiculous!! :o

Logfile of HijackThis v1.92.1
Scan saved at 8:57:17 PM, on 4/25/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title=Microsoft Internet Explorer provided by Gateway 2000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL=http://proxycfg.marketscore.com/gencfg.asp?id1=ZZZZZZZZ010&id2=5077626CSMM&lp=1&nsv=5.1.1.1
O2 - BHO: (no name) - {004A5840-FF59-11d2-B50D-0090271D3FD4} - (no file)
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar_en_1.1.70-deleon.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WinPoET] c:\BANetDSL\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [MMTray] MMTray.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] PELMICED.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LicCtrl] runservice.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRAM FILES\AWS\WEATHERBUG\WEATHER.EXE 1
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Encoder Agent.lnk = C:\Program Files\Windows Media Components\Encoder\WMENCAGT.EXE
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\DOWNLOADED PROGRAM FILES\GOOGLETOOLBAR_EN_1.1.70-DELEON.DLL/cmtrans.html
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
O15 - Trusted Zone: http://free.aol.com
O16 - DPF: Yahoo! Literati - http://download.games.yahoo.com/game...ts/y/tt0_x.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://router.squirrelmonkey.com/act...CamControl.ocx
O16 - DPF: {47F591A2-8783-11D2-8343-00A0C945A819} (RFXPlayer Class) - http://download.richfx.com/player/me...t/twophase.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...617.7129398148
O16 - DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} (printQuick Browser Add In (Ver4)) - http://ibmezprint.com/plugin/axversi...tQuick1410.cab

Hi tate - most of those entries are fine. Have you installed Marketscore or Netsetter? If you have, go to Add/Remove Programs in Control Panel and uninstall it and then reboot.

Run Hijack This again and click on the below entry:


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int
ernet Settings,AutoConfigURL=http://proxycfg.marketscore.com/gencfg.asp?id1=ZZZZZZZZ010&id2=5077626CSMM&lp=1&nsv=5.1.1.1

and click on Fix Selected and reboot,

You should be fine now.