Trouble with IE

You can go in to hijackthis and restore the backup options from what was deleted ....
http://www.higaitaisaku.com/img/hijackthis18.png

To restore, you'd select every individual backup and click restore ....




However, it appears a rogue entry is still in there. Although its a headache, I would be tempted to do another scan and logfile post on here. The localhost entry is a malicious one. Redirecting you to 127.0.0.1 stops IE accessing the internet ...

The problem will be one of those toolbars probably ...

Quote:

---

Originally Posted by linsjean

wh666 and others,

I successfully uninstalled IE 8 and 9 from my laptop. Then I went to www.beautfyoftheweb.com and downloaded the installer for IE 9. I then installed it, it told me some files were in use and I had to restart. It went through all 3 phases and completed that process and said that IE was successfully installed. I then thought it was strange that I did not see a short cut, so I did a search for Internet Explorer using the search box in my Start button. Not there. I then went to Programs & Features and it's not there. I then proceeded to install again and it's telling me that I have a more recent version of IE on my computer.

Can someone please tell me how I can drop an image into the body of a post here?

Ok, go here please:

http://i1023.photobucket.com/albums/...rormessage.jpg

I'm starting to really hate IE. The only reason I want a second browser is for the obvious reason in case FF somehow crashes and I can't get it up and running and I need to do an emergercy email or research something.

What's next? Try to uninstall? How fun!

---

Yes ... Unfortunately, IE9 never really truly un-installs that easily ... Its still detecting IE9 on there, thats why it wont install IE9 again ...

There could be files or even reg keys left ... A quick attempt would be to use a registry cleaner like this one and then see if it will let you install IE9 ...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:31:12 AM, on 5/14/2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/res.../wlscctrl2.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6556 bytes

OK, so I d/l, installed and ran Wise Disk Cleaner and Wise Registry Cleaner. I did notice among the few hundred problems it listed, that I saw IE toolbar as a problem. Anyway, I just went with all the recommendations. 391 problems were fixed (Registry Cleaner) and that many to Safely remove. Kind of strange to see all the orange explanation marks with boxes next to them. Wondering if the program actually fixed them all or if it's just showing which ones were fixed.

Then I performed a defrag on both programs and now it wants me to restart my computer.

Back later again... Any suggestions on settings for these two programs I just installed and ran? And there must be a log somewhere.

ok, so after I ran the registry program, and restarted, I was able to download IE 9 from microsoft.com and it successfully installed, but darn if I can find even a shortcut or the main app using Explorer or going to All Programs.

I looked into CP, Installed Updates, and there is it. I was going to show you a snapshot of it, but Snipping Tool is now not working. I mean it works, but it won't "save as".

So IE 9 is there under Installed UPdates as of this date 5-14-11, but if I double-click on it, it is asking me if I want to uninstall.

WHAT IS ANOTHER WAY FOR ME TO SEE WHERE MY IE APP IS LOCATED ON MY DISK?

I also turned on Indexing (Windows Features) and System Restore in case anything happens to this machine. I did try to change within Windows Features from thumbnails to Icons, but got "not all were successfully changed".

How can I get back my Snipping tool to work? Or is there another program so I can show you a pic?

ONCE AGAIN, HOW DO I SHOW YOU A PIC HERE, INSTEAD OF GIVING YOU A LINK TO MY PHOTOBUCKET SITE?

OK, thanks, I'm running out of patience. And the only reason (once again) that I want another browswer is in case FF decides to crash. Then where would I be?

I'm afraid I"m making so many changes that I can't keep up with all of this. But at least I can come back here to see what has been done. And yes, I created a Restore date from System Restore.

one more thing, after I did all these changes, do you yet another Hijack This log?

Quote:

---

Originally Posted by linsjean

OK, so I d/l, installed and ran Wise Disk Cleaner and Wise Registry Cleaner. I did notice among the few hundred problems it listed, that I saw IE toolbar as a problem. Anyway, I just went with all the recommendations. 391 problems were fixed (Registry Cleaner) and that many to Safely remove. Kind of strange to see all the orange explanation marks with boxes next to them. Wondering if the program actually fixed them all or if it's just showing which ones were fixed.

Then I performed a defrag on both programs and now it wants me to restart my computer.

Back later again... Any suggestions on settings for these two programs I just installed and ran? And there must be a log somewhere.

---

I would stick to the green (safe) only options ....

Delete slightly the wrong entry on the orange (maybe) entries and you could damage the registry ....

Quote:

---

Originally Posted by linsjean

ok, so after I ran the registry program, and restarted, I was able to download IE 9 from microsoft.com and it successfully installed, but darn if I can find even a shortcut or the main app using Explorer or going to All Programs.

I looked into CP, Installed Updates, and there is it. I was going to show you a snapshot of it, but Snipping Tool is now not working. I mean it works, but it won't "save as".

So IE 9 is there under Installed UPdates as of this date 5-14-11, but if I double-click on it, it is asking me if I want to uninstall.

WHAT IS ANOTHER WAY FOR ME TO SEE WHERE MY IE APP IS LOCATED ON MY DISK?

I also turned on Indexing (Windows Features) and System Restore in case anything happens to this machine. I did try to change within Windows Features from thumbnails to Icons, but got "not all were successfully changed".

How can I get back my Snipping tool to work? Or is there another program so I can show you a pic?

ONCE AGAIN, HOW DO I SHOW YOU A PIC HERE, INSTEAD OF GIVING YOU A LINK TO MY PHOTOBUCKET SITE?

OK, thanks, I'm running out of patience. And the only reason (once again) that I want another browswer is in case FF decides to crash. Then where would I be?

I'm afraid I"m making so many changes that I can't keep up with all of this. But at least I can come back here to see what has been done. And yes, I created a Restore date from System Restore.

---

Go to search on the start menu, all files and folders, etc. then type in iexplore.exe ...

Should be in something like system/system32/windows/etc. One you find it, run it, check it says ie9 in Help>about. Send a shortcut to desktop (right click>send to>desktop create shortcut) ...



You can upload a pic on sharky in user cp>pictures/albums ... somewhere in there .. strict file sizes and dimensions though ...

In the go advanced view when posting, you can press the picture button or type [img] hyperlink goes here [/img] .....



You can leave on indexing and system restore if you want. It will eat in to resources massively though, but you have a more modern laptop now and you're not running XP.

I always disable BITS, auto updates, security centre, remote registry, system restore, fast user switching ... just as basic steps. Other things can be disabled, but those basics save so much memory and make a noticable speed increase ...

I always recommend, people make reg backups (start>run>regedit>select my computer>file>export>save in somewhere like c:\) and system restore points if they want, then switch off all MS services that eat in to memory. Also in the days of XP, alot of malware hid itself in system restore points, so it would come back whenever people did a restore ... Vista and win7 are a bit better though ...

Quote:

---

Originally Posted by linsjean

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (file missing)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [LWS] C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files\Windows Live\Companion\companioncore.dll
O9 - Extra button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/res.../wlscctrl2.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft Limited - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: UMVPFSrv - Logitech Inc. - C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6556 bytes

---

Highlighted the changes I would make in red. Now that the log is smaller, easier to pick things out.


Dont worry, it will save as backup points. If you have IE installed and working now, you may want to go in to backups first and delete your old ones ... It will save any changes you make this time around as well ...

wh666,

is there any way I can chat with you live? I have made too many changes since the last time I posted. Even that last Hijack log is probably not accurate. I'm seeing IE 7 now and did a shortcut, but that OS is not stable, and want to upadate (a friend of mine recommended me to uninstall IE 9 since it was not showing up anywhere when I did a search). Any way for me to chat with you, this is getting confusing and upsetting to me?

I turned on my computer this morning and I saw that Wise Disk Cleaner an by itself (I thought I changed that to run manually, when I choose to run it), but here's the log and it seems to be finding more and more junk files. Getting scared here. I hope it knows which things to remove that are safe to remove. I'm scared to runt he Registry Cleaner again. And I see one file on my desktop (A word file) that has been renamed sort of):

Wise Disk Cleaner Run At 5/14/2011 10:21:07 AM
============================================================ ===========
543 Junk file(s) found Sum Size:30.58 MB
541 Junk file(s) been removed Free disk space:30.36MB

Wise Disk Cleaner Run At 5/15/2011 6:53:03 AM
============================================================ ===========
36 Junk file(s) found Sum Size:2.18 MB
32 Junk file(s) been removed Free disk space:1.14MB