Hi. I think the problem started when i installed norton systemworks 2006. This program did not load (always stuck) and removed it. since then i open ie and when hit enter to access a page (whatever the page is) the ie crashes. I also found that it crashes when i click HELP->ABOUT INTERNET EXPLORER in the menu. I tried everything. Smitfraud, hijackthis, but without solving the problem.

[Reply or follow-up to this message]

If I understand correctly, you have uninstalled NIS. Did you run a removal tool afterwards? 
After a normal uninstall of Norton programs, there are still a lot of leftovers to 
clear out. 

Running a removal tool, and then some.. are necessary. You'll need to do this first, 
then address the IE related issues, if you still have problems. It may very well 
be related.

Good luck, and let us know if you still have problems with IE afterwards.

How to Fully Remove Norton 2004 and newer
http://www.bleepingcomputer.com/forums/topic42247.html


Blocking Unwanted Parasites with a Hosts File

Oups. I forgot to tell you that i run a program called norton_removal_tool that i have downloaded from symantec. I also deleted every track in the registry by myself! What else should i do? The only thing that is probably false in the hijackthis is: O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll But i cannot delete it!!!! Here is the complete analysis of HJT: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 10:35:34 μμ, on 28/8/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\csrss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Customizer XP\RAMIdle.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0.1.411\avp.exe D:\Program Files\SAGEM\OTEnet-SAGEM Fast 800-840\dslmon.exe D:\Program Files\Zone Labs\ZoneAlarm\zapro.exe D:\WINDOWS\system32\ZoneLabs\vsmon.exe D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0.1.411\avp.exe D:\Program Files\Spyware Doctor\sdhelp.exe D:\WINDOWS\system32\ZoneLabs\MINILOG.EXE D:\WINDOWS\System32\tcpsvcs.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\wdfmgr.exe D:\WINDOWS\System32\alg.exe D:\WINDOWS\explorer.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\Documents and Settings\KK21\Desktop\HiJackThis_v2.exe D:\WINDOWS\System32\wbem\wmiprvse.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O3 - Toolbar: Systran40premi.IEPlugIn - {CFB25594-4D5F-11D6-AB7B-00B0D094B576} - D:\Program Files\Systran\4_0\Premium\IEPlugIn.dll O4 - HKLM\..\Run: [RAM Idle] D:\Program Files\Customizer XP\RAMIdle.exe O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - Startup: BHODemon 2.0.lnk = D:\Program Files\BHODemon 2\BHODemon.exe O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: DSLMON.lnk = D:\Program Files\SAGEM\OTEnet-SAGEM Fast 800-840\dslmon.exe O4 - Global Startup: ZoneAlarm Pro.lnk = D:\Program Files\Zone Labs\ZoneAlarm\zapro.exe O8 - Extra context menu item: Download All with FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download with FlashGet - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: Ε&ξαγωγή στο Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0.1.411\scieplugin.dll O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll O15 - Trusted Zone: http://www.msi.com.tw O17 - HKLM\System\CCS\Services\Tcpip\..\{13CD17E2-D77D-4FBE-9DB2-5734D65EE0B4}: NameServer = 195.251.25.60 194.177.210.211 O17 - HKLM\System\CS2\Services\Tcpip\..\{13CD17E2-D77D-4FBE-9DB2-5734D65EE0B4}: NameServer = 195.251.25.60 194.177.210.211 O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0.1.411\avp.exe O23 - Service: TrueVector Basic Logging Client (minilog) - Zone Labs Inc. - D:\WINDOWS\system32\ZONELABS\minilog.exe O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - D:\Program Files\Spyware Doctor\sdhelp.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - D:\WINDOWS\system32\ZONELABS\vsmon.exe -- End of file - 3371 bytes

[Reply or follow-up to this message]

You're assuming malware is the reason for your problem, but there are other things 
that can cause problems with IE. Many times it's a legit add-on or something that's 
the cause. 

FYI, you shouldn't have posted your HijackThis log here, since nobody requested it. 
Since it wasn't very long, I skimmed through it. Your log is clean. You shouldn't 
try to fix things when you don't know what they're related to...Here's info. on that 
unknown Winsock entry, it's legit. 

http://www.bleepingcomputer.com/startups/nwprovau.dll-13129.html

I would fix these items though. You can always restore the backup HJT creates. 

O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE



Blocking Unwanted Parasites with a Hosts File

Nothing again. I tried also a program SDfix. But nothing!!! I installed IE7, but the problem still there! Before posting here, i read somewhere that Norton Systemworks 2006 (that i tried and uninstalled) has some problemswith activex and that's why int. expl. crashes. But that post did not have any info about solving the problem. Should i remove all activex components and install again?

[Reply or follow-up to this message]

Did you run the removal tool that Bald Eagle pointed you to?

[Reply or follow-up to this message]

Why are you running all these malware fixes... first it was Smitfraud now SDfix?

There is no sign of Norton System Works in your log, no BHO, toolbar or ActiveX object. 
In fact, according to the HJT log you posted, there's not a one ActiveX object installed. 
Just to make sure you cleared it all out, follow those Norton removal instr. I directed 
you to earlier, regardless of what you've already done.

What made you think installing the atrocious IE7 would solve anything? Install Firefox 
or Opera and forget IE entirely. Other than that, post on a malware support, if you 
think your system's infected.



Blocking Unwanted Parasites with a Hosts File

To Rich: i had already used the norton_removal_tool before posting here. To Eagle: As i told you before, the ie is not the only problem. I cannot search in xp and today morning the windows kept restarting by itself after the welcome screen. The mysterious files that are running to my taskmanager now are: lsass, tcpsvcs, inetinfo, smss and spoolsv. These were not running before my catastrophe! They seem good microsoft programs but surely i didnot open none of them! So it must be something-ware (spy-, mal-......) Before closing i want to tell you a weird thing: When i try to close inetinfo.exe, an other program called iisrstas.exe and an other that i cannot remember now are getting started alone (by themselves) and as soon as the close, they bring inetinfo back to running!!! It must be something that none of the programs i have catch. (I have Kaspersky last edition, spybot, spyware doctor+blaster) Please help me, i want to complete my MSc paper!!!

[Reply or follow-up to this message]

You did not tell me about all these other problems before that you've just mentioned 
here.

Those aren't mysterious files, most of them are Windows XP processes. The Spoolsv 
is print spooler. The running processes  vary depending on what you're doing, and 
which programs you're running, at any given time. 

You can find out what they're all related to, including these: inetinfo.exe and iisrstas.exe 
via Google. As I said before, there was nothing malicious listed in your HJT log. 
There could be something hidden that doesn't show up in HJT. 

You can follow these preliminary cleaning steps. Then post on their forum, if you 
need further help. 
http://www.geekstogo.com/forum/index.php?showtopic=2852


Blocking Unwanted Parasites with a Hosts File

Hi, I did some things and everything is going alright now. Don't answer me what i did.... I don't exactly know. But without connecting to net a program named "adiras.exe" slipped into my system after i fixed. New problems but also solved through "msconfig". The processes that are running since the problems started are not good. Since before the problems none of them loaded byitself, it means that something triggers them to load and unfortunately when the win xp start up. Some of them do not close by any means. Thanks for your interest, i will keep fighting by myself. The hard times are now past.

[Reply or follow-up to this message]

We're here to help if we can, and I realize that's the reason you came to the forum. 

However, it seems whatever problems you're having, you're taking the wrong approach. 
You've been concerned about a lot of processes and startup items that are not a problem. 
You can check any startup items on this page, for descriptions.

Adiras.exe
Description: ADSL USB modem related

http://www.bleepingcomputer.com/startups/Adiras.exe-166.html

It hasn't been clear enough to me, what all is going on. "IE closes when pages load", 
is the subject of your thread. Normally the problem is related to add-ons, but according 
to that HJT log you're log shows your system's exceptionally clean.

Do you clear out temporary files, and other junk files regularly? What type of pages 
cause IE to close? I'll review your other messages again to see if I can get a better 
picture. Maybe it's just me that doesn't get it. :)



Blocking Unwanted Parasites with a Hosts File

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum