IE shutting down

Ok, I just figured out how to het the Hijack this and ran it. Here is the logfile:

Logfile of HijackThis v1.99.1
Scan saved at 8:22:46 PM, on 3/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\system32\fmifs.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Netropa\OSD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Norton Password Manager\AcctMgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Outlook Express\MSIMN.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\helpctr.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\dwwin.exe
C:\Program Files\CA\eTrust PestPatrol\PestPatrol5.exe
C:\DOCUME~1\Bartiks\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.the-huns-yellow-pages.com/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/default.armx?refresh=19674
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.searchv.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EarthLink, Inc.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O1 - Hosts: 209.66.123.175 sexyrabbit.com
O1 - Hosts: 209.66.123.175 www.sexyrabbit.com
O1 - Hosts: 209.66.123.175 free6.com
O1 - Hosts: 209.66.123.175 www.free6.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [UpdateMgr.exe] "C:\Program Files\EarthLink 5.0\updatemgr.exe" /NOCM
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [masqform.exe] C:\Program Files\PureEdge\Viewer 6.0\masqform.exe -UpdateCurrentUser
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [mspdox35] C:\WINDOWS\System32\mspdox35.exe
O4 - HKCU\..\Run: [196_150_ni] C:\WINDOWS\System32\196_150_ni.exe
O4 - HKCU\..\Run: [197_150_ni_5] C:\WINDOWS\System32\197_150_ni_5.exe
O4 - HKCU\..\Run: [198_150_ni_2] "C:\Documents and Settings\Bartiks\198_150_ni_2.exe"
O4 - HKCU\..\Run: [tsappcmp] "C:\WINDOWS\system32\tsappcmp.exe"
O4 - HKCU\..\Run: [inetcfg] "C:\WINDOWS\system32\inetcfg.exe"
O4 - HKCU\..\Run: [mcicda] "C:\WINDOWS\system32\mcicda.exe"
O4 - HKCU\..\Run: [certcli] "C:\WINDOWS\system32\certcli.exe"
O4 - HKCU\..\Run: [query] "C:\WINDOWS\system32\query.exe"
O4 - HKCU\..\Run: [hotplug] "C:\WINDOWS\system32\hotplug.exe"
O4 - HKCU\..\Run: [pcdlib32] "C:\WINDOWS\system32\pcdlib32.exe"
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://start.earthlink.net
O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {2C38A62E-D257-40E8-8BB7-5624E38FEB0A} - http://www.terra.es/personal5/ultrasky/megans_cam/2804.exe
O16 - DPF: {4129EA54-F04E-11D3-BF96-00C04F0E7BE2} - http://www103.coolsavings.com/download/cscmv4X.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1105240435584
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124290838625
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: fmifs - Unknown owner - C:\WINDOWS\system32\fmifs.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Message Edited by RKinner on 03-09-2006 10:17 AM

The wininet.dll error is an important clue. 

Get the smitrem program from Dave's World:

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

and run it.  It will extract itself to a folder on your desktop. 

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Log in as your usual login or you won't find the programs you put on the desktop
and some of the entries we want to remove will not appear in HijackTHis.

Run HijackThis and just do a Scan only. Check  then Fix Checked any of the following that remain:

O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKCU\..\Run: [drmv2clt] "C:\WINDOWS\system32\drmv2clt.exe

Now open the smitrem folder by doubleclicking on it and then doubleclick on RunThis.bat (you probably will not see the .bat part).  Follow the prompts.  (You can cancel out of the disk cleanup at the end if you are in a hurry.)  I believe it generates a log and saves it in the same folder.  Please post the log in your next reply along with a new Hijackthis.

Ron

It appears that you do not have the downloaded wininet.dll in the correct location or you did not extract it correctly.

Start, Run, cmd, OK to bring up the black cmd screen.  Type (with an Enter after each line:

cd \

dir /a /s wininet.dll

Highlight the result and press Enter then move to a reply to this post and Edit, Paste (or ctrl + v).  That will show me where all copies of the file are hiding. 

Also are you doing this in Safe Mode with Command Prompt?  This is not Safe Mode then Start, Run, cmd, OK but instead is the Safe Mode option that says Command Prompt. and which goes to a black screen.

Ron

I tried yor last input, here is what happened;

I tried yor last input, here is what happened;

I tried yor last input, here is what happened;

Here is what came up.

C:\>dir /a/s wininet.dll
 Volume in drive C has no label.
 Volume Serial Number is 1845-1B0E

 Directory of C:\I386

08/18/2001  04:00 AM           593,920 WININET.DLL
               1 File(s)        593,920 bytes

 Directory of C:\Program Files\Common Files\Adaptec Shared\System

04/23/1999  08:22 PM           459,024 Wininet.dll
               1 File(s)        459,024 bytes

 Directory of C:\WINDOWS\$hf_mig$\KB883939\SP2QFE

05/02/2005  01:57 PM           658,944 wininet.dll
               1 File(s)        658,944 bytes

 Directory of C:\WINDOWS\$hf_mig$\KB896688\SP2QFE

09/02/2005  04:53 PM           660,480 wininet.dll
               1 File(s)        660,480 bytes

 Directory of C:\WINDOWS\$hf_mig$\KB896727\SP2QFE

07/02/2005  07:09 PM           659,456 wininet.dll
               1 File(s)        659,456 bytes

 Directory of C:\WINDOWS\$hf_mig$\KB905915\SP2QFE

10/20/2005  08:38 PM           661,504 wininet.dll
               1 File(s)        661,504 bytes

 Directory of C:\WINDOWS\$NtServicePackUninstall$

01/08/2004  03:23 PM           585,216 wininet.dll
               1 File(s)        585,216 bytes

 Directory of C:\WINDOWS\$NtUninstallKB834707-IE6-20040929.115007$

08/18/2001  04:00 AM           593,920 wininet.dll
               1 File(s)        593,920 bytes

 Directory of C:\WINDOWS\$NtUninstallKB883939$

08/04/2004  12:56 AM           656,384 wininet.dll
               1 File(s)        656,384 bytes

 Directory of C:\WINDOWS\$NtUninstallKB896688$

07/02/2005  07:11 PM           658,432 wininet.dll
               1 File(s)        658,432 bytes

 Directory of C:\WINDOWS\$NtUninstallKB896727$

05/02/2005  01:52 PM           657,920 wininet.dll
               1 File(s)        657,920 bytes

 Directory of C:\WINDOWS\$NtUninstallKB905915$

09/02/2005  04:52 PM           658,432 wininet.dll
               1 File(s)        658,432 bytes

 Directory of C:\WINDOWS\ServicePackFiles\i386

08/04/2004  12:56 AM           656,384 wininet.dll
               1 File(s)        656,384 bytes

 Directory of C:\WINDOWS\SYSTEM32

10/20/2005  08:39 PM           658,432 wininet.dll
               1 File(s)        658,432 bytes

     Total Files Listed:
              14 File(s)      8,818,448 bytes
               0 Dir(s)  27,973,181,440 bytes free

I thought that I did save to the c drive as you said, and was running the safe mode with a command prompt.

Mark

No sign of the one we tried to download to C:\ but you have no shortage of existing copies including one that is a minute older than the one installed.  Very strange.  I don't trust that one so let's use the next oldest one.

Boot into Safe Mode with Command Prompt and

copy C:\WINDOWS\$NtUninstallKB905915$\wininet.dll C:\Windows\System32

If it won't let you do that then

copy C:\WINDOWS\$NtUninstallKB905915$\wininet.dll C:\Windows\System32\dllcache

then see if

sfc /scannow

will run in this mode.  If not then boot back to regular mode and run it from Start, Run, cmd, OK.

Ron

I tried that, the system said that I was trying to open a .dll file and could not open it.

Would it be best to back up my files, dump the system and reload it?

Sorry, getting frustrated.

Mark

Reloading is probably the surest option.  Before you do that did you try using System Restore to go back to the earliest date it had?

http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/systemrestore.mspx

Ron

I tried to do the system restore, every time after it reboots, it tells me that it can not restore to that date. I only select the highlighted ones and went back as far as it would let me.

How do I uninstall the os and reload it? I have the Dell Tools CD for reinstalling Dell-installed software. I tried to run it, but it said that I have a previous version running and it must be uninstalled first. How can I do this? Also, I was thinking of partitioning my hard drive so that I can keep the os on one and all the other program files and saved files on the other.