IE lockup windows xp part1

Discussion in 'Malware Help (A Specialist Will Reply)' started by prh44, Dec 30, 2009.

  1. prh44

    prh44 Private E-2

    IE explore started running slow during web page view seem to be after running some video. Then it would lock up and I would need to reboot. Soon the computer would lockup in exploer while just viewing files. IE will not load a web page most of the time it locks up. I got a couple blue screen errors also. I have Mcafee virus protection.I did see a window pop up and closed before I could see anything. I did a full system scan and no detections. I then ran the read me first operations please keep in mind system would lock up. No threatening files were found until combofix ran a found rootkit activity.
    I have attached all the logs requested and a screen shot of task manager before all the scans.
    I can not start recover console because of an error: HAL.DLL missing or corrupt.
    I had to do some scanning from safemode.

    A few weeks ago I ran CCcleaner after that time I would get a PSD runtime error at start up. "PSDRT missing" This is an HP security file This did not prevent any programs from running and I have replaced the file in the past from my other HP computer. I do not have a a second HP computer now. So I can not replace in the same way. This may be related not sure
     

    Attached Files:

  2. prh44

    prh44 Private E-2

    Re: IE lockup windows xp part2

    Two more attachements
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    While you do have some things to fix, all of your problems may not be due to malware.

    Note: You did not download and run the version of MGtools given to you in the READ & RUN ME. You are more than 13 months out of date. You should not be saving old versions as you always need to use what is given in the link in the READ & RUN ME. Also you did not put your PC into Normal Startup mode with MSconfig as requested in step 4 of the READ & RUN ME ( you need to get into normal startup mode right now). You need to try and run MGtools in normal boot mode (not safe mode) too if possible. Due to this, we really cannot create a proper fix; however I will get you started anyway and hope for the best.

    Please delete the below file/folder. MGtools does not belong here and neither does ComboFix.exe so delete it too and download the current version of ComboFix to your Desktop as requested and required:
    C:\Anti spyware\MGtools.exe
    c:\Anti spyware\ComboFix.exe

    What are the below recently saved files for?
    Code:
    "C:\Documents and Settings\paul\My Documents\"
    IMAGES~1      Dec 26 2009              "images54528"
    images~1.zip  Dec 26 2009    16600338  "images54528.zip"
    sp44703.exe   Dec 29 2009    59235760  "sp44703.exe"
    

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Uninstall the below old versions of software:
    Java(TM) 6 Update 11

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now go to TDSSKiller and Download TDSSKiller.zip to your Desktop
    • Extract its contents to your Desktop so that you have TDSSKiller.exe directly on your Desktop and not in any subfolder of the Desktop.
    • Click Start > Run and copy/paste the following bold command into Run box and hit Enter.
    "%userprofile%\Desktop\TDSSKiller.exe" -v
    • Follow the instructions to type in "delete" when it asks you what to do when if finds something.
    • When done, a log file should be created on your C: drive named something like TDSSKiller.2.1.1_27.12.2009_14.17.04_log.txt which is based on the program version # and date and time run. Please attach this log to your next reply. (See: HOW TO: Attach Items To Your Post )

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

    Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

    Now attach the below log:
    • C:\ComboFix.txt
    • the log from TDSSkiller
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  4. prh44

    prh44 Private E-2

    Thanks for your help. I executed the steps your prescribed and attached the logs. I had to download the tools from my second computer and save them to my decktop via my network.
    The three recently saved files you asked about are:
    SP44703.exe is the HP patch for the embedded security.
    The other two are images from my camera. I have deleted most unneeded files in my documents.
    The following took place after todays scans
    IE will start but will not load a web page, it freezes on connecting. I sent the error report but can not load the information. I was successful one time when i first started having trouble and MS seems to think it is a driver or corrupt file issue issue but not certain.
    Sometimes IE will start but will not appear on the screen but runs in the background. I found this by viewing windows task manager. Rebooting the systems will sometimes get IE to start but it will still hang up.
    I started Excel, nero and they ran fine.
    Hope this helps
     

    Attached Files:

  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Next time this happens, do not reboot. Just use Task Manager to close all instances of iexplorer.exe that you see. Then close Task Manager and try to run IE one more time just to see if it loads. I have seen this several times in the past and it is some kind of problem with IE or Windows not malware.....so I just want to see if your behavior is the same.

    Now Click Start, Run, and enter sfc /scannow and click OK. There is a space after the sfc. This runs System Rile Checker which looks for missing or corrupted system files and attempts to replace/repair them from files on your hard disk or from the CD if necessary. So it will ask for the Windows CD if it needs it. Let me know if it asks for your CD.


    If still having problems with IE, download and install this: Mozilla FireFox Let me know if you can browse/surf okay with FireFox.

    I see you have McAfee VirusScan Enterprise. Is this a corporate PC/license? Do you have the installed program that you could use to reinstall if I ask you to uninstall at any point?
     
    Last edited: Jan 3, 2010
  6. prh44

    prh44 Private E-2

    Again thank you for your reply. I have shut down IE using task manager and restarted. IE will start and shutdown instantly after several attempts it will start and stay running. Sometimes it hangs and everynow and then it will load my home page.
    But it will always hang at somke point.

    Moxilla seem to work OK I went to several sites and made some quick jumps and it has not hung up yet.

    The scan requested the system discs I do not have. My IT department at work has them. I have been on vacation through the holidays. They will also need to reload the McAfee if needed.

    It seems the whole systems is alittle slow to shutdown and restart
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to complete these scans or have your IT dept do it. It Windows is asking for the disks, it means you have problems with necessary files for Windows.

    Most likely McAfee.
     
  8. prh44

    prh44 Private E-2

    Thanks for all your help Got the disc today
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Did completing the sfc scan help?
     
  10. prh44

    prh44 Private E-2

    The scan did not fix the lock up problem. I did a full reload of XP pro and everything is fine now. Just had to reload my software UGH!. The machine is much faster and no problems so I believe all my hardware is good.
    Thanks for everything
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds