39 replies to this topic

[Bullydad]

Dear Sirs:
I am having trouble with my Internet Explorer. I was using IE8 with no problems, Windows did an automatic update and installed IE10. When I try to open it I get an error message that Internet Explorer has stoped working. I've been on Windows forum for this issue with no luck. I am begining to think that I have been Hijacked. I downloaded Hijackthis and tried to run it and I got some error messages (shown below). I sent an email to the address in the error message (merijn@spywareinfo.com) but it came back undeliverable. So I decided to post here. Any help you can provide would be very helpfull. Thanks in advance.
Below is the information I sent in the e-mail.

Dear Sir;
I am having a problem with my computer, Windows did an automatic update and downloaded Internet Explorer 10, and it doesn't work. I downloaded your program "Hyjackthis", and tried to run it and experienced the following errors. 1.) First error message said about Hyjackthis not being able to have access to the"Hosts" file and that I might have to edit it manually. 2.) The second error message said " An unexpected error has occurred at procedure: modMain_CheckOther1Item(), Error #75 - Path/File access error. This happens every time that I try and execute your program. I have attached a copy of the error message, my scan log, and my "Hosts" file. Any assistance you can provide me would be greatly appreciated. Thank you in advance.


Error Message=
An unexpected error has occurred at procedure: modMain_CheckOther1Item()
Error #75 - Path/File access error


Please email me at merijn@spywareinfo.com, reporting the following:
* What you were trying to fix when the error occurred, if applicable
* How you can reproduce the error
* A complete HijackThis scan log, if possible


Windows version: Windows NT 6.01.3505
MSIE version: 9.10.9200.16576
HijackThis version: 1.99.1


This message has been copied to your clipboard.
Click OK to continue the rest of the scan.




Hosts File=
# Copyright © 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host


# localhost name resolution is handled within DNS itself.
# 127.0.0.1 localhost
# ::1 localhost






Log File=
Logfile of HijackThis v1.99.1
Scan saved at 10:19:06 PM, on 5/19/2013
Platform: Unknown Windows (WinNT 6.01.3505 SP1)
MSIE: Unable to get Internet Explorer version!


Running processes:
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
N:\Downloads\Cleaning Tools\Hijack This\HijackThis.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://xfinity.comcast.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft..../?LinkId=255141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;192.168.*.*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\bonjour\mdnsnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O11 - Options group: [INTERNATIONAL] International
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.co...sreqlab_nvd.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: RelevantKnowledge - Unknown owner - C:\Program Files (x86)\RelevantKnowledge\rlservice.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

P.S. I tried to upload the log file but said that I'm not able to upload this type of file.

[Ztruker]

HijackThis is not used much any more and merijn dropped support quite some time back. As for uploading the log file, you have to zip it first then you can upload the zip file. What OS are you using now? IE9 and IE10 will not install on XP Pro which is what it says you are using under your name. Must be Windows 7. If so, update your info under My Controls please. The first thing to do is run IE9 or IE10 without any Add-ons. Click on Start, Programs, Accessories, System Tools, Internet Explorer (no Add-ons). See what happens. If it works then use the Manage Add-ons choice under the Tools drop down (gear icon at top right) to disable the Add-ons until you find the one causing the problem. You can also try resetting IE9/10 (if you can get them to start with no Add-ons) via Tools, Internet Options, Advanced tab, Reset.

[Bullydad]

I tryed dissabling add-on's and resetting Internet Explorer, neither of which worked. These were all things that I was told to do from Microsoft Forum's also. What else can I try?

[Ztruker]

Try this: How to perform a clean boot to troubleshoot a problem in Windows 8, Windows 7, or Windows Vista

[Bullydad]

Hi I tried to do the clean boot, and reboot the computer, but it didn't help my porblem. Then and went back into msconfig and found that everything had reverted to the original settings with Load System Services and Load Startup Items both highlighted. I went into and found that avast virus scan was still checked in services and startup items. So I deleated avast and loaded kispersky Internet security. and now kispersky stayes check marked in Msconfig. I tried to make changes and hit the apply button in msconfig but it still reverts to having Load system services and load startup items highlighted and kispersky check marked. On a side note I also noticed that IE10 will work if I start the computer in safe mode. Does this info. help? Any ideas? Thanks. PS IE9 does the same thing as IE10

[paws]

Hi Bullydad Until Ztruker gets back to you please be advised that Windows XP does not support versions of Internet Explorer later than IE8. If you are running Windows Xp as your profile here (under your name on the left side of the page) indicates then it is not be possible to install IE 9 or 10. You said you reset Internet Explorer 8 but it didn't work..... do you mean that the reset failed for some reason or that you are still having problems with Internet Explorer? Its important that you provide all the information you can to us as its you that's sitting in front of your computer whilst some of us here are many thousands of miles away and must rely upon your detailed descriptions in order to help you. Regards paws

[Bullydad]

Hi: I am running Windows 7. I have tried io install IE9 and IE10, neither worked, See previous posts. I can uninstall the IE9 or IE10 update and it reverts to IE8 which workws correctly, (IE8 is the browser that I had to start with, before the automatic download of IE10), and IE8 works fine. I would kind of like to go to IE10 just to have the newest version. I had installed google crome but don't care for it. I have talked to a local compute tech and he said that Google Crome might be causing a conflict with IE9 &IE10, so I uninstalled Google Crome. But when I download IE9 or IE10 They don' work. Do you have any more suggestions?

[Ztruker]

Did you try the Clean Boot I posted the link for, after installing IE9 or IE10?

[Bullydad]

I did try to do the clean boot as I stated up in the post after your suggestion. Basicly I wasn't able to do the clean boot, my computer wouldn't compleatly accept the selections. As I stated I couldn't unselect my anti-virus program in Services or Startup lists, therefore i couldn't clear the check box (Load Startup Items) on the General tab. I tried to use the O.K. button and the Apply buton to save my changes, but it kept reverting to having the "load startup items" box ckecked and check marks in the "Services" and "Startup" tabs. I'm pretty muck pulling my hair out right now.

[Ztruker]

Try it one more time, but this time, when you type msconfig in the Start Menu search box, right click on msconfig.exe at the top left and select Run as Administrator. See if that makes any difference.

[Bullydad]

I'll give it a try. but it will be in a couple of days, I'll get back to you.

[Bullydad]

That didn't work either and now I have another issue, multiple un-deliverable e-mails to unknown addresses and that I did not send. Any idea what that's all about? Back to my original problem, could I have some kind of virus or other malicious software infecting my computer?

[Ztruker]

This is beginning to sound like a malware problem. Go to the Spyware / Malware / Virus Removal forum, read the info there and follow the posted directions. Once you receive a clean bill of health, come back here if you have any additional questions or concerns or it turns out not to be a malware problem.

Please be patient as that is a very busy area. If you do not receive a response in 3 days, post a message here: What To Do If You Have No Response In 3 Days?

Do not reply to your post there as the malware folks look for posts with no replies first.

[Bullydad]

Thanks I'll try that and let you know of the results. Thanks

[Bullydad]

Dear Ztucker; I tried to go to the link for spyware removal that you posted for me, but it requires a username and password. I tried my username and password from this forum but it didn't work. I tried to make a new password and it says that my username is already in use. My username is fairly unique being the first part of my e-mail address, I find it rather difficult to believe that someone else uses the same username. Please give me your advice. Thanks.