IE has packed up

[simpo two]

For a few days I noticed that IE, when opened, took longer than usual to open the default home page (my own website).

Now I've noticed that 'ideskMFC Application' (idemlog.exe) is trying to access the internet, so I've stopped it.

I ran AVG and it found Trojan Generic.KQR and stuck it in quarantine but idemlog.exe is still trying. Also ran Adaware and Giant but nothing other than tracking cookies found.

Today IE is 'jammed' - it will load the homepage but if I try to go anywhere else it either does nothing or freezes. I tried typing 'www.google.co.uk' in by hand and the letters came up one by one about 10 seconds after I typed them...

Luckily I have Firefox and that still works, so here I am but I'd like to know what's going on .

TIA for any suggestions!

[406tm]

John

Install MS Antispyware from their site. My PC was slow and acting up, installed MA AntiSpyware and everything was hunky dory after that

HTH

Dave

406TM

[Zad]

Googling around didn't give much, but this looks like it worked:

http://forums.tomcoyote.org/index.php?showtopic=5263

If the MS Tool doesn't work, I would give it a go.

[simpo two]

Dave, 'Giant' is MS Antispyware. Didn't find anything.

However geezer on forum said:

forum said:

Download CWShredder from my signature below. Unzip it on the desktop. Open CWShredder and with ALL other windows closed, click fix.

Unfortuately CW Shredder runs for amoment than I get a blue screen crash with white writing on it. Tried it twice; two crashes.

forum said:

Go here and run at least one of the online scans, allow them to delete whatever they find: TrendMicro HouseCall eTrust AntiVirus Web Scanner Panda ActiveScan Note any thing that can't be fixed Reboot when done.

TrendMicro wants me to install java kernel which I'm a bit wary of.
eTrust won't work with Firefox
Panda doesn't do anything when I click on its buttons. It just sits there and says 'done'

forum said:

Download Spybot, install and update. Then download Ad-aware, install, and update. Spybot: Install the program and launch it. Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D Close ALL windows except Spybot S&D Click the button to "Search for Updates" and download and install the Updates. Next click the button "Check for Problems" When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window

Spybot freezes after 15 definitions

forum said:

Ad-Aware FULL SCAN: Install the program and launch it. 1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.) 2. Set up the Configurations as follows: -- Click the Gear wheel at the top of the Ad-Aware window -- Click General > Safety & Settings: Check (Green) all three. -- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion". 3. Click "Proceed" 4. Click "Scan Now" 5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat. 6. Select "Search for low-risk threats" 7. Run the scanner using the Full Scan (Perform full system scan) mode. 8. When the scan has completed, select Next. 9. In the Scanning Results window, select the "Scan Summary" tab. 10. Check the box next to each "target family" you wish to remove. 11. Click next > Click OK.

My options were slightly different but I ran the scan and it found 19 MRUs - nothing bad.

So I'm a bit stuck...

[aranell]

MRU = most recently used items. Not really a threat (IMO)

I think idemlog.exe is a browser toolbar. It might be worth checking your add/remove programs on the offchance you can remove it this way.

If not, you should be able to remove it manually, although it involves registry editing....you can check HKEY_LOCAL_MACHINESoftware and HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrent VersionRun to see if it's sitting there. Make sure you terminate the process from Windows Task Manager first. Also, delete anything from HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrent VersionBrowser Helper Objects as these are all the toolbars attached to IE. These are the three main places that junk like this sits

If in doubt, feel free to post the contents of the above places in your registry and we'll be able to tell you what should and shouldn't be there

HTH,

- A

[BliarOut]

Google for HijackThis and run it. You're primarily looking for the BHO's. Probably best to run it and fix it from safe mode.

[FunkyNige]

I think this is the one I had to use Erido to remove, none of the others fixed it IIRC.

[simpo two]

aranell said:

If in doubt, feel free to post the contents of the above places in your registry and we'll be able to tell you what should and shouldn't be there

Thanks for that. First one is a shedload of folders, second one won't copy and paste. Tried searching registry using regedit and Ctrl/F but it doesn't seem to be searching - at least, the little rubik cube/magnifying glass icon isn't animated.

However, I can bring you a Hijack This logfile...

Logfile of HijackThis v1.99.1
Scan saved at 22:12:20, on 13/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSSystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32wdfmgr.exe
C:WINDOWSsystem32 oneLabsvsmon.exe
C:WINDOWSsystem32wwSecure.exe
C:WINDOWSSystem32alg.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:WINDOWSSystem32 askswitch.exe
C:Program FilesCreativeSBLiveAudioHQAHQTB.EXE
C:Program FilesAdaptecEasy CD Creator 5DirectCDDirectCD.exe
C:Program FilesUSB ADSLCnxDslTb.exe
C:Program Files one Labs oneAlarmzlclient.exe
C:PROGRA~1GrisoftAVGFRE~1avgcc.exe
C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
D:Program FilesMS AntispywaregcasServ.exe
C:WINDOWSsystem32devldr32.exe
C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
D:Program FilesMS AntispywaregcasDtServ.exe
C:WINDOWSsystem32wuauclt.exe
C:Program FilesMailWasherMailWasher.exe
C:Program FilesOutlook Expressmsimn.exe
C:WINDOWSsystem32msiexec.exe
C:PROGRA~1MOZILL~1FIREFOX.EXE
Drivers&downloadsHiJack thisHijackThis.exe

R1 - HKCUSoftwareMicrosoftInternet Explorer,Search = Google
R1 - HKCUSoftwareMicrosoftInternet Explorer,SearchURL = www.google.co.uk
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = www.autograph.uk.com/
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = www.autograph.uk.com/
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer
O2 - BHO: Name - {3EB0B7AB-300E-4164-BFD7-48A44111A965} - C:WINDOWSSystem32mstdb.dll (file missing)
O2 - BHO: Name - {DBDADF5E-5E32-4C69-BF98-2C4E31D1AA45} - C:WINDOWSSystem32mstdb.dll (file missing)
O4 - HKLM..Run: [CoolSwitch] C:WINDOWSSystem32 askswitch.exe
O4 - HKLM..Run: [AudioHQ] C:Program FilesCreativeSBLiveAudioHQAHQTB.EXE
O4 - HKLM..Run: [AdaptecDirectCD] C:Program FilesAdaptecEasy CD Creator 5DirectCDDirectCD.exe
O4 - HKLM..Run: [CnxDslTaskBar] C:Program FilesUSB ADSLCnxDslTb.exe
O4 - HKLM..Run: [NeroCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [Zone Labs Client] "C:Program Files one Labs oneAlarmzlclient.exe"
O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVGFRE~1avgcc.exe /STARTUP
O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVGFRE~1avgemc.exe
O4 - HKLM..Run: [gcasServ] "D:Program FilesMS AntispywaregcasServ.exe"
O4 - HKLM..Run: [ATIPTA] C:Program FilesATI TechnologiesATI Control Panelatiptaxx.exe
O4 - HKLM..RunServices: [RegisterDropHandler] dRIVER~1BinREGIST~1.EXE
O4 - HKLM..RunOnce: [VcCleanUp.exe] COCUME~1JohnLOCALS~1TempVcCleanUp.exe /F C:PROGRA~1COMMON~1SYMANT~1LiveReg /RemoveAll
O4 - Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe
O6 - HKCUSoftwarePoliciesMicrosoftInternet ExplorerControl Panel present
O12 - Plugin for .mov: C:Program FilesInternet ExplorerPLUGINS
pqtplugin.dll
O12 - Plugin for .PSD: C:Program FilesInternet ExplorerPLUGINS
pqtplugin2.dll
O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/UK/install.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALContro
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5C
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader.cab
O17 - HKLMSystemCCSServicesTcpip..{2AB15984-DDF6-41B9-B48C-B2AF3ECCA73D}: NameServer = 85.255.113.130 85.255.112.79
O17 - HKLMSystemCCSServicesTcpip..{AE426FD9-5F44-4F69-A725-9C690B965649}: NameServer = 85.255.113.130,85.255.112.79
O23 - Service: Adobe LM Service - Adobe Systems - C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSSystem32Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:WINDOWSsystem32ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:PROGRA~1GrisoftAVGFRE~1avgupsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:WINDOWSsystem32 oneLabsvsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:WINDOWSsystem32wwSecure.exe

Anything interesting there?
Look forward to your views!




>> Edited by simpo two on Tuesday 13th December 22:22

[FunkyNige]

Here's a virus (Bugbear.b apaprently) -

C:Program FilesOutlook Expressmsimn.exe link

Fixing that should get rid of -

O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)

I'm suspicious of -

C:WINDOWSSystem32 askswitch.exe
O4 - HKLM..Run: [CoolSwitch] C:WINDOWSSystem32 askswitch.exe

Don't know what these are, neither does Google (unless you speak German)

O12 - Plugin for .mov: C:Program FilesInternet ExplorerPLUGINS
pqtplugin.dll
O12 - Plugin for .PSD: C:Program FilesInternet ExplorerPLUGINS
pqtplugin2.dll

Again, neither myself or Google know what these are!

Probably best to wait until someone agrees with me before you start deleting stuff though!

[aranell]

FunkyNige said:

Here's a virus (Bugbear.b apaprently) - C:Program FilesOutlook Expressmsimn.exe link Fixing that should get rid of - O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) I'm suspicious of - C:WINDOWSSystem32 askswitch.exe O4 - HKLM..Run: [CoolSwitch] C:WINDOWSSystem32 askswitch.exe Don't know what these are, neither does Google (unless you speak German) O12 - Plugin for .mov: C:Program FilesInternet ExplorerPLUGINS pqtplugin.dll O12 - Plugin for .PSD: C:Program FilesInternet ExplorerPLUGINS pqtplugin2.dll Again, neither myself or Google know what these are! Probably best to wait until someone agrees with me before you start deleting stuff though!

Agree with the above - if you google something and it comes back with virtually no repsonses, it's usually dodgy (unless you have something really obscure running on your PC!).

Back up your registry first, just in case, and then delete the above. If something breaks, you can just double click on the file you saved and it will re-load your registry before you deleted stuff. I'll have a closer look in a bit and see if I can see anything else - I'm surprised that you don't have any BHOs showing. Maybe HijackThis doesn't log this bit of the registry?

- A

[BliarOut]

HJT does check for BHO's. Agree with getting rid of the above in safe mode and then seeing how it goes. Also empty your temporary internet files and temp folders. One question, why is the microsoft installer running? Were you installing something when you ran the scan?

[simpo two]

BliarOut said:

HJT does check for BHO's. Agree with getting rid of the above in safe mode and then seeing how it goes. Also empty your temporary internet files and temp folders. One question, why is the microsoft installer running? Were you installing something when you ran the scan?

Not knowingly. I might check e-mail etc but wouldn't do anything important like installing.
Funny thing is that IE now seems to be working again, yet all the entries you refer to are still there.

Not sure how to back up the registry, or restore it if it goes tits up.

[aranell]

simpo two said:

Not knowingly. I might check e-mail etc but wouldn't do anything important like installing. Funny thing is that IE now seems to be working again, yet all the entries you refer to are still there. Not sure how to back up the registry, or restore it if it goes tits up.

As I said before, idemlog.exe is (I think) a Browser Helper Object, so I suspect one of your scans may have removed it and hence IE is now working again.

To backup the registry is quite easy....
Start button - Run
Type 'regedit' and press OK
Click on the menu 'registry' and then 'export registry file'
Save it somewhere memorable

If you find you need to restore it, all you need to do is double click on the registry file and it will add all the entries in again.

As long as you don't delete anything other than the things we've mentioned, you should be fine - I wouldn't recommend playing around with it too much unless you are confident in what you are doing - there is no 'undo' button. Whatever you do is permanent (hence why you should always backup first )

Really, I would stick with using firefox, or some other browser (I use Opera but everyone else I know hates it ) as it's far, far more secure and much harder to pick up all this kind of junk. Certain websites must be used with IE, so unfortunately you can't delete it forever

HTH,

- A

[Ballistic Banana]

Chuck IE in the bin and run Mozilla Firefox, after doing this myself I had many more hassle fee hours online.

BB