IE 5.5 freezes, please help.

[burrly]

Hi,
I'm running Win 98SE and IE 5.5. I haven't made any changes to my system that I know about. IE will freeze when I open a new window or try to click a link on the page. The page will load, but will hang for about 30 seconds and then you can click, or navigate on the page. Tried to repair and reinstall IE, did nothing to help. I've read here about the hijackthis program, so the log file is below from my system. I didn't want to make any changes until I had an expert opinion.

Thank you,

Logfile of HijackThis v1.97.5
Scan saved at 5:43:15 PM, on 3/1/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v5.50 SP1 (5.50.4522.1800)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\CTNOTIFY.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\KEYBOARD\SPEEDKEY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\NETSCAPE.EXE
C:\PROGRAM FILES\SYMPATICO\ACCESS MANAGER\APP\ENTERNET.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://www.snapy.net/index2.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?&account_id=50108

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.google.ca/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?&account_id=50108

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.globesearch.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://www.globesearch.com/cgi-bin/search/gsearch.fcgi?Terms=%s

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =

http://www.google.ca/

R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
N1 - Netscape 4: user_pref("browser.startup.homepage", "

http://www.canoe.ca/");

(C:\Program Files\Netscape\Users\mike\prefs.js)
O2 - BHO: (no name) - {8EDAB5C0-B061-11d1-801D-204C4F4F5020} - C:\WINDOWS\SYSTEM\IE4HLPR.DLL (file missing)
O2 - BHO: (no name) - {D6E66235-7AA6-44ED-A06C-6F2033B1D993} - C:\WINDOWS\SYSTEM\MSIEIN.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {000E7270-CC7A-0786-8E7A-DA09B51938A6} - C:\WINDOWS\SYSTEM\N3TPA1.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ATIGART] c:\ati\gart\atigart.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Norton eMail Protect] C:\PROGRAM FILES\NORTON ANTIVIRUS\POProxy.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [MiniLog] C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: &Define - c:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - c:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .lpc: C:\PROGRA~1\INTERN~1\PLUGINS\npldpict.dll
O12 - Plugin for .wav: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npaudio.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {275E2FE0-7486-11D0-89D6-00A0C90C9B67} (MCSiMenuCtl Class) -

http://activex.microsoft.com/controls/mcsi/mcsimenu.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -

http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

O16 - DPF: {8FAF299E-6EAB-11D2-AB2B-00C04FB16291} (SiteBrowseTreeCtrl Class) -

http://activex.microsoft.com/controls/mtswizards/sitebrowsetree.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {1C854D5E-66D9-11D3-81DD-00A0C9B62983} (TestX Class) -

http://www.expressit.com/Plugin/3DGreetings/PlayerX.CAB

O16 - DPF: {853C1A83-1639-11D0-8BBF-0080C7A01083} (Web Browser Pop-up Window Control) -

http://activex.microsoft.com/activex/controls/iptdweb/webpopup.ocx

O16 - DPF: {1678F7E1-C422-11D0-AD7D-00400515CAAA} -

http://files.cometsystems.com/cometcursor/comet.cab

O16 - DPF: {DA9A0B1E-9B7B-11D3-B8A4-00C04F79641C} (NSUpdateLiteCtrl Class) -

http://204.177.92.201/quickdl/allinone/NSupd9x.cab?pin=504508

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) -

http://security2.norton.com/SSC/SharedContent/sc/bin/cabsa.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

http://download.yahoo.com/dl/installs/yinst.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -

http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -

http://www.pcpitstop.com/internet/pcpConnCheck.cab

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} (Video Class) -

http://streamp.babenet.com/cabs/videox.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38004.5486574074

O16 - DPF: {11111111-1111-1111-1111-111111111111} -

http://207.246.124.105/cabs/ROOSTRS3002/TPS108.cab

O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) -

http://download.microsoft.com/download/vizact2000/Install/10/WIN98Me/EN-US/msorun.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai.net/7/840/537/bcd48c18cb7498/housecall.antivirus.com/housecall/xscan53.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -

http://security1.norton.com/SSC/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {D6E66235-7AA6-44ED-A06C-6F2033B1D993} -

http://distribution.trafficsyndicate.com/msiein.cab

O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} -

http://akamai.downloadv3.com/binaries/IA/ia.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4329/mcfscan.cab

 

[carrr]

Lose these entries:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://www.snapy.net/index2.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://www.couldnotfind.com/search_page.html?&account_id=50108

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.couldnotfind.com/search_page.html?&account_id=50108

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://www.globesearch.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://www.globesearch.com/cgi-bin/search/gsearch.fcgi?Terms=%s

R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: (no name) - {8EDAB5C0-B061-11d1-801D-204C4F4F5020} - C:\WINDOWS\SYSTEM\IE4HLPR.DLL (file missing)
O2 - BHO: (no name) - {D6E66235-7AA6-44ED-A06C-6F2033B1D993} - C:\WINDOWS\SYSTEM\MSIEIN.DLL
O2 - BHO: (no name) - {000E7270-CC7A-0786-8E7A-DA09B51938A6} - C:\WINDOWS\SYSTEM\N3TPA1.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O16 - DPF: {1C854D5E-66D9-11D3-81DD-00A0C9B62983} (TestX Class) -

http://www.expressit.com/Plugin/3DGreetings/PlayerX.CAB

O16 - DPF: {1678F7E1-C422-11D0-AD7D-00400515CAAA} -

http://files.cometsystems.com/cometcursor/comet.cab

O16 - DPF: {DA9A0B1E-9B7B-11D3-B8A4-00C04F79641C} (NSUpdateLiteCtrl Class) -

http://204.177.92.201/quickdl/allinone/NSupd9x.cab?pin=504508

O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} (Video Class) -

http://streamp.babenet.com/cabs/videox.cab

O16 - DPF: {D6E66235-7AA6-44ED-A06C-6F2033B1D993} -

http://distribution.trafficsyndicate.com/msiein.cab

Reboot.

How are things now?

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[bcastner]

Let me just add to Forum member carr's excellent advice. You have a lot of little nastie things that have infected your IE and system, and I really think it advisable that you follow faq608-4650 rather than depend on Hijack This! as your only weapon of choice.

 

[carrr]

Agreed. Proactive is better than reactive.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[burrly]

Many thanks to Carrr and bcastner.
Everything looks like it's back to normal after the fix you suggested.
I went through the FAQ, but wonder if there is a foolproof way to beat this malicious software. What software should a person have running on a daily basis? I have Norton antivirus and Zonealarm Pro.

thanks again,

Mike

 

[carrr]

Unfortunately, you must gather the best array of tools about yourself as possible and proceed with caution. Malwares are the foil of the day. They're out there. They're produced at a greater rate than viruses. It's a game of keeping one's head above water at present. Hold fast to the tools listed in the FAQ, use them often.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger