Internet Explorer, My Computer will only open in Safe Mode 1

[123FakeSt]

I am having a unique problem with a 2K machine. Under normal conditions, Explorer, Internet Explorer, Control Panel, etc. will not launch (from command prompt etc...) When i boot to safe mode these applications work fine. Other apps like office, command prompt, work fine always.

I have removed all programs from automatically starting up. I have reinstalled service pack 3. Ran Spybot and removed garbage. Still no love.

Any ideas?

Thanks, Rusty.

 

[123FakeSt]

Here is the hikackthis log:

Logfile of HijackThis v1.97.3
Scan saved at 5:23:23 PM, on 4/1/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\winnt\System32\smss.exe
C:\winnt\system32\winlogon.exe
C:\winnt\system32\services.exe
C:\winnt\system32\lsass.exe
C:\winnt\system32\svchost.exe
C:\winnt\System32\WBEM\WinMgmt.exe
C:\winnt\Explorer.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Autom\Local Settings\Temp\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {66993893-61B8-47DC-B10D-21E0C86DD9C8} - C:\winnt\System32\iehelper.dll (file missing)
O2 - BHO: (no name) - {BCF96FB4-5F1B-497B-AECC-910304A55011} - C:\winnt\hhUU.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINNT\System32\nzdd.dll
O2 - BHO: (no name) - {FFCBEECE-FB0C-11D2-AB16-00104B9BBBD2} - C:\WINNT\System32\AHIEHelp.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Qidion - {3789CBF0-C4CA-4e98-B93B-22ACF0587FBA} - C:\winnt\qi32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\winnt\system32\msdxm.ocx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) -

http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab

O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -

http://www.napster.com/client/isetup.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37460.1461805556

O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) -

http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab

 

[bcastner]

Do steps #1 - #4 in faq608-4650

If you still have issues, post again your Hijack Log, but enable the options to show your startup programs and other details in the log.

 

[123FakeSt]

Well, a trojan was found and had to be manually removed. All else is clean, but the problem remains, for any and all users on the laptop. Excel etc. opens, but any explorer related function (control panel, My Computer, IE, etc. ) causes the screen to flash the backround color for a second then return exactly as before. The support specialist insists on having to do a clean install so he pulled the plug and hopes to recover from a new install and the backed up files. We'll see if the problem re-emerges when he reloads the data.

Have a good weekend,
Rusty

 

[cpusolutions]

Wre have a PC here with the same issue.

Explorer functions only work in safe mode. Internet explorer will not open in normal mode, but opens and connects in safe mode with networking.

Cleaned a trojan off the PC using pandA online scan. Reinstalled TCP/IP, manually reregistered all dll's for IE.

Deleted all entries from the run keys in registry.

NOTHING HELPS. If this keeps up I'm going to call Microsoft.

 

[123FakeSt]

cpusolutions .... please let me know what you find out. I'm still at a loss in how to fix this. I'm currently trying to restore files from a backup (though the backup was made after the problem began.)

Thanks,
Rusty

 

[pjasthi]

I am having the same issue since April 2nd. I tried All kinds of Virus Scanners and no help at all. I am in the process of turning on only the services that support safe mode and see what happens.

 

[hragan]

I have a customer who is experiencing the same problem. I have the services running that is expected in safe mode.

 

[jermt01]

Hey guys, same problem here. I can only seem to browse my folder trees from notepad (executed from the Run prompt) or some method other than Explorer (windows). Also, IExplore will not run, even from the Run prompt. However, I can browse the internet through my web function in Outlook. Maybe I'm mistaken, but I thought Outlook utilized IE as it's web browser. Very odd. I'm still looking for a solution myself.

 

[onsitepc]

I'm sorry to say this but I'm glad I'm not the only one out there feeling stupid with this scenario. I'm having the same problems on an XP Home system (No IE, My Computer, Control Panel) but I'm able to reach some of these functions via making an MMC window.

I've tried the follow with no sucess:
1) Spybot
2) Norton AV
3) System Restore roll back to the week before.
4) Reload of OS (upgrade mode only)

The last resort looks like a format if no one comes across anything soon. Thanks!

 

[123FakeSt]

If it is of any use, my user reported the problem beginning while he was on a website for an Airline. I found the trojan MaConnect.dll and successfully removed it, but that is years old so i don't see how it could be the problem.

I have his machine imaged onto a backup identical laptop and i reformatted and reloaded the original to fix the problem. No fun at all .. so much for virus protection (his was completely current at the time of the problem.) He was using Norton.

Rusty

21st Century intelligence is not knowing the answer, but where to find it.

 

[lackr]

I deleted the hhuu.dll file and that seemed to solve the issue.

 

[123FakeSt]

yes .. deleting the hhuu.dll did the trick for me.

Thanks a bunch lackr!

Rusty

21st Century intelligence is not knowing the answer, but where to find it.

 

[jermt01]

Yes, thanks alot lackr.
I even found instructions for completely clearing the files from registry. Go to the following link and follow the manual removal instructions.

http://www.kephyr.com/spywarescanner/library/hungryhands/index.phtml

Thanks again to lackr

 

[jeramy]

Thanks for the awesome link. Fixed the problem under 10 minutes

Mitmont

 

[aeroed]

This problem can also be caused by the "transponder/VX2/Blackstone/TPS108/MSview" piece of spyware. Depending on the version it can be a pretty nasty piece of spyware. Check your %windir% for the following dlls.
IEHelper.dll -- Blackstone variant
VX2.dll -- VX2 variant
TPS108.dll -- TPS108 variant
MSView.dll -- MSView variant

You must unregister the dlls before you delete them. You can find directions at

http://www.doxdesk.com/parasite/Transponder.html

thanks,
Ed