Page 4 of 5 FirstFirst ... 2345 LastLast
Results 31 to 40 of 45

Thread: Major probs with IE

  1. #31
    Regal Making Handler
    Join Date
    Jun 2002
    Posts
    1,668
    When you are in safe mode make sure you have show hidden files checked under folder options. If you still can't delete it it will because itis attached to a running process. If this is the case you will have to follow the steps in Groovicus's tutorial that i linked you to. If you follow his advice you should be able to deal with it.

    Don't forget to post the hijack this logs, so we can help further.
    What happens if a big asteroid hits the Earth? Judging from realistic simulations involving a sledge hammer and a common laboratory frog, we can assume it will be pretty bad. - Dave Barry

  2. #32
    Senior Member kr5kernel's Avatar
    Join Date
    Mar 2004
    Posts
    347
    Make sure its actually in system32 and not system, I saw a couple places online where it was in system. Use those direction I said before and see if there is any reference to IETie in the registry.
    kr5kernel
    (kr5kernel at hotmail dot com)
    Linux: Making Penguins Cool Since 1994.

  3. #33
    Junior Member
    Join Date
    Nov 2004
    Posts
    23
    Ok, this is what I know.........when I try to access IE.....it goes to my homepage for about a split second, then it goes to "about:blank" ontop of that are about 4 or 5 pop ups (seemingly from Internet explorer, as that is what it says at the top) that tell me how my computer is severly infected with spyware.

    The first thing I did before ever posting somewhere was to make sure that my LAN setting were all correct (I have a cable modem) and they were not....it showed me going through a proxy, so I changed that ....... then I tried to access IE again with the same results and when I went into the LAN settings it showed that it was set to proxy again.

    I ran my ad-aware and spybot progs which showed things such as Coolwebsearch and WildTangent among some others.........followed the steps, cleaned them out.

    I was using ghost surf on my system and it was suggested that I get rid of that. I did it. Still nothing changed. It was suggested that I delete IETie.dll from the c:\windows\system32 file.

    I went into that file (first in regular mode) and saw that that file was indeed there, so I re-booted in safe mode to delete it, but when I went into c:\windows\system32..........IETie.dll WAS NOT there. I tried to delete in when I was in regular mode, but ofcourse I could not.

    Just before posting THIS message, I ran all of my spywares again, cleaned out the caa-caa, ran my AV (first I made sure that I had all of the updates available for all of them) then I reboot my computer, went to access IE......saw my homepage for a split second and then it went to "about:blank" !!! The only difference is that NOW when I check the LAN setting it is NOT showing that it is going through a proxy.

    I am sorry if I am sounding really aggravated, but , well, I am REALLY AGGRAVATED!!! It should not be this hard to fix this!!
    Willow

  4. #34
    Senior Member kr5kernel's Avatar
    Join Date
    Mar 2004
    Posts
    347
    Your damn straight it shouldnt be. Fire up task manager, kill processes that seem fishy and then try deleteing ietie, this method is similair to safe moding' it. That was a nice recap though....you will get this I am sure.
    kr5kernel
    (kr5kernel at hotmail dot com)
    Linux: Making Penguins Cool Since 1994.

  5. #35
    Junior Member
    Join Date
    Nov 2004
    Posts
    23
    Yes you mentioned that before, here is what I am finding in the TaskManager as a running process that I am not sure of (the other things, I know what they are):

    mxtask.exe (I think that might me Microsoft Task Manger)

    svchost.exe (this appears several time....under "user name" for this it has System, Local Service and Network Service)

    nprotect.exe (this might have something to do with my Norton Utilities...not sure)

    sysdoc32.exe

    wuauclt.exe

    csrss.exe

    smss.exe



    Yesteday you said to look at netstat -o.....what you were having me look for was not there. If it would help I can do that again and tell you what IS there.
    Willow

  6. #36
    Yes, when u run adaware it only gets rid of the registry entries that are in there at that current time. There is a file that puts that right back in even after u delete them whenever u reboot your computer or run IE. It's really close to a virus. You can't just go in and delete the program because it is continually changing its name. The only way to get rid of it is to use hijackthis, find ALL the entries that it could possibly be (for example with the HomeSearch bug the file ended in a 5digit random letter/num combination.dll or sometimes it ended with a 32.) There is usually a pattern in the way these files try to name themselves and there should be some place where they can tell u what the pattern is. After you get rid of those entries run adaware, spybot, everything u have twice just for the hell of it. As a last resort I'd run adaware, spybot, then just stop using IE because when u boot that up it starts it up again. Like I said before just use firefox, or is not letting u on at all? Try going to this site. http://www.short-media.com u have to register but it's all free and there are people on there that can help u more with your hijackthis log. Taskmgr.exe is your task manager so I don't know what mxtask.exe is. Google it and you should find out what it is.

  7. #37
    Junior Member
    Join Date
    Nov 2004
    Posts
    23
    Here is what I get when I do netstat -o:

    Active Connections
    Proto Local Address Foreign Address State PID

    TCP curtis-n-siss:1039 bay-cs10.msg.hotmail.com:1863 Established 1400
    " " " " :1138 cs24.msg.dcn.yahoo.com.http " 2564
    " " " " :5101 24.84.38.BO:40170 " 2564
    " " " " :5101 ACA5A2OE.1pt.aol.com:3701 " 2564
    " " " " :1180 local host: 1181 " 3016
    " " " " :1181 local host: 1180 " 3016
    " " " " :5001 local host: 1044 Close_Wait 1488
    Willow

  8. #38
    Junior Member
    Join Date
    Nov 2004
    Posts
    23
    I have also used Hijack this. I have heard, and through some of my own experience I have seen that IE is not such a great browser. The reason I want to have it is because when I want to use certain things (like aspects of yahoo mail that are not available otherwise .... fonts, colors) or if I want to use a link or download something from Microsoft (that I might need to use with my office suite) I cannot do it without having IE. It is a royal pain in the a$$, but what are ya gonna do. we are in a hostage situation either way.
    Willow

  9. #39
    Junior Member
    Join Date
    Nov 2004
    Posts
    23
    I GOT MY IE BACK!!!

    Ok here is what I finally did to get things working again. I truned off the system restore. I started thinking that with it on...even though I thought I was fixing it, it just restored itself to a point where the hijacker had control. I'm not sure if that was really the case, but I think that turning it off helped a lot.

    Then I ran ad-aware, spybot, hijack this and cwshredder. After that I went into regedit and found all the instances of about:blank, coolwebsearch, cool-web-search etc and deleted them.

    After doing that I was able to change my home page from about:blank back to MY home page.
    Then I went into the internet option and put about:blank and all the versions of coolwebsearch that I could think of in the restricted sites.

    I went through all the options on the security tab also (in internet options) and I saw that "enable 3rd party browser extension" was checked, so I unchecked that and so far so good. That was late Tuesday night when I got it back and this is now Thursday morning soooooo I think I did it!

    Good think too cause my birthday is tomorrow and I did not want to spend the whole day arguing with my computer!!
    Willow

  10. #40
    Junior Member
    Join Date
    Nov 2004
    Posts
    23
    Thanks for all your help, all of you who posted. I REALLY APPREACIATE IT!! I will definitely come here first next time I have a problem. I also think that I will log in once or twice a day just to read the posts and the news so that I can better keep up with things.

    Thanks again
    Willow

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •