IE problems

[tgray]

I am having a problem using the links from the Yahoo home page. Anytime I try to use them I get a page error and they won't load. I am running WindowsXP with SP2, TrendMicro Internet Security Pro. I also run Ad-awareSE faithfully. The problem seems to have started when I downloaded SP2. I have uninstalled SP2 and reinstalled it. I have checked all my settings(DSL, Security etc...) still no change. I can access the sites if I type them in the search bar or the address bar, but the shortcut links and news links all give a page error. Strange thing though, sometimes immediately after running Ad-aware, I can use the links, but as soon as I go back to my home page they are not accessable anymore. I have had nothing in the ad-aware except tracing cookies or minor data miners, nothing new. And no viruses have been found.

I am at a loss. I don't have any problems with the yahoo page at work. The only difference is I am running Win2000 pro there. Everything else is the same. I hope someone can help me figure this out. I take classes online and it is getting very frustrating not being able to use the links.

Thanks in advance for any help
Tim

[Mesaeus]

Try scanning with Spybot too, it will sometimes find things that Adaware misses (and vice versa). If that doesn't work, make a log with HijackThis and post it here and we'll see if there's anything out of the ordinary.

[tgray]

I ran Spybot and fixed everything it found. But no change. So here is a copy of my HijackThis log. Maybe you can see something I don't. I sure hope so.

Thanks

Well here it is....

Logfile of HijackThis v1.97.7
Scan saved at 11:26:33 AM, on 10/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\Trend Micro\Internet Security\pccguide.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.exe
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\INCRED~1\BIN\IMAPP.EXE
C:\DOCUME~1\Default\LOCALS~1\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMMON\YCOMP5_2_3_0.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [e-DT LAN Sniffer] C:\Program Files\HP\e-DiagTools\edtlancfg.exe OS
O4 - HKLM\..\Run: [Microsoft Works Portfolio] c:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - Global Startup: PowerReg Scheduler.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: LimeWire 4.0.7.lnk = C:\Program Files\LimeWire\LimeWire 4.0.7\LimeWire.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &Define - c:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Look Up in &Encyclopedia - c:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} (TTestGenXInstallObject) - http://www.mathxl.com/wizmodules/tes...enXInstall.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.com/applets/deltacvx.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...wflash5r42.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents...r/imloader.cab

[tgray]

I just ran across something. I was going to try a repair on my IE but when I went to the Add/Remove screen, my Internet Explorer was not there. I checked the program files and it still shows everywhere else, just not in the Add/Remove file. I'm not sure that it is anything but I thought it was strange.

[tgray]

Come on guys, can someone look at this log and maybe help. I have tried everything I know to do.

Pleeaase..................

[Expired]

If you have a firewall running it could be blocking session cookies or blocking something else that causes this problem

[Panama Red]

If you are going to post a HiJackThis! log, you need to follow the instructions in the Security forum for doing so. Plus you need to use the lates version of HJT. Think yours is old.

---------------moderator---------------

[glc]

I don't see anything in that log that would cause problems. It almost has to be a security setting somewhere. Try disabling your Trend Micro suite and see what happens.

[tgray]

Thanks for the help. If it helps, I am running XP Pro & trendmicro internet security 2004. I downloaded the newer version of HJT but there was no difference. I also scanned with spy-bot, and housecall, nothing there either. The only time that I get any change is when I run ad-aware. It hasn't found anything other that a few tracing cookies and MRU's but when I clean them, and go to the yahoo homepage, I am able to use the headlines shortcuts. None of the other links work however. I have checked my firewalls, windows-off, trendmicro-on. All the other security settings are either on medium, or default. However, I did find that this problem seems to be limited to just the Yahoo homepage. Just on a hunch I went to google, excite, webcrawler, altavista. No problem with any links from those sites, or any pages i go to after the yahoo homepage. The only new thing that I have downloaded was SP2. I have had the trendmicro for a while and no new programs have been added. This thing simply has me baffled. I still can't find any reason for my Internet Explorer to be gone from the add/remove screen.

I think my brain is fried. I just hope my system isn't....

By the way, I just want to say that I think this is a wonderful site. I have found the fixes for several minor problems for both myself and some of my worksite systems. My boss keeps asking me where I am learning all this stuff. I think I'll keep it a secret for now. Its not often I get to stump him. Thanks for everything and keep up the good work.

[glc]

IE will not be in the add/remove programs section with XP.

If you uninstall SP2, does it work?

[tgray]

no such luck. I feel that is something simple, but I just can't put my finger on it.

[tgray]

I Found It!!! It was a trojan, java_bytever & java_bytever-1. I found that I had a hidden file in the restore files. After I reset the file view and reran my trendmicro it was found and quarantined. I then promptly and with much relish..killed it. After rebooting everything works. It is so nice to be clean again.

Thanks for all the help maybe I can return the favor sometime. So we can close this thread for now.

Thanks again
Tim

[Panama Red]

Congrats, Tim! Way to be persistent. And thanx for getting back with the solution.

[Snoopy]

I have problem using IE. This message always appear when I'm using IE "This program has performed an illegal operation and will be shut down. if the problem persists, contact the program vendor." And I'm using Win98 and IE 6. Can anyone please help me with this?

[glc]

Snoopy, please start a new thread.