IE6 Strange Hang XP

  • Thread starter Thread starter John Harman
  • Start date Start date
J

John Harman

Hi,

I've got an XP pro machine which was running happily, but picked up
some bits of spyware, which have now all been removed (as testified by
HijackThis etc etc).

However, whenever I try to view any pages http://... it hangs.

If I try to load a file c:\test.html then that will work fine until I
click a link to http://..., regardless of whether the http address is
local, or on the web.

I have removed all downloaded program files, temporary internet files
and check that the DNS etc is all working. I've even installed SP2 and
run sfc. All with no luck. I know that the internet connection is
running as I have installed a copy of Opera which works fine.

Any ideas?
 
Hi John :-)

Try the following and see if it helps:

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or.............

Adding HTTP:// to web addresses

You can check these keys and edit them, if necessary, as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
DefaultPrefix default="http://"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
Prefixes
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

or.............

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or........

IE will not connect to a web page without manually typing http://
http://inetexplorer.mvps.org/answers_8.htm

or.......

In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

also....

Courtesy of Tony Klein, MS MVP:

This will restore the Windows defaults for a whole lot of Search related
registry entries.

CAUTION: BACKUP YOUR REGISTRY FIRST!

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:

REGEDIT4 (Watch for the line wrap. Each one should be all on on line.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://

and ..............

Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if you had
any custom adjustments you have made will have to re-select them.


If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
 
Hi Jan.

Thanks for the reply.

I've worked through each of your suggestions and sad to say it hasn't made
any difference.

I have managed to narrow it down slightly in that it appears to hang only
when accessing a page using http:// prefix. I.e. if I load a page from
c:\testpage.html then it loads fine, if I connect on FTP, e.g.
ftp://ftp.download.com then that also appears to work correctly, yet if I
enter http://www.mvps.org into the browser it locks up the moment I press
enter, to the extent that I can't even click on the stop button, and
clicking elsewhere on the screen just causes windows to note that the
program is not responding, from where I have to terminate it from task
manager.

Any further ideas would be appreciated.

Regards,

John Harman
Jan Il said:
Hi John :-)

Try the following and see if it helps:

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or.............

Adding HTTP:// to web addresses

You can check these keys and edit them, if necessary, as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
DefaultPrefix default="http://"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
Prefixes
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

or.............

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or........

IE will not connect to a web page without manually typing http://
http://inetexplorer.mvps.org/answers_8.htm

or.......

In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

also....

Courtesy of Tony Klein, MS MVP:

This will restore the Windows defaults for a whole lot of Search related
registry entries.

CAUTION: BACKUP YOUR REGISTRY FIRST!

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all
files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:

REGEDIT4 (Watch for the line wrap. Each one should be all on on line.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search
Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://

and ..............

Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if you had
any custom adjustments you have made will have to re-select them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm








Hi,

I've got an XP pro machine which was running happily, but picked up
some bits of spyware, which have now all been removed (as testified by
HijackThis etc etc).

However, whenever I try to view any pages http://... it hangs.

If I try to load a file c:\test.html then that will work fine until I
click a link to http://..., regardless of whether the http address is
local, or on the web.

I have removed all downloaded program files, temporary internet files
and check that the DNS etc is all working. I've even installed SP2 and
run sfc. All with no luck. I know that the internet connection is
running as I have installed a copy of Opera which works fine.

Any ideas?
 
Hi John :-)

Hi Jan.

Thanks for the reply.

I've worked through each of your suggestions and sad to say it hasn't made
any difference.

I have managed to narrow it down slightly in that it appears to hang only
when accessing a page using http:// prefix. I.e. if I load a page from
c:\testpage.html then it loads fine, if I connect on FTP, e.g.
ftp://ftp.download.com then that also appears to work correctly, yet if I
enter http://www.mvps.org into the browser it locks up the moment I press
enter, to the extent that I can't even click on the stop button, and
clicking elsewhere on the screen just causes windows to note that the
program is not responding, from where I have to terminate it from task
manager.

Any further ideas would be appreciated.

Try the following and see if this will help re-establish the relationship:

Go to Start>Run: Then enter each of the lines below one at a time. After
each run, you should see a short message stating the command was successful.
The first command is the one most likely to work.

regsvr32 Urlmon.dll
regsvr32 Shdocvw.dll
regsvr32 shdoc401.dll (only applicable to Windows 98 and earlier- if using a
later operating system, run regsvr32 Shell32.dll )
regsvr32 Oleaut32.dll
regsvr32 Actxprxy.dll
regsvr32 Mshtml.dll

If that does not work, try replacing OLEAUT32.dll, it will usually work when
all else has failed.

First, do a Search and find the current OLEAUT32.dll file and rename it
(just add OLD to the extension, DO NOT DELETE IT. Make sure to note the
original name of the file before renaming it). Then go here and scroll down
to the O's and then select the OLEAUT32.dll from the list and download it to
the same folder where you found the original file.
http://www.5starsupport.com/info/dll.htm

Once it is replaced you must then re-register the new OLEAUT32.dll file as
shown above. Once you are sure all is well you can delete the OLD file. If
this does not resolve the problem, then delete the new file, and rename to
OLD file back to the it's original name and re-register it as before.

If still no joy, you might also try:.....

Safely Delete the Temporary Internet Files
http://www.mvps.org/winhelp2002/delcache.htm

The temporary I.E. files folder is a cache for web pages that you have
visited. I don't know why Microsoft sets the default so high, but I have
seen 2gb set for storage. This and other setting can be changed to decreace
the size of the storage area, and supposedly delete the I.E. temp file when
you close the browser.

The Cache
http://sweb.uky.edu/~wvang00/sayre/cache.htm

and..........

Start/Run > enter sfc /scannow (note the space between the c and /) and hit
Enter

If still no help from the above, you can also try the
following..............

Download, install and run WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)

and.........

NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them.


If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
Jan Il said:
Hi John :-)

Try the following and see if it helps:

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or.............

Adding HTTP:// to web addresses

You can check these keys and edit them, if necessary, as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
DefaultPrefix default="http://"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
Prefixes
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

or.............

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or........

IE will not connect to a web page without manually typing http://
http://inetexplorer.mvps.org/answers_8.htm

or.......

In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

also....

Courtesy of Tony Klein, MS MVP:

This will restore the Windows defaults for a whole lot of Search related
registry entries.

CAUTION: BACKUP YOUR REGISTRY FIRST!

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all
files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:

REGEDIT4 (Watch for the line wrap. Each one should be all on on line.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search
Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://

and ..............

Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if you had
any custom adjustments you have made will have to re-select them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm








Hi,

I've got an XP pro machine which was running happily, but picked up
some bits of spyware, which have now all been removed (as testified by
HijackThis etc etc).

However, whenever I try to view any pages http://... it hangs.

If I try to load a file c:\test.html then that will work fine until I
click a link to http://..., regardless of whether the http address is
local, or on the web.

I have removed all downloaded program files, temporary internet files
and check that the DNS etc is all working. I've even installed SP2 and
run sfc. All with no luck. I know that the internet connection is
running as I have installed a copy of Opera which works fine.

Any ideas?
 
Hi Jan,

I've followed through each of your suggestions and have to report that it
hasn't really made any difference.

Just to recap, IE 6SP1 on WinXP SP2, can open remote ftp sites fine, can
render local pages (e.g. c:\test.html), but as soon as a remote page is
requested (e.g. http://www.google.com) IE locks up to the extent that no
buttons can be pressed and the only action available is to close it from
task manager. I've tried leaving it for hours to see if it is just taking
it's time - no response and no error message to report (annoyingly).

I have Opera7 installed on the machine which works fine. There was
previously some spyware apps which had got onto the machine, but I believe
they have all been removed, nothing in temporary internet files, temp,
downloaded program files/BHO's, hosts file, or memory as far as I can see,
sfc has been run several times.

I even tried the oleaut32.dll file from another, very similar machine
without any joy (now reverted back to original).

For your info. the netsh command returned a response saying it had cleared
the winsock catalogue as you suggested.

Any other ideas as to where to look? Thanks for all your help so far.

Regards,

John Harman
Jan Il said:
Hi John :-)

Hi Jan.

Thanks for the reply.

I've worked through each of your suggestions and sad to say it hasn't
made
any difference.

I have managed to narrow it down slightly in that it appears to hang only
when accessing a page using http:// prefix. I.e. if I load a page from
c:\testpage.html then it loads fine, if I connect on FTP, e.g.
ftp://ftp.download.com then that also appears to work correctly, yet if I
enter http://www.mvps.org into the browser it locks up the moment I press
enter, to the extent that I can't even click on the stop button, and
clicking elsewhere on the screen just causes windows to note that the
program is not responding, from where I have to terminate it from task
manager.

Any further ideas would be appreciated.

Try the following and see if this will help re-establish the relationship:

Go to Start>Run: Then enter each of the lines below one at a time. After
each run, you should see a short message stating the command was
successful.
The first command is the one most likely to work.

regsvr32 Urlmon.dll
regsvr32 Shdocvw.dll
regsvr32 shdoc401.dll (only applicable to Windows 98 and earlier- if using
a
later operating system, run regsvr32 Shell32.dll )
regsvr32 Oleaut32.dll
regsvr32 Actxprxy.dll
regsvr32 Mshtml.dll

If that does not work, try replacing OLEAUT32.dll, it will usually work
when
all else has failed.

First, do a Search and find the current OLEAUT32.dll file and rename it
(just add OLD to the extension, DO NOT DELETE IT. Make sure to note the
original name of the file before renaming it). Then go here and scroll
down
to the O's and then select the OLEAUT32.dll from the list and download it
to
the same folder where you found the original file.
http://www.5starsupport.com/info/dll.htm

Once it is replaced you must then re-register the new OLEAUT32.dll file as
shown above. Once you are sure all is well you can delete the OLD file.
If
this does not resolve the problem, then delete the new file, and rename to
OLD file back to the it's original name and re-register it as before.

If still no joy, you might also try:.....

Safely Delete the Temporary Internet Files
http://www.mvps.org/winhelp2002/delcache.htm

The temporary I.E. files folder is a cache for web pages that you have
visited. I don't know why Microsoft sets the default so high, but I have
seen 2gb set for storage. This and other setting can be changed to
decreace
the size of the storage area, and supposedly delete the I.E. temp file
when
you close the browser.

The Cache
http://sweb.uky.edu/~wvang00/sayre/cache.htm

and..........

Start/Run > enter sfc /scannow (note the space between the c and /) and
hit
Enter

If still no help from the above, you can also try the
following..............

Download, install and run WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)

and.........

NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer
called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
Jan Il said:
Hi John :-)

Try the following and see if it helps:

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or.............

Adding HTTP:// to web addresses

You can check these keys and edit them, if necessary, as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
DefaultPrefix default="http://"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
Prefixes
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

or.............

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or........

IE will not connect to a web page without manually typing http://
http://inetexplorer.mvps.org/answers_8.htm

or.......

In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

also....

Courtesy of Tony Klein, MS MVP:

This will restore the Windows defaults for a whole lot of Search
related
registry entries.

CAUTION: BACKUP YOUR REGISTRY FIRST!

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all
files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:

REGEDIT4 (Watch for the line wrap. Each one should be all on on
line.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search
Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://

and ..............

Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if you had
any custom adjustments you have made will have to re-select them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm








Hi,

I've got an XP pro machine which was running happily, but picked up
some bits of spyware, which have now all been removed (as testified by
HijackThis etc etc).

However, whenever I try to view any pages http://... it hangs.

If I try to load a file c:\test.html then that will work fine until I
click a link to http://..., regardless of whether the http address is
local, or on the web.

I have removed all downloaded program files, temporary internet files
and check that the DNS etc is all working. I've even installed SP2 and
run sfc. All with no luck. I know that the internet connection is
running as I have installed a copy of Opera which works fine.

Any ideas?
 
Hi John :-)


Hmmm......well.....since the above procedures did not resolve the issue, I
tend to suspect the possibility of some form of warez on your system may be
causing the problem. Although you may have already run some programs to
remove spyware and such, try scanning again according to the instructions
below, especially, the HiJackThis program, as it may reveal items the others
do not.

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder, Ad-aware and Spybot.
Also be sure to use the HijackThis. Please do not post your log to this
newsgroup, but to the SpywareInfo or the Aumha HiJackThis forums
http://forum.aumha.org/viewforum.php?f=30, to allow the experts there to
evaluate your log and advise you of the necessary steps to clean your
system.

AdAware SE: Free
http://www.lavasoft.de/software/adaware/

New CWShredder version: Free
http://www.intermute.com/spysubtract/cwshredder_download.html


If there is no eveidence of system foul ware found, then I can only suggest
a repair of IE itself.
Spyware removal can often cause corruption or damage to files that have to
be replaced by a repair of IE. Before doing a repair of XP, I strongly
suggest that you uninstall the SP2 first.
875350 - How to remove XP SP2
http://support.microsoft.com/default.aspx?
kbid=875350&product=windowsxpsp2kb

then........

How to Reinstall or Repair Internet Explorer and Outlook Express in
Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q318378
How to Uninstall Internet Explorer 6
http://support.microsoft.com/default.aspx?scid=kb;en-us;293907&Product=ie600
Unable to Install Internet Explorer 6 on Windows XP
http://support.microsoft.com/?kbid=304872
Tricking Windows into letting you reinstall IE6
http://www.bleepingcomputer.com/forums/index.php?showtutorial=71

or...................


You cannot install some updates or programs
http://support.microsoft.com/?kbid=822798

"The Software You Are Installing Has Not Passed Windows Logo Testing..."
Error Message When You Try to Install Internet Explorer 6 SP1
http://support.microsoft.com/?kbid=828031

Unable to install Internet Explorer 6 on XP
http://www.tek-tips.com/gfaqs.cfm/lev2/67/lev3/70/pid/779/fid/1586

or................

Here is a more recent suggestion I have been giving to XP users
who want to try some repair procedures.

<TITLE>831429 - Windows XP stops responding when you download updates
from Windows Update</TITLE>
< http://support.microsoft.com/default.aspx?scid=kb;en-us;831429 >

It is actually a more comprehensive set of re-registrations than an
IE Repair with the default FixIE.inf would do for either NT5.

Although they are listed specifically for W2K they should apply
equally to XP.

Additionally, the information here may be of some assistance:

Windows XP From A-Z
http://www.kellys-korner-xp.com/xp_abc.htm


If these steps do not resolve your problem, please post back to this thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm


Hi Jan,

I've followed through each of your suggestions and have to report that it
hasn't really made any difference.

Just to recap, IE 6SP1 on WinXP SP2, can open remote ftp sites fine, can
render local pages (e.g. c:\test.html), but as soon as a remote page is
requested (e.g. http://www.google.com) IE locks up to the extent that no
buttons can be pressed and the only action available is to close it from
task manager. I've tried leaving it for hours to see if it is just taking
it's time - no response and no error message to report (annoyingly).

I have Opera7 installed on the machine which works fine. There was
previously some spyware apps which had got onto the machine, but I believe
they have all been removed, nothing in temporary internet files, temp,
downloaded program files/BHO's, hosts file, or memory as far as I can see,
sfc has been run several times.

I even tried the oleaut32.dll file from another, very similar machine
without any joy (now reverted back to original).

For your info. the netsh command returned a response saying it had cleared
the winsock catalogue as you suggested.

Any other ideas as to where to look? Thanks for all your help so far.



John Harman
Jan Il said:
Hi John :-)

Hi Jan.

Thanks for the reply.

I've worked through each of your suggestions and sad to say it hasn't
made
any difference.

I have managed to narrow it down slightly in that it appears to hang only
when accessing a page using http:// prefix. I.e. if I load a page from
c:\testpage.html then it loads fine, if I connect on FTP, e.g.
ftp://ftp.download.com then that also appears to work correctly, yet if I
enter http://www.mvps.org into the browser it locks up the moment I press
enter, to the extent that I can't even click on the stop button, and
clicking elsewhere on the screen just causes windows to note that the
program is not responding, from where I have to terminate it from task
manager.

Any further ideas would be appreciated.

Try the following and see if this will help re-establish the relationship:

Go to Start>Run: Then enter each of the lines below one at a time. After
each run, you should see a short message stating the command was
successful.
The first command is the one most likely to work.

regsvr32 Urlmon.dll
regsvr32 Shdocvw.dll
regsvr32 shdoc401.dll (only applicable to Windows 98 and earlier- if using
a
later operating system, run regsvr32 Shell32.dll )
regsvr32 Oleaut32.dll
regsvr32 Actxprxy.dll
regsvr32 Mshtml.dll

If that does not work, try replacing OLEAUT32.dll, it will usually work
when
all else has failed.

First, do a Search and find the current OLEAUT32.dll file and rename it
(just add OLD to the extension, DO NOT DELETE IT. Make sure to note the
original name of the file before renaming it). Then go here and scroll
down
to the O's and then select the OLEAUT32.dll from the list and download it
to
the same folder where you found the original file.
http://www.5starsupport.com/info/dll.htm

Once it is replaced you must then re-register the new OLEAUT32.dll file as
shown above. Once you are sure all is well you can delete the OLD file.
If
this does not resolve the problem, then delete the new file, and rename to
OLD file back to the it's original name and re-register it as before.

If still no joy, you might also try:.....

Safely Delete the Temporary Internet Files
http://www.mvps.org/winhelp2002/delcache.htm

The temporary I.E. files folder is a cache for web pages that you have
visited. I don't know why Microsoft sets the default so high, but I have
seen 2gb set for storage. This and other setting can be changed to
decreace
the size of the storage area, and supposedly delete the I.E. temp file
when
you close the browser.

The Cache
http://sweb.uky.edu/~wvang00/sayre/cache.htm

and..........

Start/Run > enter sfc /scannow (note the space between the c and /) and
hit
Enter

If still no help from the above, you can also try the
following..............

Download, install and run WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)

and.........

NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer
called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm
Hi John :-)

Try the following and see if it helps:

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or.............

Adding HTTP:// to web addresses

You can check these keys and edit them, if necessary, as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
DefaultPrefix default="http://"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
Prefixes
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

or.............

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or........

IE will not connect to a web page without manually typing http://
http://inetexplorer.mvps.org/answers_8.htm

or.......

In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

also....

Courtesy of Tony Klein, MS MVP:

This will restore the Windows defaults for a whole lot of Search
related
registry entries.

CAUTION: BACKUP YOUR REGISTRY FIRST!

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all
files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:

REGEDIT4 (Watch for the line wrap. Each one should be all on on
line.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search
Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://

and ..............

Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if you had
any custom adjustments you have made will have to re-select them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm








Hi,

I've got an XP pro machine which was running happily, but picked up
some bits of spyware, which have now all been removed (as testified by
HijackThis etc etc).

However, whenever I try to view any pages http://... it hangs.

If I try to load a file c:\test.html then that will work fine until I
click a link to http://..., regardless of whether the http address is
local, or on the web.

I have removed all downloaded program files, temporary internet files
and check that the DNS etc is all working. I've even installed SP2 and
run sfc. All with no luck. I know that the internet connection is
running as I have installed a copy of Opera which works fine.

Any ideas?
 
Hi Jan,

Having spent several hours trudging through pieces on this machine I just
thought I'd let you know the outcome.

There was an innocuous program called c:\windows\system32\msbl.exe which was
attaching it'self to the login shell and causing the lock-ups, at first
glance it appears to be a perfectly legit MS program, but under further
investigation is not.

Thanks for all your efforts. I've learnt a lot about the background workings
of IE over the last week or so!

Regards,

John Harman
Jan Il said:
Hi John :-)


Hmmm......well.....since the above procedures did not resolve the issue, I
tend to suspect the possibility of some form of warez on your system may
be
causing the problem. Although you may have already run some programs to
remove spyware and such, try scanning again according to the instructions
below, especially, the HiJackThis program, as it may reveal items the
others
do not.

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder, Ad-aware and Spybot.
Also be sure to use the HijackThis. Please do not post your log to this
newsgroup, but to the SpywareInfo or the Aumha HiJackThis forums
http://forum.aumha.org/viewforum.php?f=30, to allow the experts there to
evaluate your log and advise you of the necessary steps to clean your
system.

AdAware SE: Free
http://www.lavasoft.de/software/adaware/

New CWShredder version: Free
http://www.intermute.com/spysubtract/cwshredder_download.html


If there is no eveidence of system foul ware found, then I can only
suggest
a repair of IE itself.
Spyware removal can often cause corruption or damage to files that have to
be replaced by a repair of IE. Before doing a repair of XP, I strongly
suggest that you uninstall the SP2 first.
875350 - How to remove XP SP2
http://support.microsoft.com/default.aspx?
kbid=875350&product=windowsxpsp2kb

then........

How to Reinstall or Repair Internet Explorer and Outlook Express in
Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q318378
How to Uninstall Internet Explorer 6
http://support.microsoft.com/default.aspx?scid=kb;en-us;293907&Product=ie600
Unable to Install Internet Explorer 6 on Windows XP
http://support.microsoft.com/?kbid=304872
Tricking Windows into letting you reinstall IE6
http://www.bleepingcomputer.com/forums/index.php?showtutorial=71

or...................


You cannot install some updates or programs
http://support.microsoft.com/?kbid=822798

"The Software You Are Installing Has Not Passed Windows Logo Testing..."
Error Message When You Try to Install Internet Explorer 6 SP1
http://support.microsoft.com/?kbid=828031

Unable to install Internet Explorer 6 on XP
http://www.tek-tips.com/gfaqs.cfm/lev2/67/lev3/70/pid/779/fid/1586

or................

Here is a more recent suggestion I have been giving to XP users
who want to try some repair procedures.

<TITLE>831429 - Windows XP stops responding when you download updates
from Windows Update</TITLE>
< http://support.microsoft.com/default.aspx?scid=kb;en-us;831429 >

It is actually a more comprehensive set of re-registrations than an
IE Repair with the default FixIE.inf would do for either NT5.

Although they are listed specifically for W2K they should apply
equally to XP.

Additionally, the information here may be of some assistance:

Windows XP From A-Z
http://www.kellys-korner-xp.com/xp_abc.htm


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm


Hi Jan,

I've followed through each of your suggestions and have to report that it
hasn't really made any difference.

Just to recap, IE 6SP1 on WinXP SP2, can open remote ftp sites fine, can
render local pages (e.g. c:\test.html), but as soon as a remote page is
requested (e.g. http://www.google.com) IE locks up to the extent that no
buttons can be pressed and the only action available is to close it from
task manager. I've tried leaving it for hours to see if it is just taking
it's time - no response and no error message to report (annoyingly).

I have Opera7 installed on the machine which works fine. There was
previously some spyware apps which had got onto the machine, but I
believe
they have all been removed, nothing in temporary internet files, temp,
downloaded program files/BHO's, hosts file, or memory as far as I can
see,
sfc has been run several times.

I even tried the oleaut32.dll file from another, very similar machine
without any joy (now reverted back to original).

For your info. the netsh command returned a response saying it had
cleared
the winsock catalogue as you suggested.

Any other ideas as to where to look? Thanks for all your help so far.



John Harman
Jan Il said:
Hi John :-)

Hi Jan.

Thanks for the reply.

I've worked through each of your suggestions and sad to say it hasn't
made
any difference.

I have managed to narrow it down slightly in that it appears to hang only
when accessing a page using http:// prefix. I.e. if I load a page from
c:\testpage.html then it loads fine, if I connect on FTP, e.g.
ftp://ftp.download.com then that also appears to work correctly, yet
if I
enter http://www.mvps.org into the browser it locks up the moment I press
enter, to the extent that I can't even click on the stop button, and
clicking elsewhere on the screen just causes windows to note that the
program is not responding, from where I have to terminate it from task
manager.

Any further ideas would be appreciated.

Try the following and see if this will help re-establish the relationship:

Go to Start>Run: Then enter each of the lines below one at a time. After
each run, you should see a short message stating the command was
successful.
The first command is the one most likely to work.

regsvr32 Urlmon.dll
regsvr32 Shdocvw.dll
regsvr32 shdoc401.dll (only applicable to Windows 98 and earlier- if using
a
later operating system, run regsvr32 Shell32.dll )
regsvr32 Oleaut32.dll
regsvr32 Actxprxy.dll
regsvr32 Mshtml.dll

If that does not work, try replacing OLEAUT32.dll, it will usually work
when
all else has failed.

First, do a Search and find the current OLEAUT32.dll file and rename it
(just add OLD to the extension, DO NOT DELETE IT. Make sure to note
the
original name of the file before renaming it). Then go here and scroll
down
to the O's and then select the OLEAUT32.dll from the list and download it
to
the same folder where you found the original file.
http://www.5starsupport.com/info/dll.htm

Once it is replaced you must then re-register the new OLEAUT32.dll file as
shown above. Once you are sure all is well you can delete the OLD
file.
If
this does not resolve the problem, then delete the new file, and rename to
OLD file back to the it's original name and re-register it as before.

If still no joy, you might also try:.....

Safely Delete the Temporary Internet Files
http://www.mvps.org/winhelp2002/delcache.htm

The temporary I.E. files folder is a cache for web pages that you have
visited. I don't know why Microsoft sets the default so high, but I
have
seen 2gb set for storage. This and other setting can be changed to
decreace
the size of the storage area, and supposedly delete the I.E. temp file
when
you close the browser.

The Cache
http://sweb.uky.edu/~wvang00/sayre/cache.htm

and..........

Start/Run > enter sfc /scannow (note the space between the c and /)
and
hit
Enter

If still no help from the above, you can also try the
following..............

Download, install and run WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)

and.........

NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer
called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm


Hi John :-)

Try the following and see if it helps:

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or.............

Adding HTTP:// to web addresses

You can check these keys and edit them, if necessary, as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
DefaultPrefix default="http://"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
Prefixes
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

or.............

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or........

IE will not connect to a web page without manually typing http://
http://inetexplorer.mvps.org/answers_8.htm

or.......

In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may
have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

also....

Courtesy of Tony Klein, MS MVP:

This will restore the Windows defaults for a whole lot of Search
related
registry entries.

CAUTION: BACKUP YOUR REGISTRY FIRST!

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all
files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:

REGEDIT4 (Watch for the line wrap. Each one should be all on on
line.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
htm"

"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
htm"

"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search
Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://

and ..............

Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if
you
had
any custom adjustments you have made will have to re-select them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other
readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm








Hi,

I've got an XP pro machine which was running happily, but picked up
some bits of spyware, which have now all been removed (as testified by
HijackThis etc etc).

However, whenever I try to view any pages http://... it hangs.

If I try to load a file c:\test.html then that will work fine until I
click a link to http://..., regardless of whether the http address is
local, or on the web.

I have removed all downloaded program files, temporary internet files
and check that the DNS etc is all working. I've even installed SP2 and
run sfc. All with no luck. I know that the internet connection is
running as I have installed a copy of Opera which works fine.

Any ideas?
 
John Harman said:
Hi Jan,

Having spent several hours trudging through pieces on this machine I just
thought I'd let you know the outcome.

There was an innocuous program called c:\windows\system32\msbl.exe which was
attaching it'self to the login shell and causing the lock-ups, at first
glance it appears to be a perfectly legit MS program, but under further
investigation is not.

Thanks for all your efforts. I've learnt a lot about the background workings
of IE over the last week or so!

Regards,

John Harman
Jan Il said:
Hi John :-)


Hmmm......well.....since the above procedures did not resolve the issue, I
tend to suspect the possibility of some form of warez on your system may
be
causing the problem. Although you may have already run some programs to
remove spyware and such, try scanning again according to the instructions
below, especially, the HiJackThis program, as it may reveal items the
others
do not.

Dealing with Unwanted Spyware and Parasites:
http://mvps.org/winhelp2002/unwanted.htm
Be sure to run CWShredder, Ad-aware and Spybot.
Also be sure to use the HijackThis. Please do not post your log to this
newsgroup, but to the SpywareInfo or the Aumha HiJackThis forums
http://forum.aumha.org/viewforum.php?f=30, to allow the experts there to
evaluate your log and advise you of the necessary steps to clean your
system.

AdAware SE: Free
http://www.lavasoft.de/software/adaware/

New CWShredder version: Free
http://www.intermute.com/spysubtract/cwshredder_download.html


If there is no eveidence of system foul ware found, then I can only
suggest
a repair of IE itself.
Spyware removal can often cause corruption or damage to files that have to
be replaced by a repair of IE. Before doing a repair of XP, I strongly
suggest that you uninstall the SP2 first.
875350 - How to remove XP SP2
http://support.microsoft.com/default.aspx?
kbid=875350&product=windowsxpsp2kb

then........

How to Reinstall or Repair Internet Explorer and Outlook Express in
Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q318378
How to Uninstall Internet Explorer 6
http://support.microsoft.com/default.aspx?scid=kb;en-us;293907&Product=ie600
Unable to Install Internet Explorer 6 on Windows XP
http://support.microsoft.com/?kbid=304872
Tricking Windows into letting you reinstall IE6
http://www.bleepingcomputer.com/forums/index.php?showtutorial=71

or...................


You cannot install some updates or programs
http://support.microsoft.com/?kbid=822798

"The Software You Are Installing Has Not Passed Windows Logo Testing..."
Error Message When You Try to Install Internet Explorer 6 SP1
http://support.microsoft.com/?kbid=828031

Unable to install Internet Explorer 6 on XP
http://www.tek-tips.com/gfaqs.cfm/lev2/67/lev3/70/pid/779/fid/1586

or................

Here is a more recent suggestion I have been giving to XP users
who want to try some repair procedures.

<TITLE>831429 - Windows XP stops responding when you download updates
from Windows Update</TITLE>
< http://support.microsoft.com/default.aspx?scid=kb;en-us;831429 >

It is actually a more comprehensive set of re-registrations than an
IE Repair with the default FixIE.inf would do for either NT5.

Although they are listed specifically for W2K they should apply
equally to XP.

Additionally, the information here may be of some assistance:

Windows XP From A-Z
http://www.kellys-korner-xp.com/xp_abc.htm


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm


Hi Jan,

I've followed through each of your suggestions and have to report that it
hasn't really made any difference.

Just to recap, IE 6SP1 on WinXP SP2, can open remote ftp sites fine, can
render local pages (e.g. c:\test.html), but as soon as a remote page is
requested (e.g. http://www.google.com) IE locks up to the extent that no
buttons can be pressed and the only action available is to close it from
task manager. I've tried leaving it for hours to see if it is just taking
it's time - no response and no error message to report (annoyingly).

I have Opera7 installed on the machine which works fine. There was
previously some spyware apps which had got onto the machine, but I
believe
they have all been removed, nothing in temporary internet files, temp,
downloaded program files/BHO's, hosts file, or memory as far as I can
see,
sfc has been run several times.

I even tried the oleaut32.dll file from another, very similar machine
without any joy (now reverted back to original).

For your info. the netsh command returned a response saying it had
cleared
the winsock catalogue as you suggested.

Any other ideas as to where to look? Thanks for all your help so far.



John Harman
Hi John :-)

Hi Jan.

Thanks for the reply.

I've worked through each of your suggestions and sad to say it hasn't
made
any difference.

I have managed to narrow it down slightly in that it appears to hang only
when accessing a page using http:// prefix. I.e. if I load a page from
c:\testpage.html then it loads fine, if I connect on FTP, e.g.
ftp://ftp.download.com then that also appears to work correctly, yet
if I
enter http://www.mvps.org into the browser it locks up the moment I press
enter, to the extent that I can't even click on the stop button, and
clicking elsewhere on the screen just causes windows to note that the
program is not responding, from where I have to terminate it from task
manager.

Any further ideas would be appreciated.

Try the following and see if this will help re-establish the relationship:

Go to Start>Run: Then enter each of the lines below one at a time. After
each run, you should see a short message stating the command was
successful.
The first command is the one most likely to work.

regsvr32 Urlmon.dll
regsvr32 Shdocvw.dll
regsvr32 shdoc401.dll (only applicable to Windows 98 and earlier- if using
a
later operating system, run regsvr32 Shell32.dll )
regsvr32 Oleaut32.dll
regsvr32 Actxprxy.dll
regsvr32 Mshtml.dll

If that does not work, try replacing OLEAUT32.dll, it will usually work
when
all else has failed.

First, do a Search and find the current OLEAUT32.dll file and rename it
(just add OLD to the extension, DO NOT DELETE IT. Make sure to note
the
original name of the file before renaming it). Then go here and scroll
down
to the O's and then select the OLEAUT32.dll from the list and download it
to
the same folder where you found the original file.
http://www.5starsupport.com/info/dll.htm

Once it is replaced you must then re-register the new OLEAUT32.dll file as
shown above. Once you are sure all is well you can delete the OLD
file.
If
this does not resolve the problem, then delete the new file, and rename to
OLD file back to the it's original name and re-register it as before.

If still no joy, you might also try:.....

Safely Delete the Temporary Internet Files
http://www.mvps.org/winhelp2002/delcache.htm

The temporary I.E. files folder is a cache for web pages that you have
visited. I don't know why Microsoft sets the default so high, but I
have
seen 2gb set for storage. This and other setting can be changed to
decreace
the size of the storage area, and supposedly delete the I.E. temp file
when
you close the browser.

The Cache
http://sweb.uky.edu/~wvang00/sayre/cache.htm

and..........

Start/Run > enter sfc /scannow (note the space between the c and /)
and
hit
Enter

If still no help from the above, you can also try the
following..............

Download, install and run WINSOCKXPFIX available at:
http://www.spychecker.com/program/winsockxpfix.html
and
WinsockXP Fix- WinXP
http://www.spychecker.com/program/winsockxpfix.html
Also, with instructions, at
http://www.iup.edu/house/resnet/winfix.shtm
also
From LavaSoft- all versions of Windows-
http://digital-solutions.co.uk/lavasoft/whndnfix.zip
also ....
(NOTE: It is reported that in XP SP2, the command netsh winsock reset
will fix this problem without the need for these programs.)

and.........

NOTE: If you can not download these programs from the Internet, if your PC
has CD read capabilities, go to another computer with CD-ROM burning
capabilities. Create a folder on the hard drive of the other computer
called
HOLD, download the programs to that folder, then burn that folder to a CD.
Copy the HOLD folder to your HD and then install the programs from there
and run them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm


Hi John :-)

Try the following and see if it helps:

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or.............

Adding HTTP:// to web addresses

You can check these keys and edit them, if necessary, as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
DefaultPrefix default="http://"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\
Prefixes
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"

or.............

Repairs the corrupted or altered (spyware) HTTP prefixes
http://mvps.org/winhelp2002/RepairDefaultPrefix.reg

or........

IE will not connect to a web page without manually typing http://
http://inetexplorer.mvps.org/answers_8.htm

or.......

In order to restore you default Search functions, download and run the
program below. You will have to redo any customized features you may
have
added afterward.
http://www.kellys-korner-xp.com/regs_edits/RestoreSearch2.REG

also....

Courtesy of Tony Klein, MS MVP:

This will restore the Windows defaults for a whole lot of Search
related
registry entries.

CAUTION: BACKUP YOUR REGISTRY FIRST!

Close IE, copy the bold to Notepad, save as Search.reg (save as 'all
files',
and doubleclick. Answer 'yes' when prompted to add the contents of
Search.reg to the Registry:

REGEDIT4 (Watch for the line wrap. Each one should be all on on
line.)

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]

"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=ies
earch"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search
Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPre
fix] @="http://"


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]"
ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://

and ..............

Download the fix - Reset Search:
http://www.spywareinfo.com/downloads/tools/IEFIX.reg
This will restore your default Search functionality. However, if
you
had
any custom adjustments you have made will have to re-select them.


If these steps do not resolve your problem, please post back to this
thread
with the details and any error messages.

Hope this helps

Jan :)
Smiles are meant to be shared,
that's why they're so contagious.

Please reply to the newsgroup so others may benefit.
Replies are posted only to the newsgroup for the benefit or other
readers.

How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm








Hi,

I've got an XP pro machine which was running happily, but picked up
some bits of spyware, which have now all been removed (as testified by
HijackThis etc etc).

However, whenever I try to view any pages http://... it hangs.

If I try to load a file c:\test.html then that will work fine until I
click a link to http://..., regardless of whether the http address is
local, or on the web.

I have removed all downloaded program files, temporary internet files
and check that the DNS etc is all working. I've even installed SP2 and
run sfc. All with no luck. I know that the internet connection is
running as I have installed a copy of Opera which works fine.

Any ideas?
 
Back
Top