Hi Jack - Well, it shouldn't affect it if it's really a scripting problem,
but I've seen stranger things. I'm going to suggest that you also install
the Sun VM and try it to see if that affects the problem.
First, though I'd like you to make sure that there isn't some malware
involved that may be causing (contributing) to this problem. The fact that
the problem returned when you rebooted is very suspicious. Please go
through the following procedure at least through updating and running
AdAware and SpyBot S&D, using HijackThis and the other Startup vector
controllers, and the stuff about BHO's. Also take a look in Add-Remove
Programs and see if you notice any "strangers" there.
..
If you go to this page at Jim Eshelman's site, here:
http://aumha.org/a/noads.htm and wait a little bit (be patient), an analysis
of a number of possible parasites on your machine will be made to help you
identify and remove them. NOTE: You will need to disable Ad Blocking in
Zone Alarm 3.x, if present or any other Ad Blocking software which
interferes with Java Scripting for this scan to work. You should get a
message between the two lines of **** giving the results of the scan.
For the general hijack case, the best way to start is to get Ad-Aware 6.0,
Build 181 or later, here:
http://www.lavasoftusa.com/support/download/.
Update and run this regularly to get rid of most "spyware/hijackware" on
your machine. If it has to fix things, be sure to re-boot and rerun
AdAware again and repeat this cycle until you get a clean scan. The reason
is that it may have to remove things which are currently "in use" before it
can then clean up others.
Another excellent program for this purpose is SpyBot Search and Destroy
available here:
http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan. The reason is that SpyBot sometimes has to remove things
which are currently "in use" before it can then clean up others.
Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm
Lastly, a very useful utility for examining your system and correcting
problems is Hijack This, which you can download here:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip See also,
HijackThis Quick Start Help,
http://www.tomcoyote.org/hjt/ (Recommended)
This site has a number of useful references and information also:
http://www.spywareinfo.com/articles/hijacked/ and here
http://www.spywareinfo.com/downloads.php
Another program giving a good inventory of all of the possible start vectors
is AutostartExplorer, here:
http://www.misec.net/aexp.jsp While it doesn't
allow control of startups, it's extremely comprehensive in examining all of
the possible sources. Highly Recommended
Next, go here:
http://www.mlin.net/StartupCPL.shtml and get Mike Lin's
Startup Control Panel applet. A somewhat more difficult to use but more
extensive program to do the same thing is StartupList from here:
http://www.lurkhere.com/~nicefiles/index.html, or even better, Autoruns from
here:
http://www.sysinternals.com/ntw2k/source/misc.shtml#autoruns. Be
very careful about doing any Registry modifications directly unless you're
comfortable with this, and be sure that you BACKUP your Registry before
making any changes, so that you can recover if something goes wrong.
Changes made with StartUpCPL are less likely to cause problems, and are
usually a matter of just re-enabling the particular program. Another
program of this type that I can recommend is StartMan, free, here:
http://www.spywareinfo.com/downloads/startman/. If you have problems with
suspected hijackers, you can look up and investigate suspect programs in
your StartUp lists here:
http://www.pacs-portal.co.uk/startup_pages/startup_full.htm (Recommended)
http://www.3feetunder.com/krick/startup/list.html (Recommended)
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm (Recommended)
Some hijackers install themselves as Browser Helper Objects. Get BHOCop
here: BHO Cop
http://www.pcmag.com/article2/0,4149,270,00.asp
(Unfortunately, no longer free from that link but you can read about it
there, and here is a direct download link for it:
http://websec.arcady.fr/bhocop.zip) and take a look at what BHO's are
currently installed. Some things like AdShield and Acrobat are normal, but
if you see something that doesn't make any sense, try disabling it and see
if that helps. Another excellent program for this same purpose is BHODemon,
(still free) here:
http://www.definitivesolutions.com/ or here:
http://www.spywareinfo.com/downloads/bhod/ I would recommend both. You can
also check/control BHO's using the Tools function of SpyBot S&D.
If ALL of this comes up clean, you might want to consider installing the
SpywareBlaster and SpywareGuard here to help prevent this kind of thing from
happening in the future:
http://www.wilderssecurity.com/spywareblaster.html (Prevents malware Active
X installs) (BTW, SpyWare Blaster is not memory resident ... no CPU or
memory load - but keep it updated) The latest version as of this writing
will prevent installation or prevent the malware from running if it is
already installed (currently 812 malware components), and it provides
information and fixit-links for a variety of parasites.
http://www.wilderssecurity.net/spywareguard.html (Monitors for attempts to
install malware) Both Very Highly Recommended.
Now, as to Sun Java. You can get the Sun Java J2SE RunTimes or SDK here:
http://java.sun.com/downloads/index.html (all versions - select using
the dropdown)
Sun also offers an automatic download and install of the 1.4 Java
plug-in here:
http://java.sun.com/getjava/download.html
Both Java VM's can co-exist on your machine quite nicely. Just select
which one you want to use in Tools|Internet Options|Advanced and restart
all IE browsers. Here, courtesy of Michel Gallant, MVP Security, is a
tiny utility which allows you to toggle and view status of your current
Java VM vendor associated with IE without restarting IE:
http://pages.istar.ca/~neutron/SelectIEJVM
A note from Mitch Gallant:
"One note about the JVM Selector utility:
If/when you install a new version of Sun J2SE, you need to manually
select to have Sun JVM as default JVM for IE (in install), or after
install via the JavaPlugin control panel. This generates the necessary win32
registry entries, which must be present for the utility to know about
JavaPlugin.
After that, the utility should work properly."
--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP
In
