AumHa Forums

Hello

Had some problems with IE8 this evening - I've always had great help before, and I'm hoping some of you kind souls will be able to help me again.

All of a sudden, I can't open Internet Explorer 8. I'm running XP. When I try to open it, I get the egg-timer for a few seconds, then nothing. The same thing happens from the shortcuts, from the start menu, and when i try to open in using run.

I've searched for solutions (Firefox still seems to work ok) - and have tried the following. Opening it without add-ons doesn't work. Resetting IE8 in internet options didn't work. Starting up in safe mode with networking DID work for a few minutes, but then stopped working. System restore didn't work... and finally, uninstalling IE8 and then reinstalling it didn't work.

Does anyone here have any idea what could have happened here? It was working fine this morning; my wife used it this afternoon and said it was all working ok; I got in from work and it wouldn't open.

Oh, I should probably also add that I've rebooted more times than I care to remember; and Malwarebytes and Avira aren't showing any problems.

Is there anything like a Hijack This file that I can post to find out if anything untoward is going on? I'm not really sure of the next steps, not having had a problem like this before.

Any help, as always, much appreciated!

Thank you
M

Are you running WinXP SP3 and is the computer fully-patched at Windows Update?

Has a Norton or McAfee application ever been installed on the computer?

Did a Norton or McAfee free-trial come preinstalled on the computer when you bought it? (Doesn't matter if you never used or Activated it.)

Thanks. Very strangely, when I tried IE today, it worked fine with no problems. I did install some updates late yesterday evening, so whether that has helped I don't know.

However, I am running Winpatrol, and since yesterday I have been getting the following File Type Change Alert:

The program currently associated with this file type is:
Run a DLL as an App - Microsoft Corporation rundll32.exe ieframe.dll,OpenURL %I

A change was made to use the following program for this file type.
Run a DLL as an App - Microsoft Corporation
C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ieframe.dll,OpenURL %I

I've got a feeling that one of the changes I tried last night to get IE to work is causing this - it was a suggestion I'd found on another site, by searching for other people that had suddenly had IE stop working on them.

Do you know how I fix this? I keep saying "no" to it, but it comes back every 10 minutes or so. Or should I just say "yes"?

In answer to your original questions,

Are you running WinXP SP3 and is the computer fully-patched at Windows Update? Yes I think so

Has a Norton or McAfee application ever been installed on the computer? Yes McAfee preinstalled and was run for the trial one month period

Did a Norton or McAfee free-trial come preinstalled on the computer when you bought it? (Doesn't matter if you never used or Activated it.) Yes and was activated and I think it's still on there, as is still in start menu list of programs.

To complicate things further, I've just run Avira and it's detected this:

TR/Horse.PNF

although it isn't giving me any more information about that at the moment, as it's still running. When I click on where it says "TR/Horse.pnf" it says that "no description was found matching your research criteria".

Maybe it will give me some more info at the end of the scan.

OK, the scan has finished, and very strangely again, it's telling me that TR/Horse.PNF is Combo-Fix.exe - which is something I downloaded previously, after advice on here!!

I've moved it to Quarantine, as suggested - I'm assuming I can always move it back or download it again if needed?

Below is the complete log of the Avira scan - sorry if this is unnecessary, I'm just trying to provide everything that might help with the problems:


Avira AntiVir Personal

Report file date: 21 July 2010 07:33



Scanning for 2394587 virus strains and unwanted programs.



The program is running as an unrestricted full version.

Online services are available:



Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : BRAVADO



Version information:

BUILD.DAT : 10.0.0.567 32097 Bytes 4/19/2010 15:07:00

AVSCAN.EXE : 10.0.3.0 433832 Bytes 4/20/2010 08:11:04

AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/20/2010 08:11:04

LUKE.DLL : 10.0.2.3 104296 Bytes 3/7/2010 18:33:04

LUKERES.DLL : 10.0.0.1 12648 Bytes 2/10/2010 23:40:49

VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 17:06:56

VBASE001.VDF : 7.10.1.0 1372672 Bytes 11/19/2009 17:11:02

VBASE002.VDF : 7.10.3.1 3143680 Bytes 1/20/2010 18:15:54

VBASE003.VDF : 7.10.3.75 996864 Bytes 1/26/2010 19:47:05

VBASE004.VDF : 7.10.4.203 1579008 Bytes 3/5/2010 19:36:58

VBASE005.VDF : 7.10.6.82 2494464 Bytes 4/15/2010 08:07:24

VBASE006.VDF : 7.10.7.218 2294784 Bytes 6/2/2010 08:01:24

VBASE007.VDF : 7.10.7.219 2048 Bytes 6/2/2010 08:01:24

VBASE008.VDF : 7.10.7.220 2048 Bytes 6/2/2010 08:01:24

VBASE009.VDF : 7.10.7.221 2048 Bytes 6/2/2010 08:01:25

VBASE010.VDF : 7.10.7.222 2048 Bytes 6/2/2010 08:01:26

VBASE011.VDF : 7.10.7.223 2048 Bytes 6/2/2010 08:01:26

VBASE012.VDF : 7.10.7.224 2048 Bytes 6/2/2010 08:01:27

VBASE013.VDF : 7.10.8.37 270336 Bytes 6/10/2010 06:46:04

VBASE014.VDF : 7.10.8.69 138752 Bytes 6/14/2010 06:18:34

VBASE015.VDF : 7.10.8.102 130560 Bytes 6/16/2010 05:45:26

VBASE016.VDF : 7.10.8.135 152064 Bytes 6/21/2010 05:58:20

VBASE017.VDF : 7.10.8.163 432128 Bytes 6/23/2010 06:03:07

VBASE018.VDF : 7.10.8.194 133632 Bytes 6/27/2010 05:50:58

VBASE019.VDF : 7.10.8.220 134656 Bytes 6/29/2010 06:07:30

VBASE020.VDF : 7.10.8.252 171520 Bytes 7/4/2010 06:30:19

VBASE021.VDF : 7.10.9.19 131072 Bytes 7/6/2010 05:55:10

VBASE022.VDF : 7.10.9.36 297472 Bytes 7/7/2010 05:55:11

VBASE023.VDF : 7.10.9.60 150016 Bytes 7/11/2010 07:39:02

VBASE024.VDF : 7.10.9.79 113152 Bytes 7/13/2010 16:06:39

VBASE025.VDF : 7.10.9.99 158720 Bytes 7/16/2010 16:06:40

VBASE026.VDF : 7.10.9.133 630784 Bytes 7/20/2010 06:32:30

VBASE027.VDF : 7.10.9.134 2048 Bytes 7/20/2010 06:32:30

VBASE028.VDF : 7.10.9.135 2048 Bytes 7/20/2010 06:32:30

VBASE029.VDF : 7.10.9.136 2048 Bytes 7/20/2010 06:32:30

VBASE030.VDF : 7.10.9.137 2048 Bytes 7/20/2010 06:32:30

VBASE031.VDF : 7.10.9.138 2048 Bytes 7/20/2010 06:32:30

Engineversion : 8.2.4.22

AEVDF.DLL : 8.1.2.0 106868 Bytes 4/24/2010 06:28:49

AESCRIPT.DLL : 8.1.3.41 1364346 Bytes 7/21/2010 06:32:36

AESCN.DLL : 8.1.6.1 127347 Bytes 5/14/2010 05:45:56

AESBX.DLL : 8.1.3.1 254324 Bytes 4/24/2010 06:28:49

AERDL.DLL : 8.1.8.2 614772 Bytes 7/21/2010 06:32:35

AEPACK.DLL : 8.2.3.2 471414 Bytes 7/21/2010 06:32:34

AEOFFICE.DLL : 8.1.1.7 201081 Bytes 7/21/2010 06:32:34

AEHEUR.DLL : 8.1.2.6 2793846 Bytes 7/21/2010 06:32:33

AEHELP.DLL : 8.1.13.2 242039 Bytes 7/21/2010 06:32:31

AEGEN.DLL : 8.1.3.15 385396 Bytes 7/21/2010 06:32:31

AEEMU.DLL : 8.1.2.0 393588 Bytes 4/24/2010 06:28:48

AECORE.DLL : 8.1.16.2 192887 Bytes 7/21/2010 06:32:31

AEBB.DLL : 8.1.1.0 53618 Bytes 4/24/2010 06:28:47

AVWINLL.DLL : 10.0.0.0 19304 Bytes 1/14/2010 12:03:38

AVPREF.DLL : 10.0.0.0 44904 Bytes 1/14/2010 12:03:35

AVREP.DLL : 10.0.0.8 62209 Bytes 2/18/2010 16:47:40

AVREG.DLL : 10.0.3.0 53096 Bytes 4/20/2010 08:11:04

AVSCPLR.DLL : 10.0.3.0 83816 Bytes 4/20/2010 08:11:04

AVARKT.DLL : 10.0.0.14 227176 Bytes 4/20/2010 08:11:04

AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 1/26/2010 09:53:30

SQLITE3.DLL : 3.6.19.0 355688 Bytes 1/28/2010 12:57:58

AVSMTP.DLL : 10.0.0.17 63848 Bytes 3/16/2010 15:38:56

NETNT.DLL : 10.0.0.0 11624 Bytes 2/19/2010 14:41:00

RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 1/28/2010 13:10:20

RCTEXT.DLL : 10.0.53.0 97128 Bytes 4/20/2010 08:11:04



Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:, G:,

Process scan........................: on

Extended process scan...............: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium



Start of the scan: 21 July 2010 07:33



Starting search for hidden objects.

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\parseautoexec

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Print\Printers\HP Photosmart C4700 series\changeid

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NtmsSvc\Config\Standalone\drivelist

[NOTE] The registry entry is invisible.



The scan of running processes will be started

Scan process 'msdtc.exe' - '51' Module(s) have been scanned

Scan process 'dllhost.exe' - '69' Module(s) have been scanned

Scan process 'dllhost.exe' - '56' Module(s) have been scanned

Scan process 'vssvc.exe' - '56' Module(s) have been scanned

Scan process 'avscan.exe' - '81' Module(s) have been scanned

Scan process 'avcenter.exe' - '74' Module(s) have been scanned

Scan process 'AAWTray.exe' - '34' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '52' Module(s) have been scanned

Scan process 'unsecapp.exe' - '46' Module(s) have been scanned

Scan process 'alg.exe' - '41' Module(s) have been scanned

Scan process 'unsecapp.exe' - '46' Module(s) have been scanned

Scan process 'cli.exe' - '119' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '55' Module(s) have been scanned

Scan process 'svchost.exe' - '46' Module(s) have been scanned

Scan process 'sprtsvc.exe' - '65' Module(s) have been scanned

Scan process 'winpatrol.exe' - '55' Module(s) have been scanned

Scan process 'avgnt.exe' - '55' Module(s) have been scanned

Scan process 'svchost.exe' - '38' Module(s) have been scanned

Scan process 'RTHDCPL.EXE' - '45' Module(s) have been scanned

Scan process 'CLI.EXE' - '180' Module(s) have been scanned

Scan process 'MSASCui.exe' - '43' Module(s) have been scanned

Scan process 'svchost.exe' - '38' Module(s) have been scanned

Scan process 'LSSrvc.exe' - '28' Module(s) have been scanned

Scan process 'jqs.exe' - '41' Module(s) have been scanned

Scan process 'avshadow.exe' - '26' Module(s) have been scanned

Scan process 'svchost.exe' - '84' Module(s) have been scanned

Scan process 'svchost.exe' - '47' Module(s) have been scanned

Scan process 'FlipShareService.exe' - '48' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '32' Module(s) have been scanned

Scan process 'avguard.exe' - '53' Module(s) have been scanned

Scan process 'svchost.exe' - '55' Module(s) have been scanned

Scan process 'sched.exe' - '46' Module(s) have been scanned

Scan process 'spoolsv.exe' - '72' Module(s) have been scanned

Scan process 'AAWService.exe' - '80' Module(s) have been scanned

Scan process 'Explorer.EXE' - '128' Module(s) have been scanned

Scan process 'svchost.exe' - '48' Module(s) have been scanned

Scan process 'svchost.exe' - '43' Module(s) have been scanned

Scan process 'svchost.exe' - '37' Module(s) have been scanned

Scan process 'svchost.exe' - '175' Module(s) have been scanned

Scan process 'MsMpEng.exe' - '46' Module(s) have been scanned

Scan process 'svchost.exe' - '49' Module(s) have been scanned

Scan process 'svchost.exe' - '55' Module(s) have been scanned

Scan process 'Ati2evxx.exe' - '34' Module(s) have been scanned

Scan process 'lsass.exe' - '65' Module(s) have been scanned

Scan process 'services.exe' - '38' Module(s) have been scanned

Scan process 'winlogon.exe' - '71' Module(s) have been scanned

Scan process 'csrss.exe' - '14' Module(s) have been scanned

Scan process 'smss.exe' - '2' Module(s) have been scanned



Starting master boot sector scan:

Master boot sector HD0

[INFO] No virus was found!

Master boot sector HD1

[INFO] No virus was found!



Start scanning boot sectors:

Boot sector 'C:\'

[INFO] No virus was found!

Boot sector 'G:\'

[INFO] No virus was found!



Starting to scan executable files (registry).

The registry was scanned ( '1913' files ).





Starting the file scan:



Begin scan in 'C:\'

C:\Documents and Settings\Mat\Desktop\spyware\Combo-Fix.exe

[DETECTION] Is the TR/Horse.PNF Trojan

Begin scan in 'G:\' <FREECOM HDD>



Beginning disinfection:

C:\Documents and Settings\Mat\Desktop\spyware\Combo-Fix.exe

[DETECTION] Is the TR/Horse.PNF Trojan

[NOTE] The file was moved to the quarantine directory under the name '4e4d0939.qua'.





End of the scan: 21 July 2010 09:18

Used time: 1:42:31 Hour(s)



The scan has been done completely.



15971 Scanned directories

494304 Files were scanned

1 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

1 Files were moved to quarantine

0 Files were renamed

0 Files cannot be scanned

494303 Files not concerned

11665 Archives were scanned

0 Warnings

1 Notes

801274 Objects were scanned with rootkit scan

3 Hidden objects were found

While it's most likely a False/Positive, please Delete Combofix from Quarantine, don't Restore it. Combofix isn't something to hang onto & use every now and then: It's frequently updated and it's best only to use it with guidance from an expert in such matters.

The WinPatrol alert is worrisome.

Not good at all! You should have uninstalled the McAfee free-trial and run a specific removal tool BEFORE you installed Avira AntiVir. Let's take care of that now:

1. Download the McAfee Consumer Products Removal Tool, saving it to your desktop: http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

2. Close all open applications (i.e., anything with an icon on the taskbar).

3. Uninstall the McAfee application via Add/Remove Programs & reboot.

4. Double-click on the file you saved in #1 above (MCPR.EXE) to run the utility. Don't TOUCH your keyboard until the run completes, then reboot again. You can now delete MCPR.EXE to the Recycle Bin.

5. Open IE8 (only) to http://support.microsoft.com/kb/923737 & run the Fix It to reset IE8 Advanced settings then reboot yet again.

6. Open IE8 (only) to http://windowsupdate.microsoft.com | Select CUSTOM and scan | Install any Critical Security Updates offered (e.g., KB982381). If a Root Certificates update is listed in the Optional Software updates category on the left-hand side of the scan results window, install it to take full advantage of IE8's enhanced security. Follow all prompts.

Do NOT install any other Optional Software or Hardware updates.

7. Manually & repeatedly update Avira AntiVir until you get a "no more updates" prompt then run another full system scan.

8. Test, then reply to this thread with an update on your situation.

Thank you. Have done everything you've suggested and am currently mid-Avira scan.

The reason i think I'm getting the Winpatrol alert is because I followed some steps on another "expert" page as to what to do when IE wouldn't open.

One of the things it suggested you try was to type: regsvr32 IEPROXY.DLL in the Run box.

Then, another "expert" had suggested that if that didn't work, you should type the following:

regsvr32.exe "c:\program files\internet explorer\ieproxy.dll"

I did this, and I'm pretty sure that that is why the Winpatrol alert is coming up. Would that be right?

I know it was pretty stupid to run that, but someone else had replied below that it had worked for them.

Is it possible to reverse that?

I suspect that re-registering IEPROXY.DLL has nothing to do with your problem & there's nothing to reverse.

OK thanks, good to know I didn't cause the problem, then!

The scan has finished and has again found one trojan - again called TR/Horse.PNF - but here's the info this time:

Begin scan in 'C:\'
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP431\A0072375.exe
[DETECTION] Is the TR/Horse.PNF Trojan
Begin scan in 'G:\' <FREECOM HDD>

Beginning disinfection:
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP431\A0072375.exe
[DETECTION] Is the TR/Horse.PNF Trojan
[NOTE] The file was moved to the quarantine directory under the name '4fc1eccb.qua'.


Also, I'm still getting the Winpatrol alert coming up - and each time I'm clicking "no" to not accept the change.

The scan results are no big deal. (I could have you "flush" System Restore but that'd leave you with one Restore Point and we don't want that yet: Better to have an iffy Restore Point than none at all.)

That being said, I think it'd be appropriate to run a thorough check for malware at this point. Start here: http://aumha.net/viewtopic.php?t=4075

After taking care of all requested Preliminaries in the above thread, please begin a new thread in Malware Removal forum and post your three (3) logs.

After you begin the new thread, I'll lock this one, at least temporarily.

Thank you, I will do.

cheers,
M