1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

While using Iternet Explorer my pc locks up

Discussion in 'Security and Privacy' started by unstable, 2004/06/21.

Thread Status:
Not open for further replies.
  1. 2004/06/21
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    while using internet explorer my pc locks up with no error messages then when i hit ctrl+alt+del i see this i try to choose "end task" on <unknown> but it wont end until i do an "end task" on internet explorer , then i get this error.

    i've tried ad-aware , spybot , cwshredder , norton av

    here is my hijachthis log:


    Logfile of HijackThis v1.97.7
    Scan saved at 7:43:40 PM, on 6/21/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\SSDPSRV.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\WINDOWS\SYSTEM\HIDSERV.EXE
    C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\MY DOCUMENTS\HIJACKTHIS1977\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Hidserv] Hidserv.exe run
    O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
    O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38134.9525925926
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab




    thanks
     
    Last edited: 2004/06/21
  2. 2004/06/21
    markp62

    markp62 Geek Member Alumni

    Joined:
    2002/05/01
    Messages:
    4,012
    Likes Received:
    16
    I see nothing bad in the log, but have two obervations here.
    You seem to received the errors at the window update page, perhaps your ActiveX control for that needs to be reloaded, it is this one.
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.c...8134.9525925926
    Remove it and let it be reinstalled.

    The other thing is this,
    C:\WINDOWS\SYSTEM\SSDPSRV.EXE
    It is part of Universal Plug and Play, and on a system with a firewall, it holds a port open on your computer, and you really do not have a use for it.
    It has nothing to do with your hardware being Plug and Play, but for networking.
    http://grc.com/unpnp/unpnp.htm
    The above link has the tool to shut it down, your system will be better off without it.
     

  3. to hide this advert.

  4. 2004/06/21
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    thx for your quick response i'll try your ideas, about the win. update page i just went there because i know for a fact it does it there but it does it just about anywhere and it only seems to do it after i've multitasked a little doing different things like gaming , chatting and stuff then when i go to browse it locks up and gives me the errors mentioned above.


    also while searching through the registry i found this i thought maybe it would give someone an idea about whats going on...........i tried deleting that key but after i reboot it just comes right back :confused:


    thanks
     
  5. 2004/06/22
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS unstable. :)

    Never a good sign, in my opinion, when something <unknown> is running. Scan your PC with RAV and Housecall. Might also install Process Explorer and try to nail down what is helping it to run.
     
  6. 2004/06/22
    Welshjim

    Welshjim Inactive

    Joined:
    2002/01/07
    Messages:
    5,643
    Likes Received:
    0
    unstable--Did you update your antivirus and spyware detectors before you scanned with them?
    Have you cleaned out your cache lately?
    Several other, perhaps useless, comments. I have heard that Logitech mice install a program or two having nothing to do with running the mice. But I have no experience with that. If you have another mouse handy, you might see if uninstalling the Logitech mouse and installing the other one gets rid of the "unknown" and better yet, the error messages.
    I believe that CLSID you show in your last post {C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1} is related to your Search history (button on your toolbar). Sounds like an unlikely source of trouble.
    It is possible the "unknown" and error messages are not related.
    There are several entries for "unknown" in my Registry.
     
  7. 2004/06/22
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    yes i always update the adaware and spybot and my av before i run them ........rav and housecall did'nt detect anything either......also i just got an <unknown> error when i tried to close msn messenger

    Welshjim i have "unknown" in my registry too .......but do you have a <unknown> in your registry ?

    i'll try to uninstall my mouseware too ........i dont have an extra mouse so i'll try to install some standard windows drivers to test to see if thats it. i can't figure out why it only shows up after i've multitasked , then when i "end task" on which ever one locks up internet explorer or msn messenger its gone again, it kinda reminds me of the way "winmgt" acts if anyones ever had issues with it before........does anyone have "winmgt" in msconfig under startup ?


    i think windows washer cleans the cache i run it all the time. so it should be pretty clean
     
  8. 2004/06/23
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Download this zip. It is used to find hidden dlls used by unwanted parasites.

    http://tools.zerosrealm.com/pv.zip

    Unzip it to the desktop. It will not work if you run it from inside the zip. After unzipping open the pv folder. Double click on the runme.bat. A dos window will open. Select option 1 for explorer dlls by typing 1 and then pressing enter. Notepad will open with a log in it. Copy and paste the log into this post.

    Afer doing that, with an IE window open, run the PV tool again, this time choosing 2 and post it's log.
     
  9. 2004/06/23
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    there are too many characters it wont let me post it
    here is the explorer dll's from option 1:link


    here is internet explorer dll's from option 2:link




    thanks
     
  10. 2004/06/23
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    See nothing out of the ordinary there. Did you install Process explorer? It has the option to generate a log of all processes, and will identify which dlls are being used for each one.
     
  11. 2004/06/23
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    yea i installed it i had'nt quite got hang of it yet
     
  12. 2004/06/23
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    heres the log file i think your talking about


    Process PID CPU Description Company Name
    Idle 0x0 94 System Idle Process
    HIDSERV.EXE 0xFFFDE6D3 HID Audio Service Microsoft Corporation
    EM_EXEC.EXE 0xFFFCE1AF Logitech Events Handler Application Logitech Inc.
    STMGR.EXE 0xFFFC7BE3 Microsoft (R) PC State Manager Microsoft Corporation
    KERNEL32.DLL 0xFFEF0ED3 Win32 Kernel core component Microsoft Corporation
    MSGSRV32.EXE 0xFFFFC833 Windows 32-bit VxD Message Server Microsoft Corporation
    mmtask.tsk 0xFFFFA83F Multimedia background task support module Microsoft Corporation
    MPREXE.EXE 0xFFFFA203 WIN32 Network Interface Service Process Microsoft Corporation
    MSTASK.EXE 0xFFFE6917 Task Scheduler Engine Microsoft Corporation
    EXPLORER.EXE 0xFFFEC5B3 Windows Explorer Microsoft Corporation
    LOADQM.EXE 0xFFFE5063 Microsoft QMgr Microsoft Corporation
    TASKMON.EXE 0xFFFDC0DB Task Monitor Microsoft Corporation
    SYSTRAY.EXE 0xFFFD8577 System Tray Applet Microsoft Corporation
    WMIEXE.EXE 0xFFFC4163 WMI service exe housing Microsoft Corporation
    ROGER.EXE 0xFFFCC07B
    DDHELP.EXE 0xFFFCE71F Microsoft DirectX Helper Microsoft Corporation
    WKCALREM.EXE 0xFFFCA7C7 Microsoft® Works Calendar Reminder Service Microsoft® Corporation
    NAVAPW32.EXE 0xFFFC5AC7 Norton AntiVirus Auto-Protect Agent Symantec Corporation
    IEXPLORE.EXE 0xFFFB2A3F Internet Explorer Microsoft Corporation
    PROCEXP.EXE 0xFFFA8A93 5 Sysinternals Process Explorer Sysinternals
    NOTEPAD.EXE 0xFFFA873B Notepad Microsoft Corporation

    Process: IEXPLORE.EXE Pid: FFFB2A3F

    Name Description Company Name Version
    WSOCK32.DLL BSD Socket API for Windows Microsoft Corporation 4.90.0000.3000
    WS2HELP.DLL Windows Socket 2.0 Helper for Windows 98 Microsoft Corporation 4.90.0000.3000
    WS2_32.DLL Windows Socket 2.0 32-Bit DLL Microsoft Corporation 4.90.0000.3000
    WINSPOOL.DRV Win32 WINSPOOL core component Microsoft Corporation 4.90.0000.3000
    WINMM.DLL System APIs for Multimedia Microsoft Corporation 4.90.0000.3000
    WININET.DLL Internet Extensions for Win32 Microsoft Corporation 6.00.2800.1405
    VERSION.DLL Win32 VERSION core component Microsoft Corporation 4.90.0000.3000
    USER32.DLL Win32 USER32 core component Microsoft Corporation 4.90.0000.3000
    URLMON.DLL OLE32 Extensions for Win32 Microsoft Corporation 6.00.2800.1400
    TAPI32.DLL Microsoft® Windows(TM) Telephony API Client DLL Microsoft Corporation 4.90.0000.3000
    SVRAPI.DLL 32-bit common Server API library Microsoft Corporation 4.90.0000.3000
    SHLWAPI.DLL Shell Light-weight Utility Library Microsoft Corporation 6.00.2800.1400
    SHELL32.DLL Windows Shell Common Dll Microsoft Corporation 5.50.4134.0100
    SHDOCVW.DLL Shell Doc Object and Control Library Microsoft Corporation 6.00.2800.1400
    SHDOCLC.DLL Shell Doc Object and Control Library Microsoft Corporation 6.00.2800.1106
    SECUR32.DLL Microsoft Win32 Security Services (Export Version) Microsoft Corporation 4.90.0000.3000
    SDHelper.dll Bad download blocker Safer Networking Limited 1.03.0000.0012
    RPCRT4.DLL Remote Procedure Call DLL Microsoft Corporation 4.71.3335.0000
    RNR20.DLL Windows Socket2 NameSpace DLL Microsoft Corporation 4.90.0000.3000
    RASAPI32.DLL Dial-Up Networking Dynamic Linked Library Microsoft Corporation 4.90.0000.3000
    OLEPRO32.DLL Microsoft Corporation 5.00.4515.0000
    OLEAUT32.DLL Microsoft Corporation 2.40.4515.0000
    OLE32.DLL Microsoft OLE for Windows and Windows NT Microsoft Corporation 4.71.3328.0000
    NTDLL.DLL Win32 NTDLL core component Microsoft Corporation 4.90.0000.3000
    NETBIOS.DLL
    NETAPI32.DLL 32-bit network API DLL Microsoft Corporation 4.90.0000.3000
    MSWSOCK.DLL Microsoft WinSock Extension APIs Microsoft Corporation 4.90.0000.3000
    MSVCRT.DLL Microsoft (R) C Runtime Library Microsoft Corporation 6.01.8637.0000
    Msvcp60.dll Microsoft (R) C++ Runtime Library Microsoft Corporation 6.00.8168.0000
    MSPWL32.DLL Password list management library Microsoft Corporation 4.90.0000.3000
    MSNET32.DLL Microsoft 32-bit Network API Library Microsoft Corporation 4.90.0000.3000
    MSLS31.DLL Microsoft Line Services library file Microsoft Corporation 3.10.0349.0000
    MSHTMLED.DLL Microsoft (R) HTML Editing Component Microsoft Corporation 6.00.2800.1106
    MSHTML.DLL Microsoft (R) HTML Viewer Microsoft Corporation 6.00.2800.1400
    MSASN1.DLL Microsoft ASN.1 Encoder/Decoder Microsoft Corporation 4.04.0000.3420
    MSAFD.DLL Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 4.90.0000.3000
    MPR.DLL WIN32 Network Interface DLL Microsoft Corporation 4.90.0000.3000
    MLANG.DLL Multi Language Support DLL Microsoft Corporation 6.00.2800.1106
    LgWndHk.dll Logitech Call Window Hook Library Logitech Inc. 9.79.0025.0001
    LGMSGHK.DLL Logitech Message Hook Library Logitech Inc. 1.01.0000.0000
    LgKbdhk.dll Logitech Keyboard Hook Library Logitech Inc. 9.79.0025.0001
    KERNEL32.DLL Win32 Kernel core component Microsoft Corporation 4.90.0000.3000
    JSCRIPT.DLL Microsoft (r) JScript Microsoft Corporation 5.06.0000.8513
    IPHLPAPI.DLL IP Helper API Microsoft Corporation 4.90.3000.0000
    IMM32.DLL Win32 IMM32 core component Microsoft Corporation 4.90.0000.3000
    IEXPLORE.EXE Internet Explorer Microsoft Corporation 6.00.2800.1106
    IEPEERS.DLL Internet Explorer Peer Objects Microsoft Corporation 6.00.2800.1106
    ICMP.DLL ICMP DLL Microsoft Corporation 5.00.1454.0001
    GDI32.DLL Win32 GDI core component Microsoft Corporation 4.90.0000.3000
    DXTRANS.DLL DirectX Media -- DirectX Transform Core Microsoft Corporation 6.03.2800.1106
    DXTMSFT.DLL DirectX Media -- Image DirectX Transforms Microsoft Corporation 6.03.2800.1106
    DHCPCSVC.DLL
    DDRAWEX.DLL Microsoft DirectDrawEx Microsoft Corporation 4.87.0000.0700
    DDRAW.DLL Microsoft DirectDraw Microsoft Corporation 4.09.0000.0900
    CRYPT32.DLL Crypto API32 Microsoft Corporation 5.131.2133.0006
    COMCTL32.DLL Common Controls Library Microsoft Corporation 5.81.4916.0400
    BROWSEUI.DLL Shell Browser UI Library Microsoft Corporation 6.00.2800.1400
    BROWSELC.DLL Shell Browser UI Library Microsoft Corporation 6.00.2800.1106
    ATL.DLL ATL Module for Windows (ANSI) Microsoft Corporation 3.00.8449.0000
    ADVAPI32.DLL Win32 ADVAPI32 core component Microsoft Corporation 4.90.0000.3000
     
  13. 2004/06/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Here's an odd process you might want to track down.
    ROGER.EXE 0xFFFCC07B
    Normally associated with the game Roger Wilco.

    I see nothing else out of the ordinary.
     
  14. 2004/06/24
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    sorry i forgot to turn off roger wilco :eek: , its a voice over net chat program.

    well i appreciate you guys helping me out but i'm stumped , i might get it out with the next formating and reinstalling lol :D
     
  15. 2004/06/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Ok :) Just out of curiosity, was the <unknown> running when you created the Process Explorer log? If you click view>lower pane>dlls, when you highlight a process it will show you which dlls are being used in the lower pane. That may help you to track down the <unknown>.
     
  16. 2004/06/24
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    nah when it shows up my desktop locks up .........the only thing i can use is the "close program" when i hit ctrl+alt+del it even hangs for a few seconds. i can't click anything at all nothing works even the start menu .....i can't even right click anything in the system tray.........then when i close internet explorer <unknown> vanishes.
     
  17. 2004/06/24
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Try using RegSeeker to search the registry for <unknown>. Maybe you'll come up with something that will provide a clue as to what put it there. Since it shows in task manager as that, might do a file search for it too. RegSeeker can do that too.
     
  18. 2004/06/24
    Welshjim

    Welshjim Inactive

    Joined:
    2002/01/07
    Messages:
    5,643
    Likes Received:
    0
    unstable--And you can always delete the <unknown> value in Registry (after having backed it up, of course) to see if that helps.
    P.S. Were you saying that <unknown> disappears from the Registry when you close IE?
     
  19. 2004/06/26
    unstable

    unstable Inactive Thread Starter

    Joined:
    2004/06/21
    Messages:
    10
    Likes Received:
    0
    no it's not in the registry , the only thing i found in the registry was the search history from when i was searching for it under search for files and folders , i never could find it though...............there are some "unknown" 's in the registry though but they're always there............ i'll try that reg program shortly thx


    P.s. it only shows up running when i press control + alt + delete after my pc locks up
     
    Last edited: 2004/06/26
  20. 2004/06/26
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Something else you might try. Open Process Explorer and drag the window size down to the smallest you can while still able to see the processes, CPU usage and in lower pane dll's in use. Then your IE window to fill the rest of the page and surf long enough, or do something you know will recreate the problem, and see if it shows up. If you can click the process it might also show what dll's are being used for the process.
     
  21. 2004/06/27
    Welshjim

    Welshjim Inactive

    Joined:
    2002/01/07
    Messages:
    5,643
    Likes Received:
    0
    unstable--Don't know if you have System Information on your PC. On mine (Win98) I can Start|Run|type msinfo32|OK. In left hand panel click the + next to Software Environment, then click Running Tasks. Is <unknown> there or some other program that has not shown up from the other scans?
     
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.