TechSpot

after removing spy falcon, one of my programs crashes

By dtes816
Feb 25, 2006
Topic Status:
Not open for further replies.
  1. Earlier this week, I ended up getting hit with spy falcon (still don't know how). Visited several different sites, and successfully removed it. Immediately after removal my browser was still being hijacked and being brought to www.securityprecaution.net (part of the spy falcon program I think).

    I then found a posting on this site from january 31st, detailing how to resolve this exact issue, and followed the instructions contained in that thread (turn off system restore, Vundu removal, hijack-this, etc.).

    Anyway, the instructions seemed to be working perfectly until I tried to play one of the games installed on my system (in this case Airfix Dogfighter). Prior to all this, this game was working perfectly, it now crashes every time that I run it anytime between 30 seconds to 3 minutes after the program starts.

    I have tried unistalling and reinstalling the game, checked the settings, and updated the patches for the game and the computer. It still crashes every time.

    Any Ideas? Any help would be appreciated.

    Thank you.
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Hello and welcome to Techspot.

    I don`t know why your game is crashing. However, if you would like to post a HJT log. I`ll take a look at it for you. There may still be something nasty on your computer.

    See HERE for instructions on how to post your HJT log.

    Regards Howard :wave: :wave:
  3. dtes816

    dtes816 TS Rookie Topic Starter

    Thank you for any help you may be able to give.

    I have done some further checking on my own and discovered that the game is crashing because it is automatically minimizing at certain time intervals ( 1 minute and 47 seconds or multiples thereof ) apparently never seeming to exceed 8 minutes. I have also noticed this pattern in other things, such as if I am typing in IE ( such as this post ) the cursor disappears until I click my mouse.

    I am attaching the HJT file, and hope that this new information helps.

    Thank you again.
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

  5. dtes816

    dtes816 TS Rookie Topic Starter

    I finally managed to run all the programs listed in the two links except Spyware Eliminator. Every time I try to run it I recieve an error message that states that
    "Problems with this web page might prevent it from being displayed properly or functioning properly. In the future you can display this message by double clicking the warning icon in the status bar."

    details are:

    Line: 42
    Char: 1
    Error: Object Expected
    Code: 0
    URL: http://www.aluriasoftware.com/index.php?menu=litescan&id=e090850e20daec8d9d9364c99e2769ac

    Attached is the Latest HJT log.

    Thank you again
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Boot into safe mode. See how here. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how here. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by pressing the ctrl/alt/delete keys together.

    Click on the processes tab, end process for(if there).

    p2pnetworking.exe
    n?tdde.exe

    close task manager.

    Click start/run and type services.msc into the run box and press the enter key.
    When the window appears, maximise it, and locate this service. [p2pnetworking] p2pnetworking.exe
    Double click on it, and stop the service if it`s running. Set the startup type to disabled. click apply/ok.


    Run HJT with no other programmes open, and have HJT fix the following, by placing a tick in the little box nect to(if there).

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://dslstart.verizon.net/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

    R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
    R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
    R3 - URLSearchHook: (no name) - {19226E0C-A1B7-DF13-96A0-F48ADDA3FDC3} - C:\WINDOWS\system32\levfrkpq.dll (file missing)
    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

    O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll (file missing)

    O4 - HKLM\..\Run: [p2pnetworking] p2pnetworking.exe
    O4 - HKLM\..\RunServices: [p2pnetworking] p2pnetworking.exe
    O4 - HKCU\..\Run: [Lirqr] C:\WINDOWS\system32\??pPatch\n?tdde.exe

    Fix all 016 DPF entries.

    O20 - Winlogon Notify: winier32 - winier32.dll (file missing)

    click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files(if there).

    C:\WINDOWS\system32\??pPatch\n?tdde.exe
    p2pnetworking.exe

    Reboot into normal mode and turn system restore back on.

    Regards Howard :)
  7. dtes816

    dtes816 TS Rookie Topic Starter

    Browser problem occurred after my last posting. After shutting down and restarting the computer I could not access any site that required a password ( the site would not load on the browser ) and some of my system settings had changed ( appearance went from windows xp style to windows classic style ). I went back to the previous spyware adware programs and restored all the files. I am going to have to need a day or two to start over.

    Will update to let you know what is happening soon.
  8. cwskiller

    cwskiller TS Rookie

Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.