IE no longer wants to launch

By ladybird1881
Jul 1, 2007
Topic Status:
Not open for further replies.
  1. There's not only a problem with my compueter, but I might have hammered my mother's as well. First mine.....
    I think it occurs when I open up IE I get the following message:
    "Visual C++ Runtime Library
    Program: C:\WINDOWS|Explorer.EXE
    A buffer overrun has been detected which has corrupted the program's internal state. the program cannot safely continue execution and must now be terminated"

    If I then click OK it shuts down everything and all I am left with is my pretty desktop wall paper. If I don't I can go about my business but get constant pop-ups. I've run both Ad-Aware and Spybot and removed whatever they told me to. I've also been using Firefox, especially to use this site for much needed help. I found a thread about this "buffer overrun" message and dl'd HJT and a few other sites that thread suggested but wanted to get feedback from any, especiall RealBlackStuff who posted the info I've been following, to ensure I am taking the right steps......
    Please help!!!!!
    I will post about my mother's computer at a later time.
    :( :( :( :(
  2. kitty500cat

    kitty500cat Newcomer, in training Posts: 2,407   +6

    Hello and welcome to TechSpot.

    Very important: Before deciding whether to clean or reformat your system, read this thread and decide what you want to do.

    If you decide to clean your system after reading the above thread, do the following.

    Go and read the Viruses/spyware/malware, preliminary removal instructions. Follow all the instructions exactly.

    Post fresh HJT, ComboFix, and AVG Antispyware logs as attachments into this thread, only after doing the above. Also post here the results of the AVG Antirootkit scan.

    Regards :)

    This thread is for the use of ladybird1881 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
  3. ladybird1881

    ladybird1881 Newcomer, in training Topic Starter

    Combofix and HJT log

    I've run all instructions up to 12 and I will continue in safe mode with the rest of them. Here are my Combofix and HJT logs up to this point.
  4. momok

    momok Newcomer, in training Posts: 2,272

    Hi ladybird1881 and welcome to techspot. =)

    The Combofix file that you posted is the wrong one. It should be ComboFix.txt, see if you can find it.

    I do see something nasty in your logs; complete the instructions then post your logs together and I'll give you the instructions for cleaning at one go. Do post your AVG antispyware log in your next reply, as well as the results of the AVG anti-root kit scan.

    Regards,
    Your friendly momok =)

    This thread is for the use of ladybird1881 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. ladybird1881

    ladybird1881 Newcomer, in training Topic Starter

    ComboFix.txt. is this the right one?

    Is this the right one?
  6. kitty500cat

    kitty500cat Newcomer, in training Posts: 2,407   +6

    That's the correct ComboFix log, but please follow momok's instructions and post the AVG Anti-Spyware log and the AVG Anti-Rootkit results.

    Regards :)

    This thread is for the use of ladybird1881 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
  7. ladybird1881

    ladybird1881 Newcomer, in training Topic Starter

    logs

    the combofix.txt log can be found in my other thread called ComboFix and HJT log...thanks
  8. ladybird1881

    ladybird1881 Newcomer, in training Topic Starter

    I posted everything in my other post....Please Help :eek:) My AntiRootKit came up clean......
  9. kitty500cat

    kitty500cat Newcomer, in training Posts: 2,407   +6

    Sorry, I think you forgot to attach the files... ;)

    Edit: never mind, I just saw your other thread.

    Please post in that one only from now on.

    Regards :)
  10. almcneil

    almcneil TechSpot Guru Posts: 1,554

    Have you tried an XP repair installation?
  11. kitty500cat

    kitty500cat Newcomer, in training Posts: 2,407   +6

    Please copy and paste these instructions into a Notepad file and save it to your desktop. Then close your web browser and follow these instructions from Notepad.

    Step 1:

    Go into Control Panel->Add/Remove Programs and uninstall anything having to do with the following:

    AWS
    Seekerbar
    PartyPoker
    WeatherBug

    Step 2:

    Run HJT with no other programs open. Do a system scan.

    Place a check in the box next to the following entries (if there):

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = [http]www.seekerbar.com/ie.aspx?tb_id=50154

    O2 - BHO: (no name) - {586C8288-10E3-489C-AEEE-B1B60C53568C} - \

    O2 - BHO: (no name) - {8ED08520-B05D-46EE-AE4F-3049A7FD1A07} - \

    O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

    O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE 1

    O4 - HKCU\..\Run: [KovpRVj2V] qapl400.exe

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)

    Click the Fix Checked button. Close HJT.

    Step 3:

    Search your system for the following file and delete all instances found:

    ALCXMNTR.EXE
    qapl400.exe


    Step 4:

    Download the attached "Combofix-Do.txt" ( from my attachment) and save it to the same folder as Combofix.
    Drag the Combofix-Do.txt over on to Combofix.exe and release.

    This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job.

    Step 5:

    Navigate to virusscan.jotti.org.

    Enter the following into the text box at the top of the page.

    C:\WINDOWS\system32\msxml3a.dll

    Click the Submit button. Make note of the results.

    Then do the same with C:\Program Files\TTC.dll

    Please post both sets of results here.

    Step 6:

    All of the items in your AVG Anti-Spyware log say No Action taken. That's because you haven't set it to deal correctly with the results. You need to run AVG Anti-Spyware again and set it to apply the recommended action to all results. Pictorial instructions here.

    Step 7:

    Post your fresh AVG Anti-Spyware log after configuring it according to Step 6, as well as fresh HJT and ComboFix logs, into this thread. Also post here the results of the Jotti virus scan.

    Regards :)

    This thread is for the use of ladybird1881 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
     
  12. ladybird1881

    ladybird1881 Newcomer, in training Topic Starter

    ok here goes

    How's this??
    The first virusscan C:\WINDOWS\system32\msxml3a.dll
    turned up "FOUND NOTHING" on all sites.
    The second virusscan.jotti search (C:\Program Files\TTC.dll)
    told me "The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file."
    There are two ComboFix logs attached, ComboFix 2 was created first (??). I think it was created yesterday and modified today (is this by your ComboFix-Do txt?) and ComboFix is the most recent scan, just about 10 minutes ago.
    I hope this is right......
  13. kitty500cat

    kitty500cat Newcomer, in training Posts: 2,407   +6

    All looks good, except for two entries in your ComboFix log.

    Download the attached "Combofix-Do.txt" ( from my attachment) and save it to the same folder as Combofix.
    Drag the Combofix-Do.txt over on to Combofix.exe and release.

    This will ask Combofix to execute the instructions within my file. Let Combofix run normally and do its job.

    Regards :)

    This thread is for the use of ladybird1881 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our Security and the Web forum.
  14. ladybird1881

    ladybird1881 Newcomer, in training Topic Starter

    Coolio

    Am I done now...this is my latest ComboFix log
  15. kitty500cat

    kitty500cat Newcomer, in training Posts: 2,407   +6

    Looks good! Can you post just one more HJT log yet?

    Regards :)
  16. momok

    momok Newcomer, in training Posts: 2,272

    Posts merged. I'll let kitty take over here from now; seems like your almost done with the cleaning.

    Regards,
    Your friendly momok =)

    This thread is for the use of ladybird1881 only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.