Firefox will not open

[Pazuzu]

I cannot get Firefox to open and now I have a box - like a Spyware S&D Tea timer registry change warning, but with no text displayed. It will not close. I am having problems un-installing Realplayer & noted that Firefox worked when I removed Realplayer temporarily.
I have run Spyware S&D, AdAware, F-Secure Black light with no alerts.
When I ran A-Squared it found a Heuristic.Dialer.RAS in Dell Support center\HWDiag\bin\pcmodem.p5x
I selected quarantine, but now cannot see it in the quarantine.

I have read the "Is your system infected?" guide. Do I need to follow the instructions & post a HiJack this? I suspect that once I have rid of realplayer these problems will be resolved.

 

[kimsland]

What happens when you disable tea timer
Can you then get into Firefox?

 

[Pazuzu]

No, I disabled Reident Tea timer by unchecking box & I cannot launch Firefox.

I can not shut down from windows Start & have to use button on PC.

I have not yet been able to remove realplayer files in C\ documents and settings\ myname\application data\real\realplayer

 

[kritius]

Unistall spybot and then follow all the steps HERE. You will reinstall Spybot when you get to step 7.

 

[Pazuzu]

Unistall spybot and then follow all the steps HERE. You will reinstall Spybot when you get to step 7.

Problem using tool 1 in Step 10. SmitfraudFix.exe cannot be found by Windows when I reboot in Safe Mode.

I will try tools 2 & 3 . The first part - tool one - has a file folder on the desktop but no sign of SmitFraud.exe anywhere I have looked.

Just re - read & see I should have uninstalled Spybot -

 

[kritius]

Try doing a scan with SmitFraud in normal mode and then if it picks up anything see if you can find it in safe mode, if that doesnt work then redownload it.

 

[Pazuzu]

I followed instructions at Viruses/Spyware/Malware preliminary removal.

I made some errors in sequence.
Panda Antirootkit found no rootkits or other problems.
Ad-Aware 2007 found 9 tracking cookies (TDI ? ) - I have saved logs in case they are relevant .SS&D found & removed other cookies.

When I tried to upload HJT attachment followed by Combofix & AVG Antispyware logs only the first attachment showed as attached. On attempt to upload second attachment it failed showing a message something like " attachment currently uploading for details and to delete click here"

This time I will try on separate postings before I go back to Step 1
If all else fails I guess I will have to restore from Casper XP

 

[Pazuzu]

Combofix log file & AVG Antispyware report.

 

[kimsland]

I realize you have just completed your scans, but your HJT log is very big (ie your startups are many) including Symantec (Norton); AVG; Sygate; Hp; Fax service; Spyware; Adware and a bundle of others from Dell and you name it !

I would suggest to turn off as many startups as humanly possible, by:
Going to Add/Remove programs and removing anything you don't want (there will be at least 5 I feel)
Running Startup and removing every tick (exception to AVG) on every Tab. (there are 5 Tabs in that program to search for startups)

And then at last re-run and post a fresh HJT log

Note: you should also see an increase in your computer's performance.

 

[Pazuzu]

I realise that there must be a lot more I could get rid of - especially the huge Photo editing packages.
if I could work out what I really need to keep & how to back it up - emails,photos, music - and reformat I think that could speed up the system.
I could just remove all the Dell stuff safely ?
Must confess I did use the FAX when I could not work out how to send a huge file of scanned documents - but that was last year.
I do have an 80GB external hard drive & Casper XP

Thanks for taking a look. I hope this is smaller.

 

[Pazuzu]

I have uninstalled a few large applications.

Yesterday Mozilla firefox would launch when I went to Yahoo messenger & then selected Mail. I tried it just now & it fails to open.

 

[kimsland]

Please try this:

Manual steps to run Chkdsk from My Computer or Windows Explorer

• Open My Computer, and then right-click the hard disk that you want to check.
• Click Properties, and then click Tools.
• Under Error-checking, click Check Now. A dialog box that shows the Check disk options is displayed

Use one of the following procedures:

• • To run Chkdsk in read-only mode, click Start.
• • To repair errors without scanning the volume for bad sectors, select the Automatically fix file system errors check box, and then click Start. (tick)
• • To repair errors, locate bad sectors, and recover readable information, select the Scan for and attempt recovery of bad sectors check box.

Note If one or more of the files on the hard disk are open, you will receive the following message:

The disk check could not be performed because the disk check utility needs exclusive access to some Windows files on the disk. These files can be accessed by restarting Windows. Do you want to schedule the disk check to occur the next time you restart the computer?

Click Yes to schedule the disk check, and then restart your computer to start the disk check.

Wait until Chkdsk finishes Checking / Repairing any faults
Windows will then either restart your computer or continue loading Normally.

 

[Pazuzu]

Ran check disk - only had the two options ( I run XP home) so I chose automatically fix errors. It ran very quickly & did not leave any report of errors.

Clicking on Firefox from start or desktop icon is getting to display the opening
window but shows trying to load "start.mozilla.org" but times out trying to find
http://start.mozilla.org/firefox?client=firefox-a&rls=org.mozilla:en-US:official

I opened my firewall & found this in the log " Application has changed since the last time you opened it, process id: 4020
Filename: C:\Program Files\Mozilla Firefox\firefox.exe
The change was allowed by user

---- Modules changed: 1 ----
C:\Program Files\Mozilla Firefox\firefox.exe
---- New modules: 0 ----"

 

[kimsland]

Please provide a HiJackThis Log

Before attaching the log, please run both CCleaner and Startup Control Panel (To reduce (untick) as many startups, and the log size, as possible)
Also, you will need to restart your computer before running HiJackThis

I am hoping that the log will show us, either a program presently running, blocking Firefox. Or a file (possibly malware related) that we could remove.

 

[Pazuzu]

When I booted up windows kernel requested send an echo packet & I allowed the action. Firefox now launching & working as before.
I have done another HJT scan.

Thanks for your help. I will do a backup now before my next disaster.

 

[Pazuzu]

The version of Firefox that worked was 2.0 As soon as I went to Yahoo messenger to pickup email it started a download of 2.0.0.12 This will not launch.
I have downloaded the earlier version from Oldversion.com & so far all is working well. The pre- release Beta3.00 does not work - I just tried. For some time I have not been able to open YMail directly from my desktop icon so I deleted that shortcut during the cleanup.

 

[kimsland]

I'm thinking Sygate firewall, is interfering with your system.
It may be wiser to uninstall this (plus many other spyware related programs) and then fully confirm your system is ok.

Once confirmed, you can then re-install your personnal firewall.
Also did you end up disabling entries (as many as possible-if not all) in Startup command?
As anyone of these can interfere (again) with the normal operaion of your computer (be aware this Startup disabling is reversible, and has multiple tabs)

I'm also not fully understood of your current Firefox version and which one is working or not. You may need to re-literate that part again.

 

[LookinAround]

skimmed through the thread quickly.. have you tried starting firefox in safe mode? (that's Firefox safe mode NOT Windows safe mode). You should find it as a choice if you look in Start->Firefox. Use it to try starting with no Firefox addons, etc.

What kind of problems you having w/real player and the uninstall? I don't know that it's related but i traced a number of problem;s on a friend's machine back to real player not long ago (maybe 8 weeks back i think). It was causing other apps to fail (but not real player) But it's worth first trying to disable any real player addons/extras options in any browser or real player itself. The one in particular that i found causing problems for other apps was the one allowing you to create copies of flash videos you downloaded via real player

 

[Pazuzu]

I am currently running Firefox version 2.0

The latest release is 2.0.12

I found this & followed links to something about directory traversal issues & chrome.
http://blog.mozilla.com/security/2008/02/08/firefox-2.0.0.12-is-now-available
I think there is some conflict with Java 6 from information on the Mozilla support forum.

Yes, I did disable all entries in Startup before I ran HJT. I also got rid of a lot of dead wood using add/remove.
I am a bit unhappy about uninstalling firewall & spyware related programs. Thanks to following your advice Kimsland i seem to have things up and running. I want to get NoScript back & see if system stays stable.

I think I have got rid of Realplayer - initially when I removed a message came up "The following files and/or directories could not be deleted C\Documents and settings\myname\application Data\Real\Realplayer & when I went to delete I could not.
Thanks for looking Looking I did not know Mozilla had a safe mode.

 

[kimsland]

Yes Firefox has a Safe Mode, try this from Start ->Run
"C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode

If Firefox fully works in Safe Mode (that's Firefox safe mode!) then it will be just a matter of finding and disabling the addon causing it to fault.

Regarding Java, please go here and confirm your Java is fully updated to the current version. Mine is, and Firefox still works.
http://java.com/en/download/installed.jsp?detect=jre&try=1

Yes, I did disable all entries in Startup

It's just that you still had a few things running at Startup. Now startup control panel doesn't actually stop all startups (as LookinAround has helped me fully become aware of - tools wise) Taking a look here: http://www.pacs-portal.co.uk/startup_index.htm You may be able to disable more (or ideally un-install) Think of it this way, anything free can be un-installed without issue (except to re-download the newest versions - later on)

That might keep you going for a bit !

 

[tomrca]

Pazuzu: the version of hijack this is way out of date

 

[kritius]

Hey Tom:wave:

I checked through some of the earlier ones and the first HJT was the up to date version but the last one for some reason was older.

Bizarre.

 

[kimsland]

I missed that myself
Here's the updated one:- https://www.techspot.com/downloads/317-trend-micro-hijackthis.html

You should remove all other first

 

[tomrca]

i think that perhaps he/she hasn't removed the old version and has simply selected the wrong one of the two ? after a second look "hijack this.exe " hasn't been renamed, instead the file holding the "hijack this.exe" file has.
by the way hi conor

to get most recent version click "hijack this" in my signature below

 

[Pazuzu]

Thanks for pointing out the HJT mistakes. A Wiggum worthy error Dooohp.

When I went to Sun Sytems & downloaded the latest Java I got these error messages I went to add or remove in control panel & selected change & Java 6.0.3 installed.

I looked at the http://www.pacs-portal.co.uk/startup_index.htm & will try to reduce startup applications when I understand it better.

Once again my thanks to you all. Now perhaps I can get back to my tethered hang gliding practice in the back garden.