links not working

[stewin]

For the last few weeks, I 've been experiencing a strange problem with IE6.

On some web site, for some reason, links are not working or are opening a blank window with no buttons or address bar. The only thing is "About: Blank Internet Explorer" in the blue bar on top of the window. Also in the bottom left corner of the previous page, it says "errors on page".

For exemple on some stores web site, if I try to enlarge an item picture (which should open in a pop up window), I get the About:Blank window mentionned above.

I've search the web to find any fix on my problem and all I find is about the problem where the home page is replaced by About:Blank (this is not my problem).

I also have tried everything about the following procedure that has not fixed my problem:

Type regsvr32 urlmon.dll , and then click OK.

When you receive the DllRegisterServer in urlmon.dll succeeded message, click OK.

If this does not resolve the problem, repeat for:
regsvr32 Shdocvw.dll
regsvr32 Msjava.dll
regsvr32 Actxprxy.dll
regsvr32 Oleaut32.dll
regsvr32 Mshtml.dll
regsvr32 Browseui.dll
regsvr32 Shell32.dll (Windows XP and Windows 2000 only)


Anyone please help, I'm very confused about that


Thanks

 

[poertner_1274]

Do you have some sort of pop-up blocker installed, or a firewall?

It could be due to something like that, allowing the window to appear, but not allow the images to appear in those windows.

Try disabling your firewall or pop-up blocker and see what happens.

:wave:Welcome to TechSpot:wave:

 

[RealBlackStuff]

The about: blank is usually related to some searchbar or virus-infection.
Go to this post here first, and follow the instructions EXACTLY, especially about UPDATING and HJT-location.
How to remove Begin2Search/Coolwebsearch and Other Nasties
Then see How to post your Hijackthis log-files.

 

[stewin]

I have pop up stopper pro that has been working well for a while now. I tried to desactivate it and also Norton antivirus. It did'nt change anything.

I would think it's related to the Coolwebsearch thing but I don't have the home page problem....???


I'll try to follow realblackstuff advice but I really don't know how to analyse HJT reports...

I'd try anything!


thanks

 

[RealBlackStuff]

You do the testing of all those programs, then run HJT and publish the log here.
We will analyse it for you and advise what to fix.

 

[stewin]

You do the testing of all those programs, then run HJT and publish the log here.
We will analyse it for you and advise what to fix.

I just started to execute the procedure realbackstuff suggests. Went to the links, printed everything.....

As the first step of the procedure is to turn off system restore, I tried to do so, and here's the message I get from Windows as soon as I click on the system restore tab:

RUNDLL32.EXE HAS ENCOUNTERED A PROBLEM AND MUST CLOSE. SORRY FOR ..... BLAH, BLAH, BLAH

I translated from french, the message may be different but basically means that...

I still haven't download or installed the tools since I'm not even able to do the first step!!!

Is it possible to still fix the problem without turning off system restore. Could it be the same problem preventing me from turning off system restore...???

Where do I go from now?

Please HELP, I've never seen anything like that!

 

[gwhite]

Did you try doing it in safe mode?

 

[stewin]

I may try... really think it would work?

 

[gwhite]

Who knows,
You won't be out much execept some time. Download firefox and forget IE6 if you don't want to mess with it.

 

[stewin]

Who knows,
You won't be out much execept some time. Download firefox and forget IE6 if you don't want to mess with it.

Tried it... still the same.

The point is not about IE6 or firefox.... it's about something messed up that is not working as it's supposed to be. Using another software would be just like going around the problem until it comes back in my face again....

Thanks for the cue, but I really want to get this fixed... Then I may decide to use another software. I really think the problem is much deeper than just the browser not working properly.

 

[gwhite]

Well you could do one of a couple things. If your computer is working well enough to save your data, do so now. You could invest a boat load of time an energy into fixing this or wipe it clean and start new. As a last try, uninstall norton and then try booting off your xp disk and do a repair of windows. I realize that reinstalling windows seems like a lot of work but in the end you'll have a nice clean system. Make sure you go to your device manager and write down every device. Modem, network card, video card ect... Have you tried to go to system restore and back it up a month or before this started happening?

 

[stewin]

My computer is still very stable, I can access all the local drives, everything is working fine exept for the links problem and the rundll32, which are probably related to the Coolwebsearch thing.

I've already tried everything about the antivirus or the ad-blocker or any goodies I have on IE.

Re-installing Windows is not an option for me by now... even if I've got everything regularely backup. I've been having this only problem for a few weeks now and the computer is still running very well, so I don't see any emergency to wipe it clean before I even spend at least one or two weeks trying to get a efficient way to fix it.

I was just going to try the procedure realblackstuff sent me (the one we see everywhere on the net when searching about this problem), cause he made me realize it is probably the infection I got, even if I don't have all the symptoms. Then I faced the rundll32 problem....

Now I'm just waiting for someone to tell me if I can execute the Coolwebsearch procedure without turning off system restore. If so, that may fix both problems, or I could fix the rundll32 afterwards.

Anyway, this is where I am for now, and I'll wait a bit for some advices before pressing the panic button...

Thank you

 

[olefarte]

I agree, I wouldn't reinstall Windows yet. But it would at least try and do the other things RealBlackStuff suggested in that post he linked, it's at least worth a shot. It might or might not get you to the point you can turn off system restore. And if you really think you have a problem with CoolWebSearch, why not go ahead and run CWShredder, that's what it's for.

At any rate, it won't hurt anything to go ahead and run the prorams he listed. I do that on a regular basis and it won't hurt a thing.

 

[RealBlackStuff]

Do it without turning System Restore off.
Download only Hijackthis from TomCoyote's website. Install it in e.g. c:\Program Files\HJT.
Then boot into Safe Mode, and run HJT on its own, with no other windows or programs open. Hit the button "Do a scan and safe a log". Safe it as 'hjt.txt' or something.
Then post that here: see How to post your Hijackthis log-files.
At least we can see what is wrong (hopefully).

 

[stewin]

Hi realblackstuff

I send you the log file of the HJT scan I just did. I think I saw a couple of things to fix and I was very tempted do try it myself... But then I just thought it might be safer to let the expert tell me exacltly what to do.

So there it is.

 

[RealBlackStuff]

Boot in Safe Mode.
Switch System restore OFF.
Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:
MsnMsgr.Exe
Ares.exe
ATR1.EXE

Next, uninstall anything to do with:
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Ares\Ares.exe

Next, run HJT on its own and let it 'fix':
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.fr.msn.ca/0SEFRCA/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.canoe.com/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Deer Hunter 2005 Registration.lnk = C:\Program Files\Atari\Deer Hunter 2005\ATR1.EXE
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.exe
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {A9F2611F-C7CE-49D7-AEE9-17E9028711C1} (SafeGuard Class) - http://www.meetstream.com/activex/login4/login.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {BFD90062-6B5E-4F8F-87B1-5F022C14E32F} (ActiveReceiver Control) - http://www.meetstream.com/activex/28010/activereceiver.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {D32E12A5-F4E1-4F99-8C80-4A0C494430A5} (MsgAlertButton Class) - http://www.meetstream.com/activex/messagealert2/NewMsgButton.cab
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\STPHAN~1\LOCALS~1\Temp\hpdj.exe (file missing)

When done, delete the highlighted bold files. When a directory-name is bold, delete everything in it, including that directory itself.
Boot normal. When all OK, switch System Restore back on.

Tip for Deerhunter:
A little advice for those who have DH2k5 full version. DO NOT DELETE THE DEMO!! In the full version, you can't change settings yet or your system will crash. The way to get around this is to use the settings you made from the demo patch, copy the .CFG and paste to the profiles of the full version. This will allow you to use your settings from the demo. And if you want to change anything, go into the demo, change your settings and repeat the process ( copy, paste(overwrite) ). This is working out nicely so far, just a quick fix till the patch for the full version comes out. I hope this helps everyone

 

[stewin]

Hi

I just tried to execute the procedure you just gave me.... But the problem is still present. Maybe you can find a mistake I made.

First, I still couldn't turn system restore off because of the rundll32.exe problem I describe above. (in a previous post).

So I went on anyway.


The 3 processes you told me to stop were not running.

I couldn't uninstall Messenger 6.2 because running in safe mode. (I did it later in regular mode).

The Ares.exe was not installed. But this name is telling me something... I can't remember exactly but I think it's a file sharing software I installed and uninstalled in the same hour because it messed up my home page or toolbars at that time.... thought it was fixed... (could it be causing my links problem)

Then running HJT and doing the fixes went well.

The Ares folder wasn't present.

I deleted the Messenger folder and the PCANotify.dll in system32 (I had to reboot first cause it was used... probably by HJT that asked for reboot).


I'm very confused.... Looks like my system is normal exept for some website links (which are working at the office, so my pc is the problem), and also the rundll32.exe problem that I discovered trying to solve the 1st one.

Any help is welcome

Thanks

 

[RealBlackStuff]

Check if you have any of the following programs installed on your PC. If so, UNinstall them.
Go!Zilla
BearShare
Mp3.com
iMesh
Babylon
Webshots
gDivx
BikiniDesk
RadLight / Subtitle Studio
RealNetworks (RealOne Player)
UK Software
Cydoor (LingoWare)
Grokster
KaZaA
Mindset Interactive (NetPalNow)

Click Start/Run and type in: sfc /scannow and keep your XP-CD handy.
This will check for any corrupted/missing system files.

And by the way, stop using IE, go to www.getfirefox.com and use Firefox from now on!
IE is strictly for Windoze-updates.

Then make a new HJT-log and post it here.

 

[stewin]

Check if you have any of the following programs installed on your PC. If so, UNinstall them.
Go!Zilla
BearShare
Mp3.com
iMesh
Babylon
Webshots
gDivx
BikiniDesk
RadLight / Subtitle Studio
RealNetworks (RealOne Player)
UK Software
Cydoor (LingoWare)
Grokster
KaZaA
Mindset Interactive (NetPalNow)

Click Start/Run and type in: sfc /scannow and keep your XP-CD handy.
This will check for any corrupted/missing system files.

And by the way, stop using IE, go to www.getfirefox.com and use Firefox from now on!
IE is strictly for Windoze-updates.

Then make a new HJT-log and post it here.

Hi

I checked for all the softwares you listed, and the only one I'm having is Kazaalite. (wich has be running for a few years with before the links problem started)
I could uninstall it, as it's not very usefull anymore....

I ran sfc/scannow - I guess this is for the rundll32.exe problem - that has not been fixed by doing that. Should I have Windows fixed with the install CD? Would this fix anything? I insist on the fact that my system is still running very stable.

I downloaded and installed Firefox... and for now, I must say that my first impression is very positive. I like it and I have no links problems. I'll explore a little more in the next few days. (I'm on firefox right now)

So, even if the telecom. technician in me hates to see the machine winning on him, if I keep Firefox as the default browser, the only problem left would be the rundll32. I already tried to restore it from the CD, seems like nothing can bring it back. And even if I've never used system restore.... I'm sure this is not the only place affected by the rundll32 problem, and I really must fix that one.

Thanks again

 

[triplate]

"Do it without turning System Restore off" ??...thats exactly where CoolWebSearch trojans hide...i,ve always had to turn Off Sys Restore to be successful.................maybe i,m missing something?..

 

[stewin]

"Do it without turning System Restore off" ??...thats exactly where CoolWebSearch trojans hide...i,ve always had to turn Off Sys Restore to be successful.................maybe i,m missing something?..

The problem is that I can't turn it off. Everytime I click on the system restore tab in the computer properties window, I get an error message saying the "there was a problem with rundll32.exe....bla, bla, bla...".

Same in safe mode.

Still haven't been able to restore rundll32.exe. I tried many ways, nothing seems to work. Is there a magic way to get it back???

 

[triplate]

You,ve got a Trojan..bigtime(imo)...About Buster, CWShredder,McAfee Stinger...those should help at least find it..what AV are you using??...You need to post a HJT log here so we can anylise it...

 

[triplate]

rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 C:\windows\inf\ie.inf ...type into RUN..hit enter...see if that helps.

 

[stewin]

"Do it without turning System Restore off" ??...thats exactly where CoolWebSearch trojans hide...i,ve always had to turn Off Sys Restore to be successful.................maybe i,m missing something?..

This is the problem!

I can't turn it off. Whenever I click on the system restore tab in the computer properties, I get a message saying that there is a problem with rundll32.exe.... bla, bla, bla...

In safe mode or regular mode, I can't turn it off.

I tried to restore rundll32.exe a few different ways, nothing seems to work, it's still corrupted or defect.... I don't know.

Is there a special way to fix the rundll32 so I can get rid of the links problem?

 

[stewin]

sorry for the last post (double) I didn't see page 2...