[Metallica]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
"{ACB1E670-3217-45C4-A021-6B829A8A27CB}" = "Mcafee VirusScan"
-> {HKLM...CLSID} = "McAfee VirusScan"
\InProcServer32\(Default) = "C:\Program Files\McAfee\McAfee VirusScan\VSCShellExtension.dll" ["Network Associates, Inc."]
"{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" = (no title provided)

These were the ones that made me suspect McAfee

Thanks for looking at this, Dan.

[Advertisements]

Have removed MacAfee and the email problem with Outlook seems to have sorted itself. However the IE6 problem is still there. Perhaps it has improved a bit (it now is a 50:50 chance of it opening).
I have stopped Windows Firewall (this has been stopped all along).

I think something happened on the last windows security update, these were
KB938464-v2
KB960714
KB958215
KB960225
KB958690
Are there any known problems with these?

[jimd07]

Have removed MacAfee and the email problem with Outlook seems to have sorted itself. However the IE6 problem is still there. Perhaps it has improved a bit (it now is a 50:50 chance of it opening).
I have stopped Windows Firewall (this has been stopped all along).

I think something happened on the last windows security update, these were
KB938464-v2
KB960714
KB958215
KB960225
KB958690
Are there any known problems with these?

[Metallica]

Usually if there are massive problems with the updates they are quickly followed by the next update.

None that I have seen in great numbers anyway.
Let's wait for Dan. Maybe he knows of some.

[Dan]

I haven't heard of any overly problematic updates either, and like Metallica said, they are usually patched pretty quickly. But, before we start looking elsewhere, let's make sure that you don't still have remnants of McAfee on your system. Please download and run the McAfee Removal Tool; once it's finished, ensure you restart your computer. Issues persist?

Also, I would assume that if it was an update issue, it wouldn't go away when you restart in safe mode, although I may be wrong -- there's a first time for everything, right?

[jimd07]

Completely removed MacAfee and at first it seemed good. I managed to open IE five times before it failed. As time has gone on the failure rate seems to have increased.
Also still got the problem with Outlook. When I open an email with graphics etc. (e.g. an ebay email) the window opens with a full header but the message pane is blank. When the email is closed Outlook crashes and then restarts.

I am now very concerned at not having a virus checker.

Jim

[Dan]

I am now very concerned at not having a virus checker.

By all means, re-install McAfee.

Also still got the problem with Outlook. When I open an email with graphics etc. (e.g. an ebay email) the window opens with a full header but the message pane is blank. When the email is closed Outlook crashes and then restarts.

Could you please open that e-mail when you're in safe mode; does the exact same thing happen?

Step 1 - Generate a startup and uninstall list:
Please download HijackThis (if you do not already have it) and install it -- once it is installed, restart your computer. Once the computer starts up, can you please launch HijackThis and then select the option Open the Misc Tools section -- select Generate StartupList log. Save the startup list in a safe location. Now select the option Open Uninstall Manager and then click Save list -- save it to a safe location. Please post the contents of the startup list and the uninstall list in your next response.

To be honest, I was pretty convinced that this was a McAfee issue -- but I'd like to see what else you have running.

[jimd07]

When I run in safe mode IE and Outlook work perfectly. They also seem to run quicker.

Two files printed here, but also attached as files.

StartupList report, 28/03/2009, 11:37:55
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office10\OUTLOOK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Jim Devlin\Start Menu\Programs\Startup]
Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

EPSON Stylus Photo RX620 Series = C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HE.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB002" /M "Stylus Photo RX620"
WheelMouse = C:\WheelMou\wh_exec.exe
KeyMaestro = C:\KMaestro\KMaestro.exe
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
kdx = C:\Program Files\KHost.exe -all
H/PC Connection Agent = "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
McAfee.InstantUpdate.Monitor = "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

DelayShred = "C:\Program Files\McAfee\McAfee Shared Components\Shredder\SHRED32.EXE" /q C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\ANTIPH~1.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\Content.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK3.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\History\History.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK4.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK231.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK557.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLKF8.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK10C.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK5A.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK6.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK22.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK27.SH! C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\OLK8.SH!

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[KeyMaestro]
FirstRun =

RepeatFlag =
PowerEnable =

BTCplayEnable =


[OptionalComponents]
*No values found*

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\ssmypics.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}

--------------------------------------------------

Enumerating Task Scheduler jobs:

{4956739E-94F1-4F31-AB56-8B4EF44ABF0F}_NOVATECH_Jim Devlin.job
{8A33CD18-9269-406A-B0B0-D7BA8D486854}_NOVATECH_Jim Devlin.job
{FE7A4309-C4DB-4961-AA3E-25F311A721E8}_NOVATECH_Jim Devlin.job

--------------------------------------------------

Enumerating Download Program Files:

[Microsoft Office Template and Media Control]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\IEAWSDC.DLL
CODEBASE = http://office.micros...tes/ieawsdc.cab

[Office Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\OGACheckControl.DLL
CODEBASE = http://download.micr.../OGAControl.cab

[BrowseFolderPopup Class]
InProcServer32 = C:\WINDOWS\MCBin\Shared\MGBrwFld.dll
CODEBASE = http://download.mcaf...ed/MGBrwFld.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://active.macrom...tor/cabs/sw.cab

[Windows Genuine Advantage Validation Tool]
InProcServer32 = C:\WINDOWS\system32\legitcheckcontrol.dll
CODEBASE = http://download.micr...heckControl.cab

[Microsoft PID Sniffer]
InProcServer32 = C:\WINDOWS\system32\odc.dll
CODEBASE = https://support.micr...ActiveX/odc.cab

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.micr...922/wmv9VCM.CAB

[Microsoft Office Template Downloader]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msotd.dll
CODEBASE = http://office.micros...llery/msotd.cab

[{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}]
CODEBASE = http://fpdownload.ma...t/ultrashim.cab

[{9F1C11AA-197B-4942-BA54-47A8489BB47F}]
CODEBASE = http://v4.windowsupd...7661.1188310185

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash10a.ocx
CODEBASE = http://download.macr...ash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #4: C:\Program Files\Bonjour\mdnsNSP.dll
NameSpace #5: C:\WINDOWS\system32\wshbth.dll

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
UPnPMonitor: C:\WINDOWS\system32\upnpui.dll

--------------------------------------------------
End of report, 7,702 bytes
Report generated in 0.090 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only



Uninstall Manager

#1 DVD Ripper 5.36
AAC
ABC Amber LIT Converter
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Help Center 1.0
Adobe PageMaker 7.0
Adobe Photoshop Album 2.0 Starter Edition
Adobe Photoshop CS2
Adobe Reader 8
Adobe Stock Photos 1.0
Adobe SVG Viewer 3.0
Adobe Type Manager 4.0
Advanced SystemCare 3
Apple Mobile Device Support
Apple Software Update
AudioShell 1.2
Autodesk MapGuide® Viewer ActiveX Control Release 6.3
AviTricks Classic version 1.65
AXIS Media Control
AXIS Media Control SDK
Bazooka Scanner
BBC iPlayer Download Manager
BBC iPlayer Download Manager
BIAS SoundSoap PE 2.1
Bonjour
CdCoverCreator 2.5.2
CD-DA X-Tractor v0.24
Citrix ICA Web Client
Compatibility Pack for the 2007 Office system
CoPilot - Pocket PC 5
Desktop Sudoku
DivX
DivX Player
DivX Web Player
DVD audio to CD
DVDInfoPro
eDrawings 2008
EPSON CardMonitor
EPSON Copy Utility 3
EPSON PhotoQuicker3.5
EPSON PhotoStarter3.1
EPSON PRINT Image Framer Tool2.1
EPSON Printer Software
EPSON Scan
EPSON Smart Panel
EPSON Web-To-Page
ERUNT 1.1j
ESPRX620 Series Reference Guide
ESPRX620 Software Guide
Express Burn
Express Rip
FF Assistant
Foxit PDF Editor
Free PDF to Word Doc Converter v1.1
Free RAR Extract Frog 1.00
Freecorder Toolbar
Freecorder Toolbar 3.02 Application
FW LiveUpdate
GeForce4 Experience
GIMP 2.6.3
Golden Records
Google Earth
Google Earth Plugin
Google Toolbar for Internet Explorer
Google Update Helper
GPL Ghostscript 8.63
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
HotDocs 5.1
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB952287)
ICT Skills Test
ImgBurn
Intel® 536EP Modem
IP Phone 1.01
iTunes
J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 7
Java 2 Runtime Environment, SE v1.4.2_05
Java 2 Runtime Environment, SE v1.4.2_06
Java™ 6 Update 11
Karen's Directory Printer
KeyMaestro Input Device Driver V2.0.1-29A2 MUL
L2012 high res Screen Saver
Lotus SmartSuite Release 9.5
LP Recorder
LP Ripper
Macromedia Shockwave Player
Magic ISO Maker v5.4 (build 0256)
MagicDisc 2.6.93
Malwarebytes' Anti-Malware
MapManager
McAfee VirusScan Professional Edition
MediaCoder 0.6.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft ActiveSync
Microsoft Data Access Components KB870669
Microsoft Flight Simulator 2000
Microsoft FrontPage 2002
Microsoft Interactive Training
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Money
Microsoft Money for the Pocket PC
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Media Content
Microsoft Office XP Standard for Students and Teachers
Microsoft Reader
Microsoft Silverlight
Microsoft Windows Journal Viewer
Microsoft Windows Media Video 9 VCM
Microsoft XML Parser and SDK
MioNet
Mozilla Firefox (3.0.7)
Mozilla Thunderbird (2.0.0.21)
MSN Messenger 7.5
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MyHeritage Family Tree Builder
Nero Mega Plugin Pack
Nero Suite
Nokia PC Suite 4.81
NVIDIA Windows 2000/XP Display Drivers
OfficeReady PDF Edition
Opera 9.64
PCI Audio Driver
PDFill PDF Editor with FREE PDF Writer and Tools
Personal Ancestral File 5
Picasa 3
PIF DESIGNER2.1
Pinnacle Instant DVD Recorder
PoiEdit
PowerDVD
Presto! ImageFolio LE
Presto! PageManager
Presto! PageType
QuickTime
RealPlayer
Recognita Standard OCR 3.2
RecordPad Sound Recorder
Recover My iPod
Recovery Genius 21st
RegCure 1.5.2.7
Retrospect Express HD 2.0
River Past Wave@MP3
Samsung ML-6040 Series Driver
SC DVD Copier 3.2.0.0
ScanToWeb
Scribus 1.3.3.12
Security Update for Windows Media Encoder (KB954156)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Shockwave
SiS 900 PCI Fast Ethernet Adapter Driver
SiSoftware Sandra Lite XIIc
Spybot - Search & Destroy
Spybot - Search & Destroy 1.4
Studio 11
Studio Ultimate
Swift To-Do List Lite 1.10
Switch
t@b ZS4 Video Editor v0.958-686
TCPMP
thinkDB 2 Desktop
TurboCAD Learning Edition
Ultrasoft MoneyLink
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
WAV Joiner
WavePad Uninstall
WheelMouse 3.10.0.002
WinAce Archiver
Windows Genuine Advantage v1.3.0254.0
Windows Media Encoder 9 Series
Windows Media Encoder 9 Series
Windows Media Format Runtime
Windows Media Player 10
Windows Media Player 10 Hotfix - KB894476
Windows XP Service Pack 3
WinZip
World Screensaver
X-Lite 3.0
Yahoo! Desktop Login
Yahoo! Widgets
YouConvert Classic



Regards

Jim

Attached Files

•  startuplist.txt   7.34KB   551 downloads
•  uninstall_list.txt   6.11KB   544 downloads

[Metallica]

My eye keeps getting drawn to this one:
C:\Program Files\McAfee\McAfee Shared Components\Shredder\SHRED32.EXE" /q C:\DOCUME~1\JIMDEV~1\LOCALS~1\TEMPOR~1\ANTIPH~1.SH!

Maybe I'm focusing too much on what I found on the McAfee forums, but that looks like there is an anti-phishing module to me.

And then we have:
[BrowseFolderPopup Class]
InProcServer32 = C:\WINDOWS\MCBin\Shared\MGBrwFld.dll
CODEBASE = http://download.mcaf...ed/MGBrwFld.cab

And can I ask what you used RegCure for? Was that shortly before the problems started?

[jimd07]

I will look more deeply at what you have pointed out with MacAfee. However I was still experiencing the problem when I completely removed MacAfee.

I downloaded RegCure after the problem to see if it would help. Unfortunately it was only a trial version which told you about problems but did not fix them. However it did not find any problems.

I will get rid of this anyway as it just blocks up the hard disk.

I will post again when I have looked at the MacAfee problem.

Many Thanks


Jim

[Metallica]

Hang on Jim,

Maybe Dan spots something else.

[Dan]

I have to agree with Metallica on this one. One thing I wouldn't mind checking would be to see if a clean boot changes anything; this might narrow it down to certain services, drivers or apps.

Step 1 - Start your machine in a clean boot state:

• Click Start, click Run, type msconfig, and then click OK
• In the new window, select the General tab and then select Selective Startup
• Click to clear the Process SYSTEM.INI File check box.
• Click to clear the Process WIN.INI File check box.
• Click to clear the Load Startup Items check box. Verify that Load System Services and Use Original BOOT.INI are checked.
• Click the Services tab.
• Click to select the Hide All Microsoft Services check box.
• Click Disable All, and then click OK.
• When you are prompted, click Restart to restart the computer.

When the computer reboots, does the issue continue?
*Note: To return Windows to a normal startup mode, please do the following:

• Select Start, and then click Run.
• Type msconfig, and then click OK.
• Click the General tab, click Normal Startup - load all device drivers and services, and then click OK. When you are prompted, click Restart to restart the computer.

[jimd07]

This doesn't make any difference.

IE6 starts just over 50% of time, but emails onaining graphics freeze at a blank email. Outlook also freezes and has to be closed, it works fine with text emails.

Have now gone back to normal startup mode.

[jimd07]

Still not got anywhere with my problem.
IE is now refusing to open at all. I can use Firefox but of course some websites will only work with IE.
The situation with Outlook seems to be variable. Yesterday it worked just fine. Today it is displaying everything but the photographs or logos that are embedded, but it is displaying all the text and the formatting.
THis has got me thoroughly foxed and I am tempted to get a new machine switch all my data and then reformat this machine.
What do you think?

Regards Jim

[Metallica]

If that is a viable solution for you.
We have thrown anything but the kitchen sink at and it won't budge.

[Dan]

Try removing all toolbars for IE from Add/Remove programs and also get rid of all of your addons -- does the issue persist?