[Resolved] Internet explorer annoyance.

[Adwanoc]

Hi. Im running windos ME with IE6and latley ive been experiencing a little annoying problem in Internet Explorer. It happened while I was typing into a text box or filling out a form. When I pushed Enter to start a new paragraph, suddenly the window became unselected. With a little tinkering I found that whenever I pushed the enter key, the window became unselected.

So I thought I might as well see what WAS selected. So I Pushed enter, then did Alt+tab and there was a "Phantom window". The window selected was an internet explorer window with the site http://3d-images.org . For some reason I cant seem to get the window to show up anywhere else. I can't see the window. I can't find the window in the close program dialouge. I cant find it on the task bar. It's just hidden from view, like its running in the background. so i decided to go to this 3d-images.org site. It seems like a perfectly normal site, but under close inspection, there are n these strange pornographic links embeded within the sites html code. ... well if anyone has any idea what i could do next to find out how to get rid of this stupid window, or if they have delt with this thing before, please rpely. THank you.

[Guest Grim Reaper]

hi adwanoc and welcome to the forum......

my first questions would be do you have up do date antivirus and a firewall in place,

secondly, have you run Ad-Aware available here and / or Spybot S & D from here?

It sounds to me like this site MAY have some sort of hijack ware.

[mark2]

If still there after running Spybot and Adaware go to http://mjc1.com/mirror/hjt/ to download Hijackthis there is also a short tutorial on the site on how to use it.

paste the results into this thread and we can sort it out.

Don't attempt to fix until you have posted your log here, a lot you will see will be needed

[Adwanoc]

Well I have Norton Antivirus on, although i dont have a fire wall. I have tried using Hijack this, and have gotten rid of all the out of the ordinary entries. I also tried Spy bot and while it detected tons of spy ware, getting rid of it doesnt seem to fix my problem. I will try ad aware... I hope it works.

[Guest Grim Reaper]

have you got your hijackthis log that we could have a look at??

[mark2]

Make sure you have the latest version of Hijackthis, v1.97.7

Unzip, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.

Press that, save the log somewhere, and please show us its contents.

Most of what it lists will be harmless or even required, so do NOT fix anything yet.

Post your log then we can analyze it.

It is also important to close all browser windows when allowing HJT to fix.

[Adwanoc]

Well ad aware did nothing...

anyways, heres my log. It seems that most of it is taken up by google toolbar and some other harmless stuff. I had already gotten rid of the most obvious spy ware stuff, such as the ever annoying mysearch.com "tool" and ezula top text. See what you can figure from this.

Logfile of HijackThis v1.97.7

Scan saved at 7:58:51 PM, on 12/1/2003

Platform: Windows ME (Win9x 4.90.3000)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\STIMON.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE

C:\WINDOWS\SYSTEM\LEXBCES.EXE

C:\WINDOWS\SYSTEM\RPCSS.EXE

C:\WINDOWS\SYSTEM\LEXPPS.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\SYSTEM\SYSTEMIE.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE

C:\WINDOWS\LOADQM.EXE

C:\PROGRAM FILES\CANON\BJPV\TVMON.EXE

C:\WINDOWS\SYSTEM\QTTASK.EXE

C:\PROGRAM FILES\OPTIMUM ONLINE\NETSURF.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE

C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE

C:\PROGRAM FILES\INSTAN-T\INSTANT.EXE

C:\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.optonline.net

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [scanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"

O4 - HKLM\..\Run: [LoadQM] loadqm.exe

O4 - HKLM\..\Run: [bJPD HID Control] C:\Program Files\Canon\BJPV\TVMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe

O4 - HKLM\..\RunServices: [stillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE

O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

O4 - HKLM\..\RunServices: [scriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg

O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background

O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O8 - Extra context menu item: Read By Natural Voice Reader - C:\Program Files\Natural Voice Reader Standard\read.html

O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html

O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html

O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html

O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html

O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html

O9 - Extra button: Related (HKLM)

O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)

O9 - Extra button: Natural Reader (HKLM)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab

O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/Template...nloads/outc.cab

O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa...director/sw.cab

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab

O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab

One more important note: I notice now that besides making forum posts and emails more annoying than ever, today it started poping up opt ins for dowloading some file called "3dimages.htm". This is making me more confident that whatever this thing is is harmful.

Additionally I have noticed my computers resources are all out of whack. It says out of my 500 mb of ram, only 20 megs is availible. When I try to open a simple program like paint, it will give me "out of memory" error messages, although most of the time the computer runs fine. Infact I ran adobe photoshop 7 just fine yesterday despite my critically low memory.

Thank you so much for your help everyone. I hope together we can solve this mystery.

[Adwanoc]

oh no, its just gotten worse. Ive been getting run time errors in german. Yes german. It says run time error on the top, and the rest of the message is in german. I DONT SPEAK GERMAN! Now my programs wont open, and I get an error message about some thing called ei timer, with some crap about countdowns. Im scared for my computers life! lol this thing is driving memore crazy than I already am! I cant find anything on google about these strage virus like symptoms! I hope none of my files become deleted or what not... for that would suck.

[mark2]

This could possibly account for some of your ads.

O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray

Pacman's portal has this to say about it

Optimum Online

Netsurf.exe

Optimum Online ISP software. Not required, just window dressing & advertising from Optimum

That's the only one there I can see that will load ads for you.

to get some of your resources back the following are optional fixes.

close all browser windows and allow HJT to fix

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime

O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background

O4 - Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

Disable

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE

C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\FINDFAST.EXE using msconfig

ME is not very good with memory management unfortunately. :down:

See how it goes with those fixes.

[Adwanoc]

Amazing. Once I got rid of netsurf and find fast my computer runs flawlessly. The memory problems are gone, although I still get that annoying 3d-images.org thing. I suppose I will never know what it is exactly... Could it be something new that just came out? Some new sort of spy ware that noone has heard of?

[mark2]

Post the latest HJT log, lets have another look see if there's something more in there to be found

[mark2]

C:\WINDOWS\SYSTEM\SYSTEMIE.EXE

is a new(ish) one, a keylogger trojan.

You'll need to change all your passwords or sensitive information you have typed into online forms.

REBOOT into safe mode.

And find and remove the files below:

systemie.exe

sysie.dll

systemie.dll

systemie.dat .

If this doesn't work we may need to go into the registry. :(

[Adwanoc]

WOW! That fixed it! THank you so much for your help! How did you ever find out about this?

[mark2]

Adwanoc

How did you ever find out about this?

I lurk in some strange places :D

It was in

http://forums.tomcoyote.org/index.php?act=idx

you might have a look at http://www.windowsforum.org/support/forum/...?showtopic=3702 and http://www.windowsforum.org/support/forum/...php?showtopic=5 to begin to prevent similar problems in the future.

Glad it's fixed :thumbup: