PCTech Forums

IE6 stops responding with the following in the error report:

C:\DOCUME~1\USERNAME~1\LOCALS~1\Temp\WER9.tmp.dir00\iexplore.exe.mdmp
C:\DOCUME~1\USERNAME~1\LOCALS~1\Temp\WER9.tmp.dir00\appcompat.txt

I downloaded and used spybot and ad-aware (I already had a McAfee virus scanner and fire wall) and finally used hijackthis. Help!

The HijackThis log:

Logfile of HijackThis v1.97.7
Scan saved at 10:03:55 PM, on 5/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\System32\smss.exe
C:\WINDOWS.000\system32\winlogon.exe
C:\WINDOWS.000\system32\services.exe
C:\WINDOWS.000\system32\lsass.exe
C:\WINDOWS.000\system32\svchost.exe
C:\WINDOWS.000\System32\svchost.exe
C:\WINDOWS.000\system32\spoolsv.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFSER~1.EXE
C:\WINDOWS.000\System32\svchost.exe
C:\Program Files\McAfee.com\VSO\mcshield.exe
C:\WINDOWS.000\Explorer.EXE
C:\WINDOWS.000\System32\devldr32.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\WINDOWS.000\System32\CTHELPER.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
C:\PROGRA~1\MESSEN~1\msmsgs.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE
C:\Program Files\Common Files\efax\Dllcmd32.exe
C:\Program Files\Common Files\efax\HotTray.exe
C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFAGENT.EXE
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Robert Maxwell\Local Settings\Temporary Internet Files\Content.IE5\1COFXPK1\HijackThis[1].exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS.000\SYSTEM\blank.htm
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS.000\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\MCAFEE.COM\PERSON~1\MPFTRAY.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFREE.EXE"
O4 - Global Startup: PageKeeper Jobs.lnk = C:\Program Files\Caere\PageKeeper30\system\PKJobs.exe
O4 - Global Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exe
O4 - Global Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {0713E8D2-850A-101B-AFC0-4210102A8DA7} (Microsoft ProgressBar Control, version 5.0 (SP2)) - http://download.mcafee.com/molbin/Share ... mCtl32.cab
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - http://download.mcafee.com/molbin/Shared/MGBrwFld.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... tor/sw.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdat ... t/opuc.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mci ... insctl.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupda ... t/opuc.cab
O16 - DPF: {69F497FB-5082-4EA4-9305-9E19F20A2BFF} (MaxisSimCity3TeleX Control) - http://simcity.ea.com/teleport/simcity/ ... 3TeleX.cab
O16 - DPF: {72C23FEC-3AF9-48FC-9597-241A8EBDFE0A} (InstallShield International Setup Player) - http://ftp.hp.com/pub/automatic/player/isetupML.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 7871296296
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcg ... cgdmgr.cab
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} (SimCityX Control) - http://simcity.ea.com/us/guide/classic/ ... mCityX.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/defaul ... der_v5.cab
O16 - DPF: {F7DC2A2E-FC34-11D3-B1D9-00A0C99B41BB} (Zoom Class) - http://www.zoomify.com/download/zoomify305.cab

Thanks, RM

Please post the complete Error Report. (Details)
One quick resort: Insert WinXp CD and go to Start / Run / Type sfc /scannow
Let that run through, reboot and see if the error still occurs. If it does, get all the details.
brad

You may also want to update your AV

Empty your browser's cache and history folders. Delete all the .tmp and .chk files you can find.
To do so, click Start/Find and in the search box (field) type *.tmp and this will search for all your temporary files.
Repeat for chk files by typing *.chk in the search field

maybe also remove old restore points you have, if you dont need them then it might be a good idea
dont delete all, save the most recent restore point

and now scan you PC with your AV (antivirus)

I inserted the WinXp CD and went to Start / Run / and typed: sfc /scannow. I ran it, rebooted, and the error still occurs.

Here's the error signature:

szAppName : iexplore.exe szAppVer : 6.0.2800.1106 szModName : MSHTML.DLL
szModVer : 6.0.2800.1400 offset : 00036f92

Reporting Details:

This error report includes: information regarding the condition of IE when the problen occurred, the operating system version and computer hardware in use, and the IP address of your computer.

We do not intentionally collect your name, address, email address or any other form of personally identifiable info. However, the error report may contain customer-specific info in the collected data files. While this info could potentially be used to determine your identity, if present, it will not be used.

The data that we collect will only be used to fix the problem. If more info is available, we will tell you when you report the problem. This error report will be sent using a secure connection to a database with limited access and will not be used for marketing purposes.

Here's the only files included in the error report:

C:\DOCUME~1\USERNAME~1\LOCALS~1\Temp\WERD.tmp.dir00\iexplore.exe.mdmp
C:\DOCUME~1\USERNAME~1\LOCALS~1\Temp\WERD.tmp.dir00\appcompat.txt

I dumped all the files in the temporary internet folder, including all offline content and the cookies, and I also dumped the history folder. When I tried to delete the .tmp files (didn't try the .chk files) found by Start/Find, it stopped responding (no error report).

McAfee VirusScan is up-to-date, and it found nothing when i ran it. When I went to System Restore settings, VirusScan said the file C:\WINDOWS.000\system32\restore\rstrui.exe contains suspicious scripting activity. Also VirusScan didn't detect the spyware that SpyBot S&D detected, and it's supposed to scan for all spyware, adware, etc...

Thanks, RM

I found some interesting posts elsewhere using google. Actually google's #2 find was THIS forums site... woo hoo.

here's the one on our site that google found.


here's another site blaming windows media player


I'm a little concerned about the files being in the temp directory. I'd try to rename the folder (WERD.tmp.dir00) that those files are contained in, and see how everything works. If it fixes the problem, simply delete the WERD.tmp.dir00 directory, if it causes more problems, change it's name back to it's original name. Generally the temp folder only gets used durring install processes.

I am unable to remove Media Player. The only thing in Add/Remove Programs is a hotfix. If I remove it about ten additional applications will not function. I also tried going into Program Files/Windows Media Player. It will not delete.

Ok, I've gone about a month without any problems (after I cleared the history), but just recently the problem with IE6 started again. It stops responding and the same error as before showed up:

Error Report Contains:
C:\DOCUME~1\ROBERT~1\LOCALS~1\Temp\WER60.tmp.dir00\iexplore.exe.mdmp
C:\DOCUME~1\ROBERT~1\LOCALS~1\Temp\WER60.tmp.dir00\appcompat.txt

With error signature:
zAppName : iexplore.exe szAppVer : 6.0.2800.1106 szModName : MSHTML.DLL
szModVer : 6.0.2800.1400 offset : 00088aa4

I've ran SpyBot S&D, AdAware, and McAfee VirusScan (nothing), plus I've dumped the cache, cookies, and the history folder. Should I download and run HiJackThis and then post the log?

Also, when I go to System Restore settings, VirusScan said the file C:\WINDOWS.000\system32\restore\rstrui.exe contains suspicious scripting activity. What's up with this?

Thanks, RM

I recommend that you (Fukumae) start your own strand in order to get a response from one of the moderators.

robym6 is right Fukumae...too many logs in one thread by different members makes it very difficult to read and follow.
So plz..start a new thread.

Both of you should download and post your logfile,in own thread...

Download Hijackthis---Important---Create a permanent folder
EG---- Open MyDocuments----Right click an empty spot and select NEW---Folder----Name the new folder HJT ---this is where you will want to save Hijackthis too, also, backups will be stored there.
Download from here
http://www.spywareinfo.com/~merijn/files/HijackThis.exe
or here
http://aumha.org/downloads/hijackthis.exe

Do a SCAN----Scan will change to SAVE LOG----copy and paste the WHOLE contents of the log
here... Don't try and fix anything yet----It is all important.

Cactus

Ermm don't forget about dei who also posted in anothers uses thread


Hmmm... tin get a bit confusin'

whoa there's been a lot of views of this topic!