Original link
Http://bbs.pcicp.com/archive/index.php/t-109689.html
HiVia
General ideas for Internet Explorer issues:
First, every time you have to do it -> Reset the Internet Option:
1. Temporary files for clearing Internet Explorer
2. Reset security level is the default level
3. The setting of the cookie is also set to the default level
4. Program associations are also reset
5. Reset advanced settings
6. Sometimes "Enable Third Party Browser Extensions" is forbidden to solve some problems
Second, in some cases because some DLLs are not registered correctly. Probably can be divided into the following categories:
Script error:
-----------------------------------
Regsvr32 Scrrun.dll
Regsvr32 msxml.dll
Regsvr32 mshtml.dll
Regsvr32 msjava.dll
Regsvr32 jscript.dll
The connection cannot be opened:
-----------------------------------
Regsvr32 urlmon.dll
Page Display Problem:
----------------------------------
Regsvr32 shdocvw.dll
Regsvr32 browseui.dll
The safety site cannot be opened:
---------------------------------
Regsvr32 SoftPub.dll
Regsvr32 WinTrust.dll
Regsvr32initpki.dll
Third, if it is an error, most cases due to third-party Plug-IN. The situation in IE itself is rare.
1. Go to Spyware is that you find that IE is old or your home page is always changed.
Commonly used to go to Spyware's free tools:
Ad-aware: http://www.lavasoft.de/support/download/download
Spybot S & D: http://beam.to/spybotsd
CWSHREDDER: http://www.spywareInfo.com/ ~merijn/files/cwshredder.exe
Note When you run these programs, you should turn all IE and Explorer all, because most SpyWare processes are bound to Process related to these two and Windows Shell. At the same time, pay attention to updating these tools to the latest feature library. SPYWARE and VIRUS are also updated to the definition library.
In addition, some traditional anti-virus software can now kill some spyware. Here are a few free online services:
TrendMicro: http://housecall.trendmicro.com/
BitDefebder: http://www.bitdefender.com/scan/licnce.php
Panda: http://www.pandasoftware.com/activescan/
2. If SpyWare can't be automatically removed, you may need you to handle it. The most common tools are:
Hijackthis: http://www.majorgeeks.com/download3155.html or http://www.spywareInfo.com/ ~merijn/files/hijackthis.exe
It scans the current system status. Below is an example:
Running Processes:
...
R1 - HKCU / Software / Microsoft / Internet Explorer, SearchURL = http://www.sharempeg.com/find/
R1 - HKCU / Software / Microsoft / Internet Explorer / Main, Search Bar = http://www.blazefind.com/search.php?search=%SR1 - HKCU / Software / Microsoft / Internet Explorer / Main, Search Page = HTTP : //www.blazefind.com
R0 - HKCU / Software / Microsoft / Internet Explorer / Main, Start Page = http://btbroadbandstart.bt.com/main.html
R1 - HKCU / Software / Microsoft / Internet Explorer / Main, Default_Search_URL = http://1-se.com/home.html (Obfuscated)
R1 - HKCU / Software / Microsoft / Internet Explorer / Search, Searchassistant = http://ie-search.com/srchasst.html (Obfuscated)
R1 - HKCU / Software / Microsoft / Internet Explorer / Search, CustomizeSearch = http://ie-search.com/srchasst.html (Obfuscated)
R0 - HKLM / Software / Microsoft / Internet Explorer / Main, Start Page = http://www.search-2003.com/
R1 - HKLM / Software / Microsoft / Internet Explorer / Main, Search Bar = http://1-se.com/srchasst.html (Obfuscated)
R1 - HKLM / Software / Microsoft / Internet Explorer / Main, Search Page = http://1-se.com/home.html (Obfuscated)
R1 - HKLM / Software / Microsoft / Internet Explorer / Main, Default_page_URL = C: /Winnt/HomePage.htm
R1 - HKLM / Software / Microsoft / Internet Explorer / Main, Default_Search_URL = http://1-se.com/home.html (Obfuscated)
R0 - HKLM / SOFTWARE / Microsoft / Internet Explorer / Search, Searchassistant = http://www.blazefind.com/search_page.php
R1 - HKCU / Software / Microsoft / Internet Explorer / SearchURL (Default) = http://www.blazefind.com
R1 - HKCU / Software / Microsoft / Internet Explorer / Main, Searchassistant = http://1-se.com/srchasst.html (Obfuscated)
R1 - HKLM / Software / Microsoft / Internet Explorer / Main, Searchassistant = http://1-se.com/srchasst.html (Obfuscated)
R1 - HKCU / Software / Microsoft / Internet Explorer, SearchAssistant = http://www.sharempeg.com/find/R1 - HKCU / Software / Microsoft / Internet Explorer, CustomizeSearch = http://www.sharempeg.com/find/
R1 - HKLM / Software / Microsoft / Internet Explorer / Search (Default) = http://1-se.com/srchasst.html (Obfuscated)
O2 - BHO: (NO Name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C: / Program Files / Adobe / Acrobat 5.0 / Reader / ActiveX / AcroieHelper.ocx
O2 - Bho: WinLink Module - {6CC1C91A-AE8B-4373-A5B4-28BA1851E39A} - C: / Documents and Settings / Administrator / Application Data / WinLink / WinLink.dll (File Missing)
O2 - Bho: (no name) - {71ed4fba-4024-4bbe-91dc-9704c93f453e} - c: /progra ~ 1/iesearchbar/iesearchbar.dll (file missing)
O2 - Bho: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - c: /winnt/2_0_1browserhelper2.dll
O2 - BHO: (Name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C: / Winnt / Downloaded Program Files / Bridge.dll (File Missing)
O3 - Toolbar: & Radio - {8E718888-423F-11D2-876E-00A0C9082467} - c: /winnt/system32/msdxm.ocx
O3 - Toolbar: IE Search Bar - {71ed4FBA-4024-4BBE-91DC-9704C93F453E} - C: /Progra ~ 1/iesearchbar/iesearchbar.dll (file missing)
O3 - Toolbar: McAfee Virusscan - {BA52B914-B692-46C4-B683-905236F6F655} - C: /Progra ~ 1/mcafee.com/vso/mcvsshl.dll
O4 - hklm /../r Run: [Synchronization Manager] MOBSYNC.EXE / LOGON
O4 - hklm /../r: [Promon.exe] Promon.exe
O4 - hklm /../ Run: [Easy Access Keyboard] C: / Program Files / Compaq / Easy Access Keyboard / MMKeybd.exe
O4 - hklm /../ Run: [em_exec] c: /progra ~ 1/mousew ~ 1/system/em_exec.exe
O4 - hklm /../run: [chkadmin] chkadmin.exe
O4 - hklm /../r: [hpdj taskbar utility] c: /winnt/system32/spool/drivers/w32x86/3/hpztsb04.exe
O4 - hklm /../ Run: [loadingqm] loadingqm.exe
O4 - hklm / hww: [tkbellexe] "C: / Program files / compon files / real / update_ob / realsched.exe" -Ontooto4 - hklm /../run: [windows shell library loader] load shell32.dll / c / set
O4 - hklm /../r: [enigmapopupstop] C: / program files / spyhunter / popblocker / enigmapopupstop.exe
O4 - hklm /../ Run: [host] c: /winnt/system32/hosts.vbs
O4 - hklm /../r Run: [vsochecktask] "c: /progra ~ 1/mcafee.com/vso/mcmnhdlr.exe" / checktask
O4 - hklm /../ Run: [Virusscan Online] "C: /Progra ~ 1/mcafee.com/vso/mcvsshld.exe"
O4 - hklm /../r: [mcagenteexe] c: /progra ~ 1/mcafee.com/agent/mcagent.exe
O4 - hklm /../ Run: [McUpdateexe] C: /Progra ~ 1/mcafee.com/agent/mcupdate.exe
O4 - hklm /../ Run: [MPFEXE] C: /Progra ~ 1/mcafee.com/person ~ 1/mpftray.exe
O4 - hklm /../r: [Belt] C: /Winnt/Belt.exe
O4 - hklm /../ Run: [ISD] C: /WINNT/ISD.EXE
O4 - hklm /../r Run: [QuickTime Task] "C: / Program Files / QuickTime / Qttask.exe" -atboottime
O4 - hklm /../ Run: [GSICONEXE] GSICON.EXE
O4 - hklm /../ Run: [DSLAGENTEXE] DSLAGENT.EXE USB
O4 - hkcu /../ Run: [internat.exe] internat.exe
O4 - hkcu /../ Run: [msnmsgr] "C: / program files / msn messenger / msnmsgr.exe" / background
O4 - hkcu /../ Run: [AIM] C: /Progra ~ 1/aim95/aim.exe -cnetwait.odl
O4 - hkcu /../r: [olehelp] c: /winnt/system32/olehelp.exe
O4 - hkcu /../r: [sws.exe] c: / program files / globaldiaaler / Wordi00026 / 5592687.exe -remove
O4 - Global Startup: Microsoft Office.lnk = C: / Program Files / Microsoft Office / Office / Osa9.exe
O4 - Global Startup: Symantec Fax Starter Edition Port.Lnk = C: / Program Files / Microsoft Office / Office / 1033 / Olfsnt40.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C: / Program Files / Common Files / Adobe / Calibration / Adobe Gamma Loader.exe
O4 - Global Startup: Winzip Quick Pick.llnk = C: / Program Files / Winzip / Wzqkpick.exeo4 - Global Startup: bt Broadband Help.Lnk = C: / Program Files / Bt Broadband / Help / Bin / Matcli.exe
O8 - Extra Context Menu Item: & AroundWeb Search - Res: // C: / Program Files / AroundWeb / AWTOOLB.DLL / MENUSEARCH.HTM
O8 - Extra Context Menu Item: Web Search - C: /WinNT/EX.htm
O9 - Extra Button: AIM (HKLM)
O9 - Extra Button: Related (HKLM)
O9 - Extra 'Tools' Menuitem: show & related Links (HKLM)
O9 - Extra Button: real.com (hklm)
O12 - Plugin for .SPOP: C: / Program Files / Internet Explorer / Plugins / Npdocbox.dll
O13 - WWW prefix: http://ehttp.cc?
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} - http://63.219.181.7/CAX.cab
O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install026.exe
.
Partial part worth noting:
The R1 starts is some IE settings, including homepage, search settings, and more. If you are infected by some malicious pages, some situations will be found here.
O2 is very important. Many IE's PLUG-IN is a binding with the shell through Bho. Here should pay attention to those suspicious third-party DLLs.
O3 is some of the toolbars in IE or other extensions. If you are not your installed program, you can remove it.
O4 is a startup item. It is similar to that of Msconfig.
There are other things that are not explained.
In HijackThis, you can tick those suspicious items again "fix checked". Thus those suspicious Items are automatically deleted. Everyone can also send the LOG of HijackThis on their own machine to the forum to help analyze, which things are deleted. . .
3. There are still two advanced tools:
Process Explorer:
http://www.sysinternals.com/ntw2k/freeware/procexp.shtml
Can help you see all processes that bind to Explorer or IE.
Microsoft MPS Reporting Tool:
http://www.microsoft.com/downloads/details.aspx?familyid=cebf3c7c-7ca5-408f-88b7-f9c79b7306c0&displayLANG=EN
This tool is the favorite of Microsoft Engineers. A large amount of information can be found inside. If you have some registry values, system information, all DLLs under the system directory, all of the currently running programs and the DLLs that are bound to them.
Fourth, the page can't be opened
This situation is complicated. It can generally be divided into the following cases: 1. Network reasons. If you find that other Internet programs can not access the Internet, then what you see is a network problem, this has exceeded the scope of this article to discuss.
2. Firewall. Some firewalls have compatibility issues. What you first think of is to stop the firewall to even Uninstall.
3. It may be that the page content is required to have the corresponding ActiveX control on the unit. You can see the source file of the page. The most common is to install Flash Player, JRE ETC.
4. Sometimes due to the parameters of TCP / IP. This situation occurs most when accessing the Secure site. There is a tool automatically trim TCP / IP Winsock. You can try (for Win2k, WinXP):
Http://members.shaw.ca/techcd/winsockxpfix.exe
5. Other reasons must be analyzed in specific problems. Commonly used methods are mainly
a. Look at the error Code. For example, 403 is permission problem, 404 is a file that cannot be found.
b. Analyze by tools such as NetWork Monitor. But ask you to know more about HTTP.
http://www.w3.org/protocols/rfc2616/rfc2616.html
