Skip to main content

Weird IE problem

Submitted by Makk on
Forum

Ive got this problem on my PC. Whenver I access some sites, for example any of the IGN sites, the page woont load. What happens is it just gives me a blank webpage, as if there is nothing on the site.
However if I click refresh, instead of saying at the status bar something like- Opening page http://ps2ign.com it shows this-
[img]http://www.sumea.com.au/forum/attached/Makk/200410149550_bastard.jpg[/i…]

This was a screengrab I took. I was trying to refresh IGN ps2 but it says that on the status bar. Yet, at the adress bar up the top it says http://ps2.ign.com.
Also, if I right click and select properties, it says the adress is http://iwuxps.outhost.info/

What is going on?!?!?!
This problem started to appear 2 days ago.
Something else that is suspicous is that ZoneAlarm wont stay active. That is, if I load it up, 5 seconds later it disappears without any warning or anything.
I couldnt connect to my server through CuteFTP to upload the above pic either, yet that was working the other day.

Anyone know what this could be and how to fix this???
Ive searched my HD for iwuxps.outhost.info but nothing shows up. I dont have a virus scanner either! ( [:0] ) Whats a good, preferbly cheap one to get?

Submitted by souri on Fri, 15/10/04 - 10:35 AM Permalink

Try [url="http://www.free-av.com/"]AntiVir[/url]... it's free. Make sure you update your virus definitions often too if you install it.

Submitted by Makk on Fri, 15/10/04 - 11:01 AM Permalink

Well, tried downloading that and it said that the file had been damaged or changed since it had been created, if you downloaded this file try again.
ass.
Its 1:00am and Im tired, will try again tommorrow

Submitted by Daemin on Fri, 15/10/04 - 11:11 PM Permalink

Sounds like a virus or some kind of worm that you've got there...

When a friend installed a worm on his system it took some effort in removing, but what the worm did is that it hooked itself into windows so that each time an application started it would know about it so that it could shut it down, therefore no antivirus would work etc.

Submitted by Makk on Sun, 17/10/04 - 7:39 AM Permalink

Well I ran that AntiVir program, it picked up a few trojans but the problem still remains.
Daemin, how did your friend get rid of that? Im thinking a freshh reinstall of XP might be good idea.

Submitted by Daemin on Sun, 17/10/04 - 12:10 PM Permalink

We googled the worm symptoms/name and found several websites that told us how to remove it.

Then we had to go through teh registry, removing many entries, and removing the files used by the worm... I.e. manually remove every last trace of it...

Submitted by tbag on Mon, 18/10/04 - 4:28 AM Permalink

Personally, before reinstalling XP, try Ad-Aware and SpyBot. I find if you use both of them, your system is practically clean of spyware, trojans and worms, the cool thing about SpyBot is it immunises your computer so the spyware, virus or worm cant infect you again [:)].

Lavasoft Ad-Aware: http://www.lavasoftusa.com/support/download/

SpyBot Search & Destroy: http://www.safer-networking.org/en/download/index.html

Give both of them a go, you wont be dissapointed. SpyBot is 100% free and so is Ad-Aware to certain extent if i recall [:p].

EDIT: And if that doesnt work, try SpywareBlaster, it is targetted more towards browser hijackers and is recommended by the SpyBot team.

SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html

Submitted by Makk on Tue, 19/10/04 - 8:33 AM Permalink

After reinstalling XP its still there.
I think its a browser highjacker. I cant click on any of those links tbag gave or the download link to the highjack this program, as IE closes automatically.
Something else thats weird is that I had Spybot on my PC, yet its disappeared somehow. Its not on my Start menu, I cant find it in the Program Files folder, Ive searched my HD for Spybot and that didnt show up. The uninstall option under add/remove prgrams is there though, so maybe Im just blind. I know I didnt uninstall it as its quite a handy little program.

I think I'll have to get a different web browser, what do people recommend? Though will it highjack that?
Hopefully it wont so I can use the new browser to download spybot, etc and get rid of it
Gah!! this is annoying, especailly not being able to upload as I really need too!

Submitted by souri on Tue, 19/10/04 - 9:08 AM Permalink

Dude... seriously... [url="http://www.mozilla.org/products/firefox/"]Firefox[/url]. Tabbed browsing, pop up blocking, more secure (no active X), and a whole lotta extensions that will make your browsing experience a hundred times more efficient/enjoyable..

Submitted by Makk on Tue, 19/10/04 - 9:19 AM Permalink

Whats a tabbed browser!?!?

Submitted by redwyre on Tue, 19/10/04 - 8:44 PM Permalink

Are you running WinXP SP2?

Submitted by mcdrewski on Tue, 19/10/04 - 9:24 PM Permalink

quote:Originally posted by Souri

Dude... seriously... [url="http://www.mozilla.org/products/firefox/"]Firefox[/url].

Seconded. Firefox is the way.

As for "what's tabbed browsing?", it's like the right-click open in new window", but takes up less resources, and you don't have to alt-tab back to the original window. Basically in Firefox you click a link with your middle button and it opens in the background in a 'tab' in the same window. you can see when it's ready to read and then switch across to it later.

you can also open all the bookmarks in a given folder (ie: all your first-thing in the morning links like penny-arcade, sluggy, sumea, google news etc.) in tabs with one click. FANtastic.

Another good thing I use is the 'bookmarks synchroniser' extension.
quote:
http://update.mozilla.org/extensions/authorprofiles.php?id=22
Bookmarks Synchronizer is a Mozilla Firefox extension that let you connect to an FTP server and synchronize your bookmarks that are stored in an XML file. Setup is easy; just write in your FTP server address, username, password and a name for the XML file.

This means that my work PC and home PC and second HD for my work laptop all get the same set of bookmarks.

Woo-Hoo!

Submitted by DaMunkee on Wed, 20/10/04 - 12:27 AM Permalink

That definitely sounds like your machine has been hijacked. From the sounds of it, when you say "reinstalled windows" it seems like your just installing it over the previous installation, not doing a complete format c: reinstall. Anyway, that's a last resort. Try this to help narrow it down.

Obviously something is not allowing your other programs to run, which means that there's a process somewhere that's not friendly. Check your Process list under the Task Manager (control -> alt -> delete -> Task Manager) if there's anything there that you don't recognize, google it. The exception is svchost.exe, a lot of crap runs as a service so if the malware has taken that as it's process name, then you won't be able to find it that way. Another way is to open up the run dialog (start -> run) and type, cmd. That'll open a command prompt, once there type netstat -o that'll list all the incoming and outgoing sockets, the -o option shows the process id with each of them. If they're connecting to addresses that you're not familiar with, well that's some good proof it's a worm or something. Check out the process id on them. What you need to do is kill it :)

Back to Task Manager, with the Processes tab clicked, click view -> select columns then select process id. Match up the ids you saw from netstat and select and click end process.

Once you've done that, you should be able to download and install ad-aware and spybot like the other guys suggested. That should catch your pest :)

Oh, in the meantime, try mozilla's firefox. It owns :)

Munkee

Submitted by Makk on Wed, 20/10/04 - 1:57 AM Permalink

REdwyre, No Im not running SP2. Havent installed any of em.
Munkee. wow, I'll look into that thanks :)

I got firefox downloaded but whe I try to connect to I site its says "The connection was refused when attempting to connect to www.anyurlhere.com
Where is the connection settings?

Submitted by tbag on Wed, 20/10/04 - 3:41 AM Permalink

Honestly, it sounds like this thing has really infected you. Check your processes running in the background, is there anything suspicious there?

As for Firefox its great, i can view websites that require membership for no ads but Firefox kills those ads anyway [:)]. You do however, need to customise your userContent.css to do this [;)].

Submitted by souri on Wed, 20/10/04 - 4:56 AM Permalink

You haven't installed SP1 yet?? [:0]

Submitted by tbag on Wed, 20/10/04 - 5:38 AM Permalink

quote:Originally posted by Souri

You haven't installed SP1 yet?? [:0]

Im guessing your referring to Makk?

And as far as i know, isnt SP2 the latest release?

Submitted by MoonUnit on Wed, 20/10/04 - 6:23 AM Permalink

thats why hes shocked that he hasnt even installed 1 yet

Submitted by tbag on Wed, 20/10/04 - 6:29 AM Permalink

I still have SP1, although SP2 is in the cupboard next to me [:p], probably should install it.

EDIT: Found another program that clears up quite some crap, BHODemon, it clears out IE hijackers and other annoying stuff: http://www.definitivesolutions.com/bhodemon.htm

Submitted by Makk on Wed, 20/10/04 - 7:27 AM Permalink

oh yeah, its a pain in the ass. Especially when your bit of a lamer like me when it comes to the technical side PCs

I think I might backup important data then do a reformat. Ive been wanting to do that for awhile. Anyone know the commad line for that in MS-Dos?

So I should get SP1, eh Souri

I've tried the Task manager but there doesnt look like one there thats suspicous.

In the latest adventures of Spybot, I found a site which wont close IE on me, allowing me to download it. However! when it gets to 99% and goes to copy it to the folder in which I saved it to, it cames up with an error and says Cannot copy file: CAnnot read from the source file or disk. FUN!! :(

Gotta say thanks to you all you guys helping out :)

Submitted by mcdrewski on Wed, 20/10/04 - 7:19 PM Permalink

Okay. to really see what's going on, try wget.

http://allserv.ugent.be/~bpuype/wget/

basically, it's a command line utility to download files from the web (and can be used for all sorts of other useful purposes, but that's beside the point)

once it's unzipped:

wget http://blah.blah.blah.com/directory/file.exe

and it'll download that file.

it should be about as low level as you can get, so you might be lucky enough to bypass whatever hijacker you've got there.

Posted by Makk on
Forum

Ive got this problem on my PC. Whenver I access some sites, for example any of the IGN sites, the page woont load. What happens is it just gives me a blank webpage, as if there is nothing on the site.
However if I click refresh, instead of saying at the status bar something like- Opening page http://ps2ign.com it shows this-
[img]http://www.sumea.com.au/forum/attached/Makk/200410149550_bastard.jpg[/i…]

This was a screengrab I took. I was trying to refresh IGN ps2 but it says that on the status bar. Yet, at the adress bar up the top it says http://ps2.ign.com.
Also, if I right click and select properties, it says the adress is http://iwuxps.outhost.info/

What is going on?!?!?!
This problem started to appear 2 days ago.
Something else that is suspicous is that ZoneAlarm wont stay active. That is, if I load it up, 5 seconds later it disappears without any warning or anything.
I couldnt connect to my server through CuteFTP to upload the above pic either, yet that was working the other day.

Anyone know what this could be and how to fix this???
Ive searched my HD for iwuxps.outhost.info but nothing shows up. I dont have a virus scanner either! ( [:0] ) Whats a good, preferbly cheap one to get?


Submitted by souri on Fri, 15/10/04 - 10:35 AM Permalink

Try [url="http://www.free-av.com/"]AntiVir[/url]... it's free. Make sure you update your virus definitions often too if you install it.

Submitted by Makk on Fri, 15/10/04 - 11:01 AM Permalink

Well, tried downloading that and it said that the file had been damaged or changed since it had been created, if you downloaded this file try again.
ass.
Its 1:00am and Im tired, will try again tommorrow

Submitted by Daemin on Fri, 15/10/04 - 11:11 PM Permalink

Sounds like a virus or some kind of worm that you've got there...

When a friend installed a worm on his system it took some effort in removing, but what the worm did is that it hooked itself into windows so that each time an application started it would know about it so that it could shut it down, therefore no antivirus would work etc.

Submitted by Makk on Sun, 17/10/04 - 7:39 AM Permalink

Well I ran that AntiVir program, it picked up a few trojans but the problem still remains.
Daemin, how did your friend get rid of that? Im thinking a freshh reinstall of XP might be good idea.

Submitted by Daemin on Sun, 17/10/04 - 12:10 PM Permalink

We googled the worm symptoms/name and found several websites that told us how to remove it.

Then we had to go through teh registry, removing many entries, and removing the files used by the worm... I.e. manually remove every last trace of it...

Submitted by tbag on Mon, 18/10/04 - 4:28 AM Permalink

Personally, before reinstalling XP, try Ad-Aware and SpyBot. I find if you use both of them, your system is practically clean of spyware, trojans and worms, the cool thing about SpyBot is it immunises your computer so the spyware, virus or worm cant infect you again [:)].

Lavasoft Ad-Aware: http://www.lavasoftusa.com/support/download/

SpyBot Search & Destroy: http://www.safer-networking.org/en/download/index.html

Give both of them a go, you wont be dissapointed. SpyBot is 100% free and so is Ad-Aware to certain extent if i recall [:p].

EDIT: And if that doesnt work, try SpywareBlaster, it is targetted more towards browser hijackers and is recommended by the SpyBot team.

SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html

Submitted by Makk on Tue, 19/10/04 - 8:33 AM Permalink

After reinstalling XP its still there.
I think its a browser highjacker. I cant click on any of those links tbag gave or the download link to the highjack this program, as IE closes automatically.
Something else thats weird is that I had Spybot on my PC, yet its disappeared somehow. Its not on my Start menu, I cant find it in the Program Files folder, Ive searched my HD for Spybot and that didnt show up. The uninstall option under add/remove prgrams is there though, so maybe Im just blind. I know I didnt uninstall it as its quite a handy little program.

I think I'll have to get a different web browser, what do people recommend? Though will it highjack that?
Hopefully it wont so I can use the new browser to download spybot, etc and get rid of it
Gah!! this is annoying, especailly not being able to upload as I really need too!

Submitted by souri on Tue, 19/10/04 - 9:08 AM Permalink

Dude... seriously... [url="http://www.mozilla.org/products/firefox/"]Firefox[/url]. Tabbed browsing, pop up blocking, more secure (no active X), and a whole lotta extensions that will make your browsing experience a hundred times more efficient/enjoyable..

Submitted by Makk on Tue, 19/10/04 - 9:19 AM Permalink

Whats a tabbed browser!?!?

Submitted by redwyre on Tue, 19/10/04 - 8:44 PM Permalink

Are you running WinXP SP2?

Submitted by mcdrewski on Tue, 19/10/04 - 9:24 PM Permalink

quote:Originally posted by Souri

Dude... seriously... [url="http://www.mozilla.org/products/firefox/"]Firefox[/url].

Seconded. Firefox is the way.

As for "what's tabbed browsing?", it's like the right-click open in new window", but takes up less resources, and you don't have to alt-tab back to the original window. Basically in Firefox you click a link with your middle button and it opens in the background in a 'tab' in the same window. you can see when it's ready to read and then switch across to it later.

you can also open all the bookmarks in a given folder (ie: all your first-thing in the morning links like penny-arcade, sluggy, sumea, google news etc.) in tabs with one click. FANtastic.

Another good thing I use is the 'bookmarks synchroniser' extension.
quote:
http://update.mozilla.org/extensions/authorprofiles.php?id=22
Bookmarks Synchronizer is a Mozilla Firefox extension that let you connect to an FTP server and synchronize your bookmarks that are stored in an XML file. Setup is easy; just write in your FTP server address, username, password and a name for the XML file.

This means that my work PC and home PC and second HD for my work laptop all get the same set of bookmarks.

Woo-Hoo!

Submitted by DaMunkee on Wed, 20/10/04 - 12:27 AM Permalink

That definitely sounds like your machine has been hijacked. From the sounds of it, when you say "reinstalled windows" it seems like your just installing it over the previous installation, not doing a complete format c: reinstall. Anyway, that's a last resort. Try this to help narrow it down.

Obviously something is not allowing your other programs to run, which means that there's a process somewhere that's not friendly. Check your Process list under the Task Manager (control -> alt -> delete -> Task Manager) if there's anything there that you don't recognize, google it. The exception is svchost.exe, a lot of crap runs as a service so if the malware has taken that as it's process name, then you won't be able to find it that way. Another way is to open up the run dialog (start -> run) and type, cmd. That'll open a command prompt, once there type netstat -o that'll list all the incoming and outgoing sockets, the -o option shows the process id with each of them. If they're connecting to addresses that you're not familiar with, well that's some good proof it's a worm or something. Check out the process id on them. What you need to do is kill it :)

Back to Task Manager, with the Processes tab clicked, click view -> select columns then select process id. Match up the ids you saw from netstat and select and click end process.

Once you've done that, you should be able to download and install ad-aware and spybot like the other guys suggested. That should catch your pest :)

Oh, in the meantime, try mozilla's firefox. It owns :)

Munkee

Submitted by Makk on Wed, 20/10/04 - 1:57 AM Permalink

REdwyre, No Im not running SP2. Havent installed any of em.
Munkee. wow, I'll look into that thanks :)

I got firefox downloaded but whe I try to connect to I site its says "The connection was refused when attempting to connect to www.anyurlhere.com
Where is the connection settings?

Submitted by tbag on Wed, 20/10/04 - 3:41 AM Permalink

Honestly, it sounds like this thing has really infected you. Check your processes running in the background, is there anything suspicious there?

As for Firefox its great, i can view websites that require membership for no ads but Firefox kills those ads anyway [:)]. You do however, need to customise your userContent.css to do this [;)].

Submitted by souri on Wed, 20/10/04 - 4:56 AM Permalink

You haven't installed SP1 yet?? [:0]

Submitted by tbag on Wed, 20/10/04 - 5:38 AM Permalink

quote:Originally posted by Souri

You haven't installed SP1 yet?? [:0]

Im guessing your referring to Makk?

And as far as i know, isnt SP2 the latest release?

Submitted by MoonUnit on Wed, 20/10/04 - 6:23 AM Permalink

thats why hes shocked that he hasnt even installed 1 yet

Submitted by tbag on Wed, 20/10/04 - 6:29 AM Permalink

I still have SP1, although SP2 is in the cupboard next to me [:p], probably should install it.

EDIT: Found another program that clears up quite some crap, BHODemon, it clears out IE hijackers and other annoying stuff: http://www.definitivesolutions.com/bhodemon.htm

Submitted by Makk on Wed, 20/10/04 - 7:27 AM Permalink

oh yeah, its a pain in the ass. Especially when your bit of a lamer like me when it comes to the technical side PCs

I think I might backup important data then do a reformat. Ive been wanting to do that for awhile. Anyone know the commad line for that in MS-Dos?

So I should get SP1, eh Souri

I've tried the Task manager but there doesnt look like one there thats suspicous.

In the latest adventures of Spybot, I found a site which wont close IE on me, allowing me to download it. However! when it gets to 99% and goes to copy it to the folder in which I saved it to, it cames up with an error and says Cannot copy file: CAnnot read from the source file or disk. FUN!! :(

Gotta say thanks to you all you guys helping out :)

Submitted by mcdrewski on Wed, 20/10/04 - 7:19 PM Permalink

Okay. to really see what's going on, try wget.

http://allserv.ugent.be/~bpuype/wget/

basically, it's a command line utility to download files from the web (and can be used for all sorts of other useful purposes, but that's beside the point)

once it's unzipped:

wget http://blah.blah.blah.com/directory/file.exe

and it'll download that file.

it should be about as low level as you can get, so you might be lucky enough to bypass whatever hijacker you've got there.