Error iexplorer and msimn

Question

Good evening,  I have a big problem with Internet Explorer (6.0.29) and Outlook Express: as soon as I open a site on IE or try to open an email containing HTML (or even after a while when I'm doing nothing), I get an application error and the famous "send to Microsoft..."  After a scan, I found that I had pokapoka75 installed, which I promptly removed using hijackthis, ccleaner, and apparently I no longer have it. But the problem persists :(  Upon closer inspection of the error log, it indicates an error on "ModName: waxw2k.dll." However, I do not have this dll on my PC and cannot find it, either on the internet or on another machine... I only find its name in the hijack log but cannot locate the file.  Do you have any suggestions? I would like to avoid spending a weekend reformatting and reinstalling :(  Below is the log just in case... thank you in advance for any suggestions.  Logfile of HijackThis v1.99.1 Scan saved at 21:50:05, on 11/10/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)  Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE D:\PowerToy	askswitch.exe D:\ANTIVI~1\AVG7\avgcc.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\CAPRPCSK.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE D:\ANTIVI~1\AVG7\avgamsvr.exe D:\ANTIVI~1\AVG7\avgupsvc.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\gearsec.exe D:\Antivirus\Norton Antivirus
avapsvc.exe D:\Antivirus\Norton Antivirus\IWP\NPFMntor.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\wuauclt.exe D:\Antivirus\HijackThis.exe  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Links O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\DaemonTools\daemon.exe" -lang 1033 -noicon O4 - HKLM\..\Run: [CoolSwitch] D:\PowerToy	askswitch.exe O4 - HKLM\..\Run: [CAPON] C:\WINDOWS\System32\Spool\Drivers\w32x86\3\CAPONN.EXE O4 - HKLM\..\Run: [AVG7_CC] D:\ANTIVI~1\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Canon LBP-800 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE O4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Translate from English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Related pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Similar pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Current page version available in Google cache - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll O9 - Extra 'Tools' menuitem: Java Console (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_02\bin
pjpi142_02.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122650811499 O20 - Winlogon Notify: waxw2k - C:\WINDOWS\SYSTEM32\waxw2k.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\ANTIVI~1\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\ANTIVI~1\AVG7\avgupsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - D:\Antivirus\Norton Antivirus
avapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - D:\Antivirus\Norton Antivirus\IWP\NPFMntor.exe O23 - Service: SAVScan - Symantec Corporation - D:\Antivirus\Norton Antivirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

^^Marie^^ · Answer

Hello,
First of all, you should get rid of Norton, it's a real sieve.
Personally, I have Avast! But you can choose, check it out here:
http://sebsauvage.net/
A=
--
-----don'tknowwhat todo---we'llsee---

Elcibi · Answer

Well, actually my usual antivirus is AVG, but since it didn't detect the pokatruc, I tried Norton...

But what I would really like to resolve is more this waxw2k.dll issue ;) (even though I'm not a big fan of IE, it's still practical, and it's mainly for Express..)

I'll definitely take a look at your link :)

balltrap34 · Answer

hi
try this
click on start/run and type cmd
then copy and paste this into the window that opened
netsh winsock reset catalog

restart it

if that doesn't change anything
download this
download this
http://www.downloads.subratam.org/l2mfix.exe
unzip it double click on l2mfix.bat press any key and then choose option 1
wait it will generate a report copy and paste it
don't do anything else
--
hunting and shooting are my true passion
see personal site in profile

balltrap34 · Answer

restart l2mfix and click on l2mfix.bat and this time click on option 2 and let it do its thing and give me the report and a
new hijack report

--
hunting and clay shooting are my true passion
see personal site in profile

robespierre24 · Answer

Here you go,  it has rebooted. I'm sending you the Log from L2Mfix then Hijack.  Thanks for the information.  In an hour I'm hitting the road for a week....  I'll pick up the thread after...   Setting Directory  C:\  C:\  System Rebooted!   Running From:  C:\   killing explorer and rundll32.exe   Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org  Killing PID 1620 'explorer.exe'   Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03  Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org  Killing PID 1836 'rundll32.exe'   Scanning First Pass. Please Wait!   First Pass Completed   Second Pass Scanning   Second pass Completed!   Zipping up files for submission:  adding: clear.reg (188 bytes security) (deflated 2%)  adding: boot.ini (124 bytes security) (deflated 30%)  adding: lo2.txt (188 bytes security) (deflated 51%)  adding: test.txt (188 bytes security) (stored 0%)  adding: test2.txt (188 bytes security) (stored 0%)  adding: test3.txt (188 bytes security) (stored 0%)  adding: test5.txt (188 bytes security) (stored 0%)  adding: xscan.txt (188 bytes security) (deflated 94%)   Restoring Registry Permissions:    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above  Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)  This program is Freeware, use it on your own risk!    Revoking access for predefined group "Administrators"  Inherited ACE cannot be revoked here!  Inherited ACE cannot be revoked here!    Registry permissions set to:   RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above  Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)  This program is Freeware, use it on your own risk!   Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify:  (ID-NI) ALLOW Read BUILTIN\Users  (ID-IO) ALLOW Read BUILTIN\Users  (ID-NI) ALLOW Read BUILTIN\Power Users  (ID-IO) ALLOW Read BUILTIN\Power Users  (ID-NI) ALLOW Full access BUILTIN\Administrators  (ID-IO) ALLOW Full access BUILTIN\Administrators  (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM  (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM  (ID-IO) ALLOW Full access CREATOR OWNER    Restoring SeDebugPrivilege:   Granting SeDebugPrivilege to Administrators ... failed (GetAccountSid(Administrators)=1332   Restoring Windows Update Certificates.:    The following is the Current Export of the Winlogon notify key: ****************************************************************************  Windows Registry Editor Version 5.00   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]  "Asynchronous"=dword:00000000  "Impersonate"=dword:00000000  "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\  6c,00,00,00  "Logoff"="ChainWlxLogoffEvent"   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]  "Asynchronous"=dword:00000000  "Impersonate"=dword:00000000  "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\  6c,00,6c,00,00,00  "Logoff"="CryptnetWlxLogoffEvent"   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]  "DLLName"="cscdll.dll"  "Logon"="WinlogonLogonEvent"  "Logoff"="WinlogonLogoffEvent"  "ScreenSaver"="WinlogonScreenSaverEvent"  "Startup"="WinlogonStartupEvent"  "Shutdown"="WinlogonShutdownEvent"  "StartShell"="WinlogonStartShellEvent"  "Impersonate"=dword:00000000  "Asynchronous"=dword:00000001   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]  "DLLName"="wlnotify.dll"  "Logon"="SCardStartCertProp"  "Logoff"="SCardStopCertProp"  "Lock"="SCardSuspendCertProp"  "Unlock"="SCardResumeCertProp"  "Enabled"=dword:00000001  "Impersonate"=dword:00000001  "Asynchronous"=dword:00000001   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]  "Asynchronous"=dword:00000000  "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00  "Impersonate"=dword:00000000  "StartShell"="SchedStartShell"  "Logoff"="SchedEventLogOff"   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]  "Logoff"="WLEventLogoff"  "Impersonate"=dword:00000000  "Asynchronous"=dword:00000001  "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]  "DLLName"="WlNotify.dll"  "Lock"="SensLockEvent"  "Logon"="SensLogonEvent"  "Logoff"="SensLogoffEvent"  "Safe"=dword:00000001  "MaxWait"=dword:00000258  "StartScreenSaver"="SensStartScreenSaverEvent"  "StopScreenSaver"="SensStopScreenSaverEvent"  "Startup"="SensStartupEvent"  "Shutdown"="SensShutdownEvent"  "StartShell"="SensStartShellEvent"  "PostShell"="SensPostShellEvent"  "Disconnect"="SensDisconnectEvent"  "Reconnect"="SensReconnectEvent"  "Unlock"="SensUnlockEvent"  "Impersonate"=dword:00000001  "Asynchronous"=dword:00000001   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ermsrv]  "Asynchronous"=dword:00000000  "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\  6c,00,6c,00,00,00  "Impersonate"=dword:00000000  "Logoff"="TSEventLogoff"  "Logon"="TSEventLogon"  "PostShell"="TSEventPostShell"  "Shutdown"="TSEventShutdown"  "StartShell"="TSEventStartShell"  "Startup"="TSEventStartup"  "MaxWait"=dword:00000258  "Reconnect"="TSEventReconnect"  "Disconnect"="TSEventDisconnect"   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\waxw2k]  "DllName"=hex(2):77,00,61,00,78,00,77,00,32,00,6b,00,2e,00,64,00,6c,00,6c,00,\  00,00  "Startup"="waxw2k"  "Impersonate"=dword:00000001  "Asynchronous"=dword:00000001  "MaxWait"=dword:00000001  "key4"="[442695539247[Philippe M]"   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]  "DLLName"="wlnotify.dll"  "Logon"="RegisterTicketExpiredNotificationEvent"  "Logoff"="UnregisterTicketExpiredNotificationEvent"  "Impersonate"=dword:00000001  "Asynchronous"=dword:00000001   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif]  "DLLName"="wzcdlg.dll"  "Logon"="WZCEventLogon"  "Logoff"="WZCEventLogoff"  "Impersonate"=dword:00000000  "Asynchronous"=dword:00000000    The following are the files found: ****************************************************************************   Registry Entries that were Deleted:  Please verify that the listing looks ok.  If there was something deleted wrongly there are backups in the backreg folder. ****************************************************************************  REGEDIT4   [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]  REGEDIT4   [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ****************************************************************************  Desktop.ini Contents: **************************************************************************** ****************************************************************************      -------------   --------------   and the Hijack LOG    Logfile of HijackThis v1.99.1  Scan saved at 01:17:50, on 22/10/2005  Platform: Windows XP (WinNT 5.01.2600)  MSIE: Internet Explorer v6.00 (6.00.2600.0000)   Running processes:  C:\WINDOWS\System32\smss.exe  C:\WINDOWS\system32\winlogon.exe  C:\WINDOWS\system32\services.exe  C:\WINDOWS\system32\lsass.exe  C:\WINDOWS\system32\svchost.exe  C:\WINDOWS\System32\svchost.exe  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe  C:\WINDOWS\system32\spoolsv.exe  C:\Program Files\AVPersonal\AVWUPSRV.EXE  C:\Program Files\Common Files\Symantec Shared\ccProxy.exe  C:\WINDOWS\System32\svchost.exe  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe  C:\Program Files\Inventel\Gateway\wlancfg.exe  C:\WINDOWS\System32\wuauclt.exe  C:\WINDOWS\explorer.exe  C:\WINDOWS\system32\NOTEPAD.EXE  C:\WINDOWS\System32\wuauclt.exe  C:\Program Files\Netscape\Communicator\Program
etscape.exe  C:\Program Files\Microsoft Office\Office10\WINWORD.EXE  C:\Documents and Settings\Philippe M\Mes documents\philippe.mallard\HijackThis.exe   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://abonnes.lemonde.fr/web/sequence/0,2-3208,1-0,0.html  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =  N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.google.fr"); (C:\Program Files\Netscape\Users\default\prefs.js)  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll  O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx  O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe  O4 - HKLM\..\Run: [CHotkey] mHotkey.exe  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime  O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe  O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo  O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe  O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"  O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe" -osboot  O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"  O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIX10.exe  O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  O4 - Global Startup: hp psc 2000 Series.lnk = D:\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe  O4 - Global Startup: hpoddt01.exe.lnk = ?  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE  O8 - Extra context menu item: &Download with NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000  O8 - Extra context menu item: Download All with NetTransport - C:\Program Files\Xi\NetTransport 2\NTAddList.html  O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll  O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)  O20 - Winlogon Notify: waxw2k - C:\WINDOWS\SYSTEM32\waxw2k.dll  O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe  O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe  O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe  O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe  O23 - Service: Protocol IP V4 RunTime - Unknown owner - C:\WINDOWS\System32\SVCIPV4.EXE (file missing)  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe  O23 - Service: WlanCfg launch service (Wlancfg) - Inventel - C:\Program Files\Inventel\Gateway\wlancfg.exe  O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

balltrap34 · Answer

Can you analyze this file
C:\WINDOWS\System32\SVCIPV4.EXE
23 antivirus editor
http://www.virustotal.com/xhtml/virustotal_en.html
click on browse, locate the file and click on send, wait for the report
and give us the
--
hunting and shooting are my real passion
see personal site in profile

robespierre24 · Answer

Hi,I'm back....Well, I still have this problem:Every internet access causes applications to crash: IE, Outlook when a message contains .html, WMP, etc...I wanted to scan SVCIPV4.EXE but I can't find it in system32I conducted an automatic search: nothing.Furthermore, I'm using an old Netscape Navigator since IE crashes and it can't display the page:http://www.virustotal.com/xhtml/virustotal_en.htmlI'm stuck and overwhelmed.Thank you for your help..

balltrap34 · Answer

download: process xp here:
http://www.sysinternals.com/files/procexpnt.zip
unzip it

log out
close all programs

double click on processxp.exe

* In the main window of processxp double click on winlogon.exe
In the new window that opens click on threads
select only the lines that contain waxw2k.dll then click on kill for each found line.
once done, confirm with ok

* In the main window of processxp double click on explorer.exe
In the new window that opens click on threads
select only the lines that contain waxw2k.dll then click on kill for each found line.
once done, confirm with ok

► restart hijack check these lines and then click on fix
O20 - Winlogon Notify: waxw2k - C:\WINDOWS\SYSTEM32\waxw2k.dll

****************************************************************
►
****************************************************************
► restart in safe mode

safe mode for this tap the f8 key
as soon as the computer starts without stopping
a window will open, move with the arrow keys on start in safe mode
once on the desktop there won’t be all the colors and others, it’s normal. if f8 doesn't work use the f5 key
****************************************************************
► search and delete this
C:\WINDOWS\SYSTEM32\waxw2k.dll

--
hunting and shooting are my true passion
see personal site in profile

robespierre24 · Answer

Thank you! Everything works, I followed it step by step: perfect! ;-))  Thanks again.  And now to avoid this: Avast or Antivir? Which software to control Trojans and worms?  Philippe Mallard

balltrap34 · Answer

content for you for personal antivirus I use Bit Defender and I have never used the ones you mentioned -- hunting and trap shooting my true passion see personal site in profile

Error iexplorer and msimn

10 réponses

How to get the character µ on the android keyboard.

Texture issues in enshrouded

Access issue to my "contact me" profile

Windows spotlight is not working.

My tv turns off and then on again repeatedly?

Executable from a python file

Pay in 4 installments cdiscount

The alt gr key is not working on my keyboard.

Code 80072efe how to get windows update working again

Video in ".3gp" format