"white box- close" popping up

[2cautious]

Recently upgraded from freeserve dial-up to tiscali b. band and since then I get a white box with just the word "close" in it. On clicking on this , usually just the box goes , but sometimes the box and the site i`m looking at disappears. (box has just appeared as I`m typing this! ---clicked on "close" and its gone) I am told that some of freeserve has not been fully uninstalled , is this the problem and if so how do I rectify the situation.
Win ME IE 7
Thank you
2

 

[2cautious]

Er, nobody got any ideas , it`s now seriously getting on the old nerves!( bit like crooked wallpaper!)

Thanks

2

 

[TonyWarrington]

In Internet Explorer check that you have disabled Dial up.

Goto Tools / Internet Options / Connections. Is there anything showing in the Dial up and Virtual Private Network box? If there is then you can either select "Never Dial a Connection" or if you have no need for dial up highlight the connection and delete

 

[2cautious]

Tony

Boxes are "empty" (white) The Never Dial a Connection button is showing-but the whole section ( and button) is greyed-out . Clicked on Lan Settings and the Automatically Detect Settings is ticked! Should this be so? only use this one PC in one location/ room , all use very basic.

Thanks

2

 

[TonyWarrington]

Boxes are "empty" (white) The Never Dial a Connection button is showing-but the whole section ( and button) is greyed-out

That sounds correct - you do not have a dial up connection enabled for IE. My first thoughts were that the white box you see could be an attempt by your system to dial out using the old connection. Have you looked to see if the old connection still exists in Dial-Up Networking - think you will find this in Control Panel

Clicked on Lan Settings and the Automatically Detect Settings is ticked! Should this be so? only use this one PC in one location/ room , all use very basic.

It may be correct but you should check with your ISP for their recommended LAN settings - in my case ISP (Orange) states that Automatically Detect settings should be clear.

It is possible that remnants of freeserve still remain. It has been a long time since I used Freeserve dial up. From memory the installation CD put some shortcuts on the desktop, changed the start page in IE and automatically configured the Dial up connection.
How did you uninstall Freeserve prior to Tiscali upgrade?

I noticed that you are using Windows ME and you state IE7. Are you sure that this is correct as I understand that IE7 needs XP service pack 2 as minimum ?

 

[2cautious]

Tony
Sorry, am using IE 6. To uninstall went to Settings--Add/remove progs.

Then, Start--Search--Files/folders, typed in Freeserve , then deleted it all and then repeated for Orange.(and AOL - from distant past )

Thank you

2

 

[TonyWarrington]

Are you still getting the box pop up?

 

[Estrella]

I think a HJT log might be handy Tony.

 

[TonyWarrington]

I think a HJT log might be handy Tony.

Very good idea. I was also thinking that if and when the "box" appears bring up Task Manager to see what is running - not sure if it would actually identify anything though!

Hijack this can be downloaded from Here

 

[2cautious]

T & B

Just had a go as suggested, ctrl+alt+del pressed--ZILCH no flicker on screen or any response . Bet this is now ringing bells! ( or getting you both drinking the Bells!! )

I run and update at each PC use session -- avast anti virus- spyware blaster-spybot.

Again thank you for your time/effort.

2

 

[TonyWarrington]

Bet this is now ringing bells!

Er, yes it is - think it rang BoxCleva before mine as he suggested Hijack This log.

I posted a link in to Hijack This (last post), I suggest downloading and running the program taking the option to scan and save log file. The log file will open in Notepad and you can copy and paste results so we can see what is running on your system.

Prior to that you may wish to download and run something like SuperAnti Spyware from Here. . The basic program is free and IMO pretty good at eradicating the bad stuff! Best if after you have downloaded you run it in Safe Mode and follow the recommendations for removal of unwanted progs.

 

[2cautious]

Tony

Used Super Anti Spyware (full scan )--"no problems"

Here is result of "Hijack"

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:19:20, on 02/12/2008
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPERLITE\DKSERVICE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\E_S6I0C1.EXE
C:\PROGRAM FILES\FILSECLAB\XFILTER\XFILTER.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
C:\WINDOWS\SYSTEM\E_S6I0C1.EXE
C:\SIERRACHART\DATA\DS CLOCK\DSCLOCK.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\ROCKET SOFTWARE\ROCKETTIME\ROCKETTIME.EXE
C:\PROGRAM FILES\COMMON FILES\FILSECLAB\FILMSG.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\TREND MICRO\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.co.uk/iesearch/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.metoffice.gov.uk/weather/uk/nw/chester_forecast_weather.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\PROGRAM FILES\EPSON\EPSON WEB-TO-PAGE\EPSON WEB-TO-PAGE.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_13\bin\ssv.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\PROGRAM FILES\EPSON\EPSON WEB-TO-PAGE\EPSON WEB-TO-PAGE.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YT.DLL
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [3DLabsHelperDemon] 3dldemon.exe nowakeup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OWCCardbusTray] ocbtray.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\SYSTEM\E_S6I0C1.EXE /P26 "EPSON Stylus DX3800 Series" /O7 "EPUSB1:" /M "Stylus DX3800"
O4 - HKLM\..\Run: [XFILTER] C:\PROGRAM FILES\FILSECLAB\XFILTER\XFILTER.EXE
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
O4 - HKLM\..\Run: [CriticalUpdate] C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\DiskeeperLite\DkService.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\SYSTEM\E_S6I0C1.EXE /P26 "EPSON Stylus DX3800 Series" /M "Stylus DX3800" /EF "HKCU"
O4 - HKCU\..\Run: [DS Clock] "C:\SIERRACHART\DATA\DS CLOCK\DSCLOCK.EXE"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE
O4 - HKUS\.DEFAULT\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\SYSTEM\E_S6I0C1.EXE /P26 "EPSON Stylus DX3800 Series" /M "Stylus DX3800" /EF "HKCU" (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [DS Clock] "C:\SIERRACHART\DATA\DS CLOCK\DSCLOCK.EXE" (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [SUPERAntiSpyware] C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE (User 'Default user')
O4 - .DEFAULT Startup: Rocket.Time.lnk = C:\Program Files\Rocket Software\RocketTime\RocketTime.exe (User 'Default user')
O4 - .DEFAULT Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe (User 'Default user')
O4 - .DEFAULT Startup: Filseclab Messenger.lnk = C:\Program Files\Common Files\Filseclab\FilMsg.exe (User 'Default user')
O4 - .DEFAULT Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (User 'Default user')
O4 - Startup: Rocket.Time.lnk = C:\Program Files\Rocket Software\RocketTime\RocketTime.exe
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O4 - Startup: Filseclab Messenger.lnk = C:\Program Files\Common Files\Filseclab\FilMsg.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_13\BIN\SSV.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRAM FILES\JAVA\JRE1.5.0_13\BIN\SSV.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: cpgSwap -
O16 - DPF: cpgOther -
O16 - DPF: cPageFaults -
O16 - DPF: cInstanceFaults -
O16 - DPF: cPageIns -
O16 - DPF: cPageOuts -
O16 - DPF: cDiscards -
O16 - DPF: cpgSwapfile -
O16 - DPF: cpgSwapfileInUse -
O16 - DPF: cpgSwapfileDefective -
O16 - DPF: cpgDiskcache -
O16 - DPF: cpgDiskcacheMin -
O16 - DPF: cpgDiskcacheMac -
O16 - DPF: cpgDiskcacheMid -
O16 - DPF: cpgSharedPages -
O16 - DPF: cpgCommit -
O16 - DPF: cpgLockedNoncache -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O20 - Winlogon Notify: !SASWinLogon - C:\PROGRAM FILES\SUPERANTISPYWARE\SASWINLO.DLL
O24 - Desktop Component 0: (no name) - http://www.timezoneconverter.com/images/tzc2/bg.gif

--
End of file - 8931 bytes

I can see some refs. to Freeserve and other items I no longer use ie, one being Win Patrol.

Thanks

2

 

[TonyWarrington]

Looking at the HJT log IMO nothing stands out as being too out of place, although a couple of items caught my attention:

1. Firewall, what do you use? There are entries for Zone Alarm and Filesclab. You should only use one! Make sure that you have uninstalled completely one or the other.

2. In C:\WINDOWS\SYSTEM\KERNEL32.DLL, MSTASK.EXE, RUNDLL32.EXE and WMIEXE.EXE.
I am not sure about this with Windows Me, but I would have expected to find these files in the System32 folder (at least with XP) not in System folder. You may want to check that these files are kosher and in the correct folders for Windows Me, as it is possible that files are named similar to MS applications when they are in fact malware.


As Superantispyware found no problems my main concern is not being able to open Task Manager. I believe that this should be addressed before worrying about the pop up box. Something has "messed up" your Windows Me install and while you can fiddle about to try and find a fix perhaps you should consider reinstall or repair.

From memory Windows Me has a System Restore feature - consider restoring to an earlier time.

If the "white box" issue still remains after repair or restore then have a look at:

Spybot may help in locating the rogue "white box". There is an option to disable start up items- go through each start up item and disable all but those you are sure you need or believe to be essential.

Using Add/remove in control panel remove any programs you do not use

 

[Estrella]

OMG!!! How many startup entries do you have there fella!!

Do you have switch it on the night before you want to use it ?

A lot of those 04 entries can be stopped.

I'll not step on Tony's toes, and there isn't an obvious culprit for the pop up in that list. However I concur that you should get your security in order. From that list , it would appear that you have :
SAS
Winpatrol
Zone Alarm
Avast
Fileslab

Personally I would have 1 AV and 1 FW - and an do an occasional online scan for malware. I think all the residents you have are a little OTT.

 

[Igorian]

I hate to sound defeatist, but this is a Windows ME system, which is prone to error.

How long since the O/S has been reloaded?

Move all your docs to some safe external storage.
Reinstall ME (if you must), with all the apps. Take an image of the HD.
Put your data back.

It'll make the next fix so much quicker