Member Avatar for michael_mertz

I have a feeling this one will challenge you senior techies out there bigtime -- about 2 weeks ago my IBM T21 just started spinning the hard drive CONSTANTLY whenever I would visit Yahoo sites (my mail server, for one thing) using IE6. Most all else works fine, except whenever I'm on Yahoo, the hard disc starts to grind away and it takes 5 - 30 minutes just to bring up a page, or to bring up the task manager.

About the same time this started I noticed I couldn't run Netscape 7 OR run my Norton/Symantec AntiVirus. I downloaded Ad-aware, Advanced System Optimizer, defragged the hard drive, defragged the system registry, etc. This fixed some problems with bootup times -- but IE still hosed on Yahoo. Went to Microsoft and downloaded every conceivable patch for IE6. Nothing. Loaded IE5.5 - same problem. Loaded Netscape6 -- SAME PROBLEM!! Went to the Symantec website and ran all their utilities and everything checks out "stealth". Their virus scan gave me an A+. Problem still there. Ran SpyBot S/D last night - found some stuff, deleted it. (SpyBot even deleted the stuff when I pressed "no" button... hmmmmm). Rebooted -- NO HELP. So Finally I got hold of HijackThis and ran it -- doesn't look unusual to me. Logfile is attached. I'm running IE 6.0.2800.1106.xpsp1.020828-1920 with SP1 and a bunch of Q... patches. Note: I can do most anything with this laptop and it works hunky-dory, including surf NON-Yahoo URL's (occasionally I will find one that hangs slightly, but nowhere near yahoo). And as you might guess IT IS DRIVING ME CRAZY.

Please help.

Logfile of HijackThis v1.97.7
Scan saved at 8:15:26 AM, on 1/10/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\tp4mon.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\SM1BG.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Intuit\QuickBooks Premier - Accountant Edition\Components\QBAgent\qbdagent2002.exe
C:\Program Files\Network Everywhere\Wireless Notebook Adapter\NWP11Cfg.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Ted\Desktop\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Premier - Accountant Edition\Components\QBAgent\qbdagent2002.exe
O4 - Global Startup: Wireless Notebook Adapter Utility.lnk = C:\Program Files\Network Everywhere\Wireless Notebook Adapter\NWP11Cfg.exe
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {544EB377-350A-4295-9BEB-EAB8392E09C6} (MSN Money Charting) - http://fdl.msn.com/public/investor/v13/invinstl.exe
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.napster.com/client/isetup.cab
O16 - DPF: {9CF28A69-7659-4C51-BFD5-9ADE19E19EC3} (RegConfig Class) - http://download.yahoo.com/dl/installs/bkm/prod/yregcfg.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37869.7660069444
O16 - DPF: {AECD14A8-F662-11D1-A395-00805F535788} (Plotwon Control) - http://www.investors.com/member/ocx/plotwon.ocx
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
  • 5 Contributors
  • 7 Replies
  • 220 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by suRoot

Dani AI

Generated

Short, practical addendum that builds on the suggestions from , , and without redoing what you’ve already tried.

The combination of: (a) heavy disk activity only when visiting Yahoo pages, (b) the problem appearing in more than one browser, and (c) odd behaviour from tools like Spybot, strongly suggests a system-level hook (browser helper object, toolbar/ActiveX helper, LSP or a service) or an AV/process repeatedly scanning files when certain content loads. Clear the cache is OK (already suggested) but next do a focused diagnosis so you don’t remove the wrong thing.

Practical diagnostic checklist (in order):

  • Reproduce the slowdown and watch which process is doing the disk I/O. If Task Manager doesn’t show it, use Sysinternals Process Explorer to see per-process I/O and loaded DLLs.

  • Capture file/registry activity for that process with FileMon/RegMon (or Process Monitor) to see what’s being accessed repeatedly.

  • Run Internet Explorer with add-ons disabled to isolate add-ons/BHOs:

    iexplore -extoff

  • Test in a new Windows user profile and in Safe Mode with Networking — if the problem disappears, it’s a startup/profile component.

  • Use Autoruns to inspect and selectively disable browser helper objects, startup items and shell extensions. Check Winsock/LSP entries if network hooks are suspected. Always export/save the registry or create an image before changes.

If the trace points to Yahoo-related helpers or an AV process: uninstall the Yahoo components via Add/Remove Programs and disable their startup entries; temporarily suspend on‑access scanning while diagnosing (but don’t leave it off). If Spybot behaved oddly, run offline/rootkit checks or rescue-media scans before trusting in-place removals.

A couple of cautions: don’t use “Fix All” with HijackThis — backup first and only remove entries you can identify. If targeted removal, offline scans and autoruns tweaks don’t resolve it, a repair install or restoring from a clean image is often faster and safer than chasing an obscure hook.

Recommended Answers

All 7 Replies

Member Avatar for Dani

First of all, moved this post to the Internet Explorer forum. Second of all, could it be a problem with a 3rd-party plugin that both Internet Explorer and Netscape use. For example, Macromedia Flash or Java - which this particular website utilizes? Perhaps the site uses an ActiveX control?

Member Avatar for michael_mertz

could be, that's why I downloaded the IE6 Q... patches. But the question of course is, "why did it just start having a problem...?"

Member Avatar for steamwiz

Hi

Following on cscgal's post.....

Close all browser windows - run hijackthis and tick to fix :-

O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll

O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -

O16 - DPF: {9CF28A69-7659-4C51-BFD5-9ADE19E19EC3} (RegConfig Class) - http://download.yahoo.com/dl/installs/bkm/prod/yregcfg.cab

steam

Member Avatar for michael_mertz

thanks but this didn't help.

Member Avatar for caperjack

i poster your problem & log elsewhere and got this response!

"Corrupted cookie(s) may be ?
Try deleting all cookies and try again."
.

Member Avatar for steamwiz

Hi michael

Delete your temporary internet files as well.

steam

Member Avatar for suRoot

Yup make sure

O16 - DPF: {9CF28A69-7659-4C51-BFD5-9ADE19E19EC3} (RegConfig Class) - http://download.yahoo.com/dl/instal...rod/yregcfg.cab

isn't there any more, delete all cookies, and temp internetfiles, and then up your IE security and then restart visit yahoo and see if it still happens?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.