Re: ddraw.dll error followed by iexplore closedown

Hi Jan :-)

Sorry about the delayed reply.

The good news is that in safe mode SpyBot found a (red) Virus problem and
fixed it. I also repaired IE6 with AVG and firewall disabled. I also
downloaded/installed/ran PocketKillbox, About Buster, BHO Demon. I then came
out of safe mode and ran all my usual protect programs (CCleaner,
CWShredder,AdAwareSE,Spyware Blaster, SpyBot again, PC Bug Doctor). Clean
bill of health. I then ran IE for 90 minutes and it worked like a dream.

So many, many thanks for all your help. I have printed out your replies in
case I need to go further with HiJackThis etc in the future. I spent 2 hours
reading stuff on both the forums suggested - AumHa and Bleeping Computer.
Most interesting.

Three small questions.
1. My system is permanently set to "show all files" incl hidden. Do I need
to change this?
2. SpyBot. I use the Default rather than the Advanced setting. Is that OK?
3. The MS Antispyware Program (Beta) does not say that it can be run on
Win98SE. Presume I was right to ignore it?

Thanks again.

Flusters :-)

"Jan Il" <abuse@xxxxxxxxxxxxx> wrote in message
news:e13zIsMVFHA.3544@xxxxxxxxxxxxxxxxxxxxxxx
> Hi flusters :-)
>
> Win 98:
>
> Pocket Killbox: Scroll down to Killbox here: 95-XP
> http://forums.subratam.org/index.php?showtopic=2681
>
> BHODemon: Read the information at this download site:
> http://www.majorgeeks.com/download3550.html
>
> HiJackThis - Yes, it is safe for Win98 - XP
>
> In spite of the fact that you may have already run SpyBot, AdAware, AVG or
> others, it is very important that you run them again in Safe Mode
according
> to the instructions. Running them in Safe Mode will insure that some
> malware and pests cannot use files that are being used by Windows to keep
> from being detected or removed. Perform all the scanning and removal
steps
> as outlined, as there are some variants that can replicate themselves
> repeatedly if not removed properly. Please follow all the instructions
> carefully:
>
> Hope this helps :-)
>
> Jan :)
> MS MVP - IE/OE
> Smiles are meant to be shared,
> that's why they're so contagious.
>
> Replies are posted only to the newsgroup for the benefit or other readers.
> How to make a good newsgroup post:
> http://www.dts-l.org/goodpost.htm
>
>
> > Hi Jan :-)
> >
> > Wow. Thanks so much. I will work through your suggestions in order.
> >
> > Incidentally, I run AVG permanently, also with a daily full test and an
> > automatic check for daily updates. Zone Alarms and Spyware Blaster are
> > also
> > running and kept updated. The following are run at least twice a week
and
> > are kept updated:-
> > SpyBot, AdAwareSE, CCleaner, CW Shredder, PCBug Doctor.
> >
> > However, stupidly, I realise that I have not disabled AVG and ZA when
> > repairing IE6. In addition, I have repaired it from Settings>Control
> > Panel>Add/Remove Programs>MSIE6SP1 and Internet Tools>Repair IE. Will
> > follow
> > your suggestion to the letter - also with the reinstallation of DirectX
9.
> > This ie my stupidity, could be the cause of the problem.
> >
> > Presume BHO Demon, PocketKillbox and HiJackThis will all run with
Win98SE
> > and not cause conflicts with any of my existing programs.
> >
> > Really appreciate your guidance and help.
> >
> > Flusters:-)
> >
> >
> > "Jan Il" <abuse@xxxxxxxxxxxxx> wrote in message
> > news:uP7xH9KVFHA.544@xxxxxxxxxxxxxxxxxxxxxxx
> >> Hi flusters :-)
> >>
> >> It is possible that this file has become corrupted and needs to be
> > replaced.
> >> Try reinstalling the DirectX, if possible. See the information here:
> >> http://www.computerhope.com/directx.htm#a10
> >>
> >> also...
> >>
> >> How to Repair Windows 98
> >>
> >> Be sure that your AV and firewall is disabled before starting:
> >>
> >> The Internet Explorer Repair Tool
> >> http://inetexplorer.mvps.org/answers_5.htm#repair_tool
> >> or
> >> Quick Repairs for Windows 98
> >> http://www.mvps.org/serenitymacros/repair.html
> >>
> >> and....
> >>
> >> If you have not already done so, then you might try a repair of IE6 as
> >> follows:
> >>
> >
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1
> >> or
> >> http://snipurl.com/6s3r
> >>
> >> It is also possible that you have scumware on your system that can
cause
> >> this problem. In addition to updating and running your AV, download,
> > install
> >> and run the programs below in Safe Mode with Hidden Files enabled.
This
> >> will remove the nasty you have and any others it may have let in the
back
> >> door. Some malware can replicate itself repeatedly if not removed
> > properly,
> >> so run them again according to the information below so that Windows is
> > not
> >> operating to hide any files 'in use' Follow all instructions
carefully:
> >>
> >> First, Clear the TIF's and empty the recycle bin:
> >> http://www.mvps.org/winhelp2002/delcache.htm
> >>
> >> Also?empty your Recycle bin.
> >>
> >> Then do the following:
> >>
> >> WARNING>>>> Backup all documents and files before removing any
spyware!!
> >>
> >> How to properly scan for scumware (read first, if possible)
> >> http://aumha.org/forum/viewtopic.php?t=5878
> >>
> >> Download and install BHODemon from
> >> http://www.definitivesolutions.com/bhodemon.htm
> >> Your problem may be caused by a bad BHO.
> >>
> >> Most importantly, download install and run CWShredder here
> >> http://www.majorgeeks.com/download3019.html
> >> and About Buster, which searches for hidden .dlls that recreate the
> > malware.
> >> http://www.majorgeeks.com/download4289.html
> >> Then visit these two sites to test for parasites and help basic
cleaning:
> >> On-Line Check
> >> http://aumha.org/a/noads.htm
> >> and
> >> Quick-Fix Protocol.
> >> http://aumha.org/a/quickfix.php
> >> Basically, throw everything here at your "infection".
> >>
> >> Then download, install and immediately update these three programs
before
> >> running:
> >> AdAware SE - Update immediately after installing
> >>
> >
http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button
> >> AdAware Tutorial -
> >> http://www.bleepingcomputer.com/forums/index.php?showtutorial=48
> >> SpyBot S &D - Update immediately after installing
> >> http://www.majorgeeks.com/download2471.html
> >> SpyBot S&D Tutorial -
> >> http://www.bleepingcomputer.com/forums/index.php?showtutorial=43
> >> Microsoft Windows Antispyware Program (Beta)
> >> http://www.microsoft.com/athome/security/spyware/software/default.mspx
> >>
> >> Also download, install and run CWShredder:
> >>
> >
http://www.majorgeeks.com/downloadget.php?id=3019&file=11&evp=9e0433de9f8fd8e137fd6b3ff02edc90
> >>
> >> Next, do an Online scan here (if possible) -
> >> http://www.pandasoftware.com/activescan/com/activescan_principal.htm
> >> Make sure that you choose "fix" or "clean".
> >>
> >> Download PocketKkillbox from
> >> http://www.thespykiller.co.uk/files/killbox.exe
> >> and put it on the desktop where you can find it easily
> >>
> >> Download, install, and run HiJackThis - it is one of the most important
> >> tools to help clean your system of scumware. Follow the instructions
> >> carefully:
> >>
> >> How to download and install HiJackThis: (it does not need to be
updated)
> >> http://www.bleepingcomputer.com/forums/topict309.html
> >>
> >> Please DO NOT post your log to this newsgroup. It is important that
you
> > go
> >> to one of the HiJackThis Support Forums below and allow the experts
> >> there
> >> to analyze it for you.
> >> AumHa HiJackThis Forum
> >> http://forum.aumha.org/viewforum.php?f=30
> >> or Bleeping Computer Forum
> >> http://www.bleepingcomputer.com/forums/forum22.html
> >> to allow the experts there to evaluate your log and advise you of any
> >> necessary steps to clean your system.
> >> (Note: You will have to Register before posting on these Forums.
Please
> >> follow all posting instructions carefully to avoid having your log
> >> deleted
> >> or ignored.)
> >>
> >> Also, please post a link to the forum where you post your HJT log back
to
> >> this thread so that we can follow your progress there.
> >>
> >> CAUTION!!!!! Before you try to remove spyware using any of the
programs
> >> below, download a copy of LSPFIX from any of the following sites:
> >> http://www.cexx.org/lspfix.htm
> >> http://www.spychecker.com/program/winsockxpfix.html
> >> (if your OS is Win2k or XP) The process of removing certain malware may
> > kill
> >> your internet connection. If this should occur, this program, LSPFIX,
> >> will
> >> enable you to regain your connection.
> >>
> >> You should also get a copy of WINSOCKXPFIX available at:
> >> http://www.spychecker.com/program/winsockxpfix.html
> >> and
> >> WinsockXP Fix- WinXP
> >> http://www.spychecker.com/program/winsockxpfix.html
> >> with instructions, at
> >> http://www.iup.edu/house/resnet/winfix.shtm
> >> also... From LavaSoft- all versions of Windows-
> >> http://digital-solutions.co.uk/lavasoft/whndnfix.zip
> >> (NOTE: It is reported that in XP SP2, the command netsh winsock reset
> >> will fix this problem without the need for these programs.)
> >> or Winsock Fix Utility
> >> http://www.dfwonline.net/files/WinsockFix.zip
> >>
> >> How to Restart in Safe Mode
> >>
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
> >>
> >> How to Show Hidden Files
> >> http://snipurl.com/6rl8
> >>
> >> Hope this helps :-)
> >>
> >> Jan :)
> >> MS MVP - IE/OE
> >> Smiles are meant to be shared,
> >> that's why they're so contagious.
> >>
> >> Replies are posted only to the newsgroup for the benefit or other
> >> readers.
> >> How to make a good newsgroup post:
> >> http://www.dts-l.org/goodpost.htm
> >>
> >>
> >> > Hi Jan :-)
> >> >
> >> > Unfortunately it does not appear to be the answer as I am running
> > DirectX
> >> > 9.0c. But thanks anyway for the idea.
> >> >
> >> > Flusters :-)
> >> >
> >> > "Jan Il" <abuse@xxxxxxxxxxxxx> wrote in message
> >> > news:uvo%23xSJVFHA.928@xxxxxxxxxxxxxxxxxxxxxxx
> >> >> Hi flusters :-)
> >> >>
> >> >> Check the information here and see if it helps:
> >> >>
> >> >> Ddraw.dll May Cause an Error Message
> >> >> http://www.kbalertz.com/kb_Q317814.aspx
> >> >>
> >> >> Hope this helps :-)
> >> >>
> >> >> Jan :)
> >> >> MS MVP - IE/OE
> >> >> Smiles are meant to be shared,
> >> >> that's why they're so contagious.
> >> >>
> >> >> Replies are posted only to the newsgroup for the benefit or other
> >> >> readers.
> >> >> How to make a good newsgroup post:
> >> >> http://www.dts-l.org/goodpost.htm
> >> >>
> >> >>
> >> >> > Can anyone help me please? I am running Win98SE and IE6 without
> > problem
> >> >> > until past 24 hours.
> >> >> >
> >> >> > When running IE6, I receive message popup saying MS error. This
> >> >> > error
> >> >> > report
> >> >> > sent to MS says it occurs in "iexplore.exe ddraw.dll 6.0.2800.1106
> >> >> > mod.ver.
> >> >> > 4.9.0.904 offset:0002d3fa".
> >> >> > I send the error report and this is followed by another close
> >> >> > down/error
> >> >> > message as follows:
> >> >> >
> >> >> > "IEXPLORE executed an invalid instruction in
> >> >> > module <unknown> at 0000:83a7a2e0.
> >> >> > Registers:
> >> >> > EAX=000000b7 CS=00bf EIP=83a7a2e0 EFLGS=00010206
> >> >> > EBX=80a0169c SS=00b7 ESP=80a01690 EBP=80a0169c
> >> >> > ECX=206f06bc DS=00b7 ESI=809f3850 FS=4e1f
> >> >> > EDX=000083a7 ES=00b7 EDI=83a7a2e0 GS=0000
> >> >> > Bytes at CS:EIP:
> >> >> > ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
> >> >> > Stack dump:
> >> >> > 809876ba 809f3850 206f06bc 00000000 0000cde6 0c5f0016 00000000
> > 00200040
> >> >> > 00000000 0000001e 00000001 0000524c 00000004 00800000 32534753
> >> >> > 00000040"
> >> >> >
> >> >> > This has happened four times in 24 hours. Each time, I have
repaired
> >> >> > IE6
> >> >> > and
> >> >> > restarted.
> >> >> >
> >> >> > Any ideas on the solution?
> >> >> >
> >> >> > Thanks
> >> >> >
> >> >> > Flusters
> >> >> >
> >> >> >
> >> >> >
> >> >>
> >> >
> >> >
> >>
> >
> >
>


.