Re: OE6 hangs in NewPost or Reply screens sporadically

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: jt3 (jt3_at_cranky.computer)
Date: 08/18/04 

Date: Wed, 18 Aug 2004 11:22:09 -0700

For anyone interested in the subject of this thread:
    The culprit *seems* to be Nero's InCD UDF packet writing utility which
was autoloaded in the \Run key. Apparently, it caused the problem most
often, but not only, when a UDF CD was in the drive, though not in use
explicitly. It seems to sporadically hang Explorer, so it could be that OE
uses Explorer and thus the connection.
    The version is 3.51.61 (part of an upgrade to Nero 5.5). May be due to
interaction with a CD-R drive on the machine which it apparantly believes is
a CD-RW.

Joe
"jt3" <jt3@cranky.computer> wrote in message
news:%23M%23%23s9AfEHA.1208@TK2MSFTNGP10.phx.gbl...
> PABear;
> Sorry I didn't see your explanation of why and what regarding the new
> Identity before I last posted. I did try a new identity, but it will be
> some time before I know for sure that there is no problem since it is not
> that regular an occurrence. In fact, it hasn't recurred in the last 3
days,
> but it's done that before.
> I believe I have done everything else you mentioned. The virus scan
> found no viruses (EZ Armor) and I scanned the second partition as well as
> the C:\. It was a full scan, done in real mode.
> I ran still another HJT scan (though this time I hadn't been able to
> update it beforehand, since every time I attempted, it could not log on to
> the server, both sites. This was about 5 times, some about 3 hours apart.
> I will try again, of course, but it was probably not very far out of date
> since I had done it just a few days before, no more than a week. Again, I
> found no hint of anything for which I could not easily account. However,
> you seemed to feel that I was questioning your assistance, which I hasten
to
> assure you, I am not, and so I posted the latest one to:
> http://forums.spywareinfo.com/index.php?showtopic=20104
> I just did this a few minutes ago, so it will no doubt be some time before
> anyone picks up the thread.
>
> Thank you,
> Joe
> "PA Bear" <PABear@mvps.org> wrote in message
> news:eYBL3xeeEHA.2852@tk2msftngp13.phx.gbl...
> > When you delete Temporary Internet files, do you accept the prompt to
> delete
> > all offline content?
> >
> > Did you try a new Named Identity?
> >
> > Do you update Ad-aware and Spybot (v1.3) before each and every use?
> >
> > Did you post your HT log to a forum to let others take a look at it?
URL
> of
> > your thread, please?
> >
> > Reinstalling IE/OE won't help a bit if Windows itself is infected with
> > malware.
> > --
> > HTH - Please Reply to This Thread
> >
> > ~Robear Dyer (PA Bear)
> > MS MVP-Windows (IE/OE), AH-VSOP
> >
> > AumHa Forums
> > http://forum.aumha.org
> >
> > What You Should Know About Spyware
> > http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx
> >
> > jt3 wrote:
> > > Thought I had mentioned all the stuff in the OP, but I notice that
I
> > > assumed you'd infer the use of the CA EZArmor AV program since I was
> using
> > > the EZArmor FW, but I suppose that's not a given. Anyhow, do, did,
> update
> > > all of it, usually do an AAware scan as well as SBS&D immediately
after
> > > visiting any web sites on any given day. That includes checking for
> > > updates each time I run them. Don't use McAfee (did years ago), have
> the
> > > e-mail checking part of EZArmor turned off.
> > > Don't usually run CWShredder unless I have some cause to wonder,
> though
> > > I did it last night just to be certain.
> > > Just did HJT just before I posted the OP this afternoon.
> > > Have never come up with anything but tracking cookies (which I
always
> > > delete), the standard Alexa object which I don't do anything about
since
> I
> > > don't have the toolbar, and the About: blank 'potential hijack'
> references
> > > in AAwe which are *not* hijacks (simply the default page that I prefer
> to
> > > use as my starting page in IE; I don't have to go online at that
point,
> > > that way).
> > > I'm on dial-up so it's fairly easy to tell if something on your
> machine
> > > wants to get out--in addition to the EZArmor FW blocking non-permitted
> > > objects trying to get out. That's why I've been checking the FW logs
to
> > > try to find out if anything were trying to. Predominantly, they're
all
> > > incoming or 'routed' (which is why I asked that question in the
original
> > > post). SBS&D shows a number of tracks, some of which I chose to
> > > eliminate, but only those I felt I'd have no need of.
> > > Nearly everything in the HiJackThis report is readily attributable
to
> > > things that ought to be there, as I said before, with the possible
> > > exception of one nameless BHO, the registry key of which pointed to a
MS
> > > .ocx file. More especially, such things don't happen with IE (I listed
> > > those posts because they were the closest I could find with OE
search),
> > > and with continual monitoring of the outbound traffic by EZArmor FW,
> > > which I have set to ask permission, as well as the fact that I also
run
> > > WinTop continually to monitor what's running, it's hard to see where
the
> > > malware can be. I was given the machine last Christmas, cold
turkey,
> > > with my brother's comment that he hadn't been able to make W98 work on
> > > the machine (he had a version of Linux on it). From the W98SE
> > > installation in February, I've been thrashing this thing one way or
> > > another ever since, and still have very little installed on it. This
> > > last thing has been bugging me over two months, and while I have found
> > > little things that help, here and there (replaced the power supply!
and
> > > it *did* reduce it a little bit, I think--mostly it improved the
> > > stability of the OS in general). I haven't yet reinstalled IE/OE
since
> > > that sounds a bit grim. The CA people had me reinstall EZArmor, and
> that
> > > did help, but didn't eliminate this. Apparently the original file
(from
> > > the MS distributed disk) was somehow corrupt which caused the FW to
lock
> > > the machine randomly, which may have masked this problem. It seems
that
> > > there must have been a number of small things wrong initially, and
> > > presented as a matrix of symptoms which confuse the issue. It now
> *seems*
> > > to be down to the last one, or at least last until I install something
> > > new. I think I have previously covered the territory you mentioned
> > > with the exceptions of Stinger (don't know what it does, yet) and I
have
> > > not used the Symantec tools you mentioned, though I did use Trend
> Micro's
> > > tools earlier (I had purchased their Internet Security 2003--only
> changed
> > > over to the CA product when the Secy Upd came in the mail, and
everyone
> > > in the W98 NG had praised it so much; I do like it better, but mostly
> > > because of its configurability and the blocking of outgoing traffic.)
> > > Never would accept an idiotic choice like hide file extensions.
> > > This one is 98, not XP. (One of my other machines is, and that's
> > > another story--do not like PnP, it's crazy to have to figure out ways
to
> > > outwit your OS just to get your hardware to install.) Anyhow, since
I'm
> > > not sure what your agenda is in these last recommendations, I'll try
> them
> > > and see what happens. My wife hasn't turfed me out yet for the time I
> > > spend on this thing, so maybe she won't for a while longer.
> > > The bit about Windows update reminds me--I apparently lied when I
> said
> > > I'm down to the last problem. I forgot about the way the modem goes
> > > off-line whenever there's a large barrage of blocked requests
(generally
> > > incoming, according to the FW log). Happened last night when I was
> trying
> > > to get WUpdt to load--it would make it up to 33%, sometimes 66%, and
> then
> > > I'd get hammered by these requests, and it was almost as if the
firewall
> > > would block them until it got overwhelmed, and then the connection
would
> > > go. This has happened before, most notably when I was at the Merijn
> site,
> > > and the Computer Cops, as well. So, I guess I'll have to keep
dragging
> > > it on. I don't understand how these malefactors can tell you're trying
> to
> > > access a security oriented site, but it seems that way. Seems like
> there
> > > should be something on my machine calling them, but I can't find any
> sign
> > > of it. Sorry to bend your ears back about all of this but, I assure
> > > you, my
> > > wife doesn't want to hear about it!
> > >
> > > Will post back when I've tried the things last mentioned. If you have
> any
> > > further comments--I check post regularly.
> > >
> > > Thanks,
> > > Joe
> > > "PA Bear" <PABear@mvps.org> wrote in message
> > > news:uI36F8beEHA.1652@TK2MSFTNGP10.phx.gbl...
> > > > Have you disabled Background Compacting and do you compact all
folders
> > > > frequently, per http://insideoe.tomsterdam.com/files/maintain.htm?
> > > >
> > > > Have you "Taken Out the Trash" recently, including "Delete all
offline
> > > > content"?
> > > > http://aumha.org/a/health.php#tip6
> > > >
> > > > Are you running McAfee VirusScan? Have you tried disabling it?
> > > >
> > > > Your current Identity may be damaged, especially if its the default
> Main
> > > > Identity. Try one or more of your accounts in a new Named Identity
> > > > (File>Identities>Add new identity). Assuming all is well, import
> > > > messages from the old Identity before deleting it
> > > > (File>Identities>Manage Identities).
> > > >
> > > > Are you having similar problems in IE? Check your system for
> > > > "hijackware" thoroughly:
> > > >
> > > > Help with Hijackware
> > > > http://aumha.org/a/parasite.htm
> > > > http://aumha.org/a/quickfix.htm
> > > > http://mvps.org/winhelp2002/unwanted.htm
> > > > http://inetexplorer.mvps.org/Darnit.htm
> > > >
> > > > CoolWebSearch Chronicles
> > > > http://www.spywareinfo.com/~merijn/cwschronicles.html
> > > >
> > > > Run these tools in the following order with nothing else running in
> > > > background:
> > > >
> > > > 1. CWShredder (fix all found)
> > > >
> > > > 2. Ad-Aware (fix all found)
> > > >
> > > > 3. Spybot (RTFM but generally fix everything in red)
> > > >
> > > > Important: You *must* seek updates for Ad-Aware, Spybot, etc.,
before
> > > > each and every use, even "right out of the box". But even they
can't
> > > > catch everything, 24/7. When all else fails, HijackThis
> > > > (http://www.spywareinfo.com/~merijn/files/HijackThis.exe) is the
> > > > preferred tool to use. It will help you to both identify and remove
> any
> > > > hijackware/spyware. **Post your files to
> > > > http://forums.spywareinfo.com/ or
> > > > http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not
> > > > here.**
> > > >
> > > > [Alternate download pages for many of the above tools may be found
at
> > > > http://aumha.org/a/parasite.htm.]
> > > >
> > > > Also:
> > > >
> > > > 1. Download and run Stinger (http://vil.nai.com/vil/stinger/);
then...
> > > >
> > > > 2. Update your virus definitions, enable Show Hidden Files
> > > >
> > >
>
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339)
> > > > and then run a full system scan in Safe Mode
> > > >
> > >
>
(http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406)
> > > > with nothing else running in background. Note the files identified
> and
> > > > removed then find the corresponding page for the file at your AV
> maker's
> > > > online support pages (e.g.,
> > > >
> > >
>
http://securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html)
> > > > and follow all Removal steps.
> > > >
> > > > WinXP Only (WinME similar): If this scan finds anything, create a
new
> > > > Restore Point then Disk Cleanup > More options > Delete all but the
> most
> > > > recent Restore Point.
> > > >
> > > > 3. Check in at Windows Update.
> > > >
> > > > So How Did I Get Infected Anyway?
> > > > http://boards.cexx.org/viewtopic.php?t=957
> > > > --
> > > > HTH - Please Reply to This Thread
> > > >
> > > > ~Robear Dyer (PA Bear)
> > > > MS MVP-Windows (IE/OE), AH-VSOP
> > > >
> > > > AumHa Forums
> > > > http://forum.aumha.org
> > > >
> > > > What You Should Know About Spyware
> > > > http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx
> > > >
> > > >
> > > > jt3 wrote:
> > > > > The problem I have is that OE will randomly lockup in the
process
> > > > > of typing out some response or an original post--only in that
> > > > > screen--I have yet to see it happen in the preview pane. This is
> > > > > generally a Vulcan-proof hang-only the reset button will get me
> going
> > > > > again. When it does boot, the wierd part is that ScanDisk never
> > > > > runs--just starts as a normal boot. I'm sure that the post is
being
> > > > > written in some buffer file somewhere (though I haven't been able
to
> > > > > find its remnants yet), but apparently the dirty flag never gets
> set.
> > > > > This and the pattern of occurrence is leading me to wonder if it
has
> > > > > something to do with some kind of buffer flag. The only pattern,
> > > > > other than what I have already mentioned, is that it seems to
occur
> > > > > just before something is blocked by the FW (though not always--it
> has
> > > > > even done it when offline) since there is usually a log of
something
> > > > > having been blocked at that time. It doesn't seem to be
correlated
> > > > > with background activity such as downloading. If it is possibly
due
> > > > > to the display (distinctly possible since we've noticed that when
it
> > > > > hangs, the last raster of the entered characters is often missing)
I
> > > > > have a problem since this is the most up-to-date driver offered by
> > > > > ATi (Rage 128) for this card (and I have tried some of the older
> ones
> > > > > as well. Also of note is that when it hangs, if one notices
before
> > > > > entering any more strokes, and clicks on the close button, one
> > > > > gets an 'error' ding. But not a second time. I should mention
that
> I
> > > > > regularly use AAwe, SBS&D, have just used both CWShrdr & HJT and
> > > > > found nothing of any note--everything any of them finds is
something
> > > > > accountable for in the OS (W98SE) or in the relatively few
> > > > > applications installed on the machine. The firewall is the
version
> > > > > used in CA EZArmor, the free version. By the way, when the log
for
> > > > > the FW says direction is 'routed' for some importuning net
> source,
> > > > > how is that different from any other inbound attempt? There is no
> > > > > consistency in occurrence, as it may happen 4 times in 15 minutes,
> or
> > > > > not once all day. Except that it seems to happen much more
often
> > > > > on a day in which the FW has to block many attacks. The only
> possibly
> > > > > similar-problem posts I have found are:
> > > > > <uOAZjbxWEHA.2176@TK2MSFTNGP11.phx.gbl>
> > > > > <#Y1y02yWEHA.1128@TK2MSFTNGP10.phx.gbl>
> > > > > <u8LQN44WEHA.3944@tk2msftngp13.phx.gbl>
> > > > > <#pXnXb6WEHA.3944@tk2msftngp13.phx.gbl>
> > > > > <#To9qQHXEHA.4000@TK2MSFTNGP09.phx.gbl>
> > > > > <OB6U4LJXEHA.2408@tk2msftngp13.phx.gbl>. BTW, is there any way to
> get
> > > > > the rebarbative search function that comes with OE to find
> references
> > > > > such as this without typing them into a post in order to click on
> > > > > them?
> > > > >
> > > > > More than one question, I know, but thanks very much for any help,
> > > > > Joe
> >
>
>

Relevant Pages

  • Re: Deleted Objects
    ... Unless you are using backlinks these will not get updated automatically, ... Joe Richards Microsoft MVP Windows Server Directory Services ... >>references to deleted objects. ...
    (microsoft.public.windows.server.active_directory)
  • Re: DFU functionality in RPG-II?
    ... Sounds GREAT, Joe. ... There are a few "issues" to cover, which we'll deal with offline, and then, presumably, post the final outcome here. ... with source code so that it can be tweaked. ... functionality would need no changes. ...
    (comp.sys.ibm.sys3x.misc)
  • Re: services.exe error trying to shutdown cmputer after boot up
    ... They were quarantined by your a/v software, but the references to the ... Click Start, Run, type REGEDIT, click OK. ... change the filename and repeat till all references are found. ... Hello Joe, none of the files names were found searching regedit. ...
    (microsoft.public.windowsxp.general)
  • Re: Attention 110mb.com users.
    ... wtwjgc (Joe) wrote: ... Online or Offline. ... their site for obvious reasons. ...
    (uk.people.silversurfers)
  • Re: Short-lived TV shows that still became pop culture icons
    ... later life. ... watched them grew up and began shaping pop culture themselves. ... became iconic in the early part of this decade, as references to ... Joe is especially illuminating--the pop culture view of Joe is ...
    (rec.arts.tv)