Re: ddraw.dll error followed by iexplore closedown



Jan Il
07-09-2005, 10:02 PM
Hi flusters :-)

> Hi Jan :-)
>
> Sorry about the delayed reply.
>
> The good news is that in safe mode SpyBot found a (red) Virus problem and
> fixed it. I also repaired IE6 with AVG and firewall disabled. I also
> downloaded/installed/ran PocketKillbox, About Buster, BHO Demon. I then
> came
> out of safe mode and ran all my usual protect programs (CCleaner,
> CWShredder,AdAwareSE,Spyware Blaster, SpyBot again, PC Bug Doctor). Clean
> bill of health. I then ran IE for 90 minutes and it worked like a dream.
>
> So many, many thanks for all your help. I have printed out your replies in
> case I need to go further with HiJackThis etc in the future. I spent 2
> hours
> reading stuff on both the forums suggested - AumHa and Bleeping Computer.
> Most interesting.

You're very welcome. Well done! :-)
>
> Three small questions.
> 1. My system is permanently set to "show all files" incl hidden. Do I need
> to change this?

As long as you are the only one using the machine, I wouldn't worry about
it. But, if there are others who have access to your machine, then I'd
switch it back just to be on the safe side.

> 2. SpyBot. I use the Default rather than the Advanced setting. Is that OK?

Yes.

> 3. The MS Antispyware Program (Beta) does not say that it can be run on
> Win98SE. Presume I was right to ignore it?

No, it is not compatible with Win 98, so you should not use it on your
system:

"System Requirements
Supported Operating Systems: Windows 2000, Windows 2000 Advanced Server,
Windows 2000 Professional Edition , Windows 2000 Server, Windows 2000
Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4,
Windows Server 2003, Windows XP, Windows XP Home Edition , Windows XP Media
Center Edition, Windows XP Professional Edition , Windows XP Service Pack 1,
Windows XP Service Pack 2, Windows XP Tablet PC Edition"

Also see the information here:

Microsoft Windows AntiSpyware (Beta): System requirements
http://www.microsoft.com/athome/security/spyware/software/requirements.mspx

Hope this helps :-)

Jan :)
MS MVP - IE/OE
Smiles are meant to be shared,
that's why they're so contagious.

Replies are posted only to the newsgroup for the benefit or other readers.
How to make a good newsgroup post:
http://www.dts-l.org/goodpost.htm



>
> Thanks again.
>
> Flusters :-)
>
> "Jan Il" <abuse@localhost.com> wrote in message
> news:e13zIsMVFHA.3544@TK2MSFTNGP10.phx.gbl...
>> Hi flusters :-)
>>
>> Win 98:
>>
>> Pocket Killbox: Scroll down to Killbox here: 95-XP
>> http://forums.subratam.org/index.php?showtopic=2681
>>
>> BHODemon: Read the information at this download site:
>> http://www.majorgeeks.com/download3550.html
>>
>> HiJackThis - Yes, it is safe for Win98 - XP
>>
>> In spite of the fact that you may have already run SpyBot, AdAware, AVG
>> or
>> others, it is very important that you run them again in Safe Mode
> according
>> to the instructions. Running them in Safe Mode will insure that some
>> malware and pests cannot use files that are being used by Windows to keep
>> from being detected or removed. Perform all the scanning and removal
> steps
>> as outlined, as there are some variants that can replicate themselves
>> repeatedly if not removed properly. Please follow all the instructions
>> carefully:
>>
>> Hope this helps :-)
>>
>> Jan :)
>> MS MVP - IE/OE
>> Smiles are meant to be shared,
>> that's why they're so contagious.
>>
>> Replies are posted only to the newsgroup for the benefit or other
>> readers.
>> How to make a good newsgroup post:
>> http://www.dts-l.org/goodpost.htm
>>
>>
>> > Hi Jan :-)
>> >
>> > Wow. Thanks so much. I will work through your suggestions in order.
>> >
>> > Incidentally, I run AVG permanently, also with a daily full test and an
>> > automatic check for daily updates. Zone Alarms and Spyware Blaster are
>> > also
>> > running and kept updated. The following are run at least twice a week
> and
>> > are kept updated:-
>> > SpyBot, AdAwareSE, CCleaner, CW Shredder, PCBug Doctor.
>> >
>> > However, stupidly, I realise that I have not disabled AVG and ZA when
>> > repairing IE6. In addition, I have repaired it from Settings>Control
>> > Panel>Add/Remove Programs>MSIE6SP1 and Internet Tools>Repair IE. Will
>> > follow
>> > your suggestion to the letter - also with the reinstallation of DirectX
> 9.
>> > This ie my stupidity, could be the cause of the problem.
>> >
>> > Presume BHO Demon, PocketKillbox and HiJackThis will all run with
> Win98SE
>> > and not cause conflicts with any of my existing programs.
>> >
>> > Really appreciate your guidance and help.
>> >
>> > Flusters:-)
>> >
>> >
>> > "Jan Il" <abuse@localhost.com> wrote in message
>> > news:uP7xH9KVFHA.544@TK2MSFTNGP15.phx.gbl...
>> >> Hi flusters :-)
>> >>
>> >> It is possible that this file has become corrupted and needs to be
>> > replaced.
>> >> Try reinstalling the DirectX, if possible. See the information here:
>> >> http://www.computerhope.com/directx.htm#a10
>> >>
>> >> also...
>> >>
>> >> How to Repair Windows 98
>> >>
>> >> Be sure that your AV and firewall is disabled before starting:
>> >>
>> >> The Internet Explorer Repair Tool
>> >> http://inetexplorer.mvps.org/answers_5.htm#repair_tool
>> >> or
>> >> Quick Repairs for Windows 98
>> >> http://www.mvps.org/serenitymacros/repair.html
>> >>
>> >> and....
>> >>
>> >> If you have not already done so, then you might try a repair of IE6 as
>> >> follows:
>> >>
>> >
> http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q194/1/77.asp&NoWebContent=1
>> >> or
>> >> http://snipurl.com/6s3r
>> >>
>> >> It is also possible that you have scumware on your system that can
> cause
>> >> this problem. In addition to updating and running your AV, download,
>> > install
>> >> and run the programs below in Safe Mode with Hidden Files enabled.
> This
>> >> will remove the nasty you have and any others it may have let in the
> back
>> >> door. Some malware can replicate itself repeatedly if not removed
>> > properly,
>> >> so run them again according to the information below so that Windows
>> >> is
>> > not
>> >> operating to hide any files 'in use' Follow all instructions
> carefully:
>> >>
>> >> First, Clear the TIF's and empty the recycle bin:
>> >> http://www.mvps.org/winhelp2002/delcache.htm
>> >>
>> >> Also…empty your Recycle bin.
>> >>
>> >> Then do the following:
>> >>
>> >> WARNING>>>> Backup all documents and files before removing any
> spyware!!
>> >>
>> >> How to properly scan for scumware (read first, if possible)
>> >> http://aumha.org/forum/viewtopic.php?t=5878
>> >>
>> >> Download and install BHODemon from
>> >> http://www.definitivesolutions.com/bhodemon.htm
>> >> Your problem may be caused by a bad BHO.
>> >>
>> >> Most importantly, download install and run CWShredder here
>> >> http://www.majorgeeks.com/download3019.html
>> >> and About Buster, which searches for hidden .dlls that recreate the
>> > malware.
>> >> http://www.majorgeeks.com/download4289.html
>> >> Then visit these two sites to test for parasites and help basic
> cleaning:
>> >> On-Line Check
>> >> http://aumha.org/a/noads.htm
>> >> and
>> >> Quick-Fix Protocol.
>> >> http://aumha.org/a/quickfix.php
>> >> Basically, throw everything here at your "infection".
>> >>
>> >> Then download, install and immediately update these three programs
> before
>> >> running:
>> >> AdAware SE - Update immediately after installing
>> >>
>> >
> http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button
>> >> AdAware Tutorial -
>> >> http://www.bleepingcomputer.com/forums/index.php?showtutorial=48
>> >> SpyBot S &D - Update immediately after installing
>> >> http://www.majorgeeks.com/download2471.html
>> >> SpyBot S&D Tutorial -
>> >> http://www.bleepingcomputer.com/forums/index.php?showtutorial=43
>> >> Microsoft Windows Antispyware Program (Beta)
>> >> http://www.microsoft.com/athome/security/spyware/software/default.mspx
>> >>
>> >> Also download, install and run CWShredder:
>> >>
>> >
> http://www.majorgeeks.com/downloadget.php?id=3019&file=11&evp=9e0433de9f8fd8e137fd6b3ff02edc90
>> >>
>> >> Next, do an Online scan here (if possible) -
>> >> http://www.pandasoftware.com/activescan/com/activescan_principal.htm
>> >> Make sure that you choose "fix" or "clean".
>> >>
>> >> Download PocketKkillbox from
>> >> http://www.thespykiller.co.uk/files/killbox.exe
>> >> and put it on the desktop where you can find it easily
>> >>
>> >> Download, install, and run HiJackThis - it is one of the most
>> >> important
>> >> tools to help clean your system of scumware. Follow the instructions
>> >> carefully:
>> >>
>> >> How to download and install HiJackThis: (it does not need to be
> updated)
>> >> http://www.bleepingcomputer.com/forums/topict309.html
>> >>
>> >> Please DO NOT post your log to this newsgroup. It is important that
> you
>> > go
>> >> to one of the HiJackThis Support Forums below and allow the experts
>> >> there
>> >> to analyze it for you.
>> >> AumHa HiJackThis Forum
>> >> http://forum.aumha.org/viewforum.php?f=30
>> >> or Bleeping Computer Forum
>> >> http://www.bleepingcomputer.com/forums/forum22.html
>> >> to allow the experts there to evaluate your log and advise you of any
>> >> necessary steps to clean your system.
>> >> (Note: You will have to Register before posting on these Forums.
> Please
>> >> follow all posting instructions carefully to avoid having your log
>> >> deleted
>> >> or ignored.)
>> >>
>> >> Also, please post a link to the forum where you post your HJT log back
> to
>> >> this thread so that we can follow your progress there.
>> >>
>> >> CAUTION!!!!! Before you try to remove spyware using any of the
> programs
>> >> below, download a copy of LSPFIX from any of the following sites:
>> >> http://www.cexx.org/lspfix.htm
>> >> http://www.spychecker.com/program/winsockxpfix.html
>> >> (if your OS is Win2k or XP) The process of removing certain malware
>> >> may
>> > kill
>> >> your internet connection. If this should occur, this program, LSPFIX,
>> >> will
>> >> enable you to regain your connection.
>> >>
>> >> You should also get a copy of WINSOCKXPFIX available at:
>> >> http://www.spychecker.com/program/winsockxpfix.html
>> >> and
>> >> WinsockXP Fix- WinXP
>> >> http://www.spychecker.com/program/winsockxpfix.html
>> >> with instructions, at
>> >> http://www.iup.edu/house/resnet/winfix.shtm
>> >> also... From LavaSoft- all versions of Windows-
>> >> http://digital-solutions.co.uk/lavasoft/whndnfix.zip
>> >> (NOTE: It is reported that in XP SP2, the command netsh winsock reset
>> >> will fix this problem without the need for these programs.)
>> >> or Winsock Fix Utility
>> >> http://www.dfwonline.net/files/WinsockFix.zip
>> >>
>> >> How to Restart in Safe Mode
>> >>
> http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
>> >>
>> >> How to Show Hidden Files
>> >> http://snipurl.com/6rl8
>> >>
>> >> Hope this helps :-)
>> >>
>> >> Jan :)
>> >> MS MVP - IE/OE
>> >> Smiles are meant to be shared,
>> >> that's why they're so contagious.
>> >>
>> >> Replies are posted only to the newsgroup for the benefit or other
>> >> readers.
>> >> How to make a good newsgroup post:
>> >> http://www.dts-l.org/goodpost.htm
>> >>
>> >>
>> >> > Hi Jan :-)
>> >> >
>> >> > Unfortunately it does not appear to be the answer as I am running
>> > DirectX
>> >> > 9.0c. But thanks anyway for the idea.
>> >> >
>> >> > Flusters :-)
>> >> >
>> >> > "Jan Il" <abuse@localhost.com> wrote in message
>> >> > news:uvo%23xSJVFHA.928@TK2MSFTNGP15.phx.gbl...
>> >> >> Hi flusters :-)
>> >> >>
>> >> >> Check the information here and see if it helps:
>> >> >>
>> >> >> Ddraw.dll May Cause an Error Message
>> >> >> http://www.kbalertz.com/kb_Q317814.aspx
>> >> >>
>> >> >> Hope this helps :-)
>> >> >>
>> >> >> Jan :)
>> >> >> MS MVP - IE/OE
>> >> >> Smiles are meant to be shared,
>> >> >> that's why they're so contagious.
>> >> >>
>> >> >> Replies are posted only to the newsgroup for the benefit or other
>> >> >> readers.
>> >> >> How to make a good newsgroup post:
>> >> >> http://www.dts-l.org/goodpost.htm
>> >> >>
>> >> >>
>> >> >> > Can anyone help me please? I am running Win98SE and IE6 without
>> > problem
>> >> >> > until past 24 hours.
>> >> >> >
>> >> >> > When running IE6, I receive message popup saying MS error. This
>> >> >> > error
>> >> >> > report
>> >> >> > sent to MS says it occurs in "iexplore.exe ddraw.dll
>> >> >> > 6.0.2800.1106
>> >> >> > mod.ver.
>> >> >> > 4.9.0.904 offset:0002d3fa".
>> >> >> > I send the error report and this is followed by another close
>> >> >> > down/error
>> >> >> > message as follows:
>> >> >> >
>> >> >> > "IEXPLORE executed an invalid instruction in
>> >> >> > module <unknown> at 0000:83a7a2e0.
>> >> >> > Registers:
>> >> >> > EAX=000000b7 CS=00bf EIP=83a7a2e0 EFLGS=00010206
>> >> >> > EBX=80a0169c SS=00b7 ESP=80a01690 EBP=80a0169c
>> >> >> > ECX=206f06bc DS=00b7 ESI=809f3850 FS=4e1f
>> >> >> > EDX=000083a7 ES=00b7 EDI=83a7a2e0 GS=0000
>> >> >> > Bytes at CS:EIP:
>> >> >> > ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>> >> >> > Stack dump:
>> >> >> > 809876ba 809f3850 206f06bc 00000000 0000cde6 0c5f0016 00000000
>> > 00200040
>> >> >> > 00000000 0000001e 00000001 0000524c 00000004 00800000 32534753
>> >> >> > 00000040"
>> >> >> >
>> >> >> > This has happened four times in 24 hours. Each time, I have
> repaired
>> >> >> > IE6
>> >> >> > and
>> >> >> > restarted.
>> >> >> >
>> >> >> > Any ideas on the solution?
>> >> >> >
>> >> >> > Thanks
>> >> >> >
>> >> >> > Flusters
>> >> >> >
>> >> >> >
>> >> >> >
>> >> >>
>> >> >
>> >> >
>> >>
>> >
>> >
>>
>
>


Re: ddraw.dll error followed by iexplore closedown