Hard to explain...deals with right clicking

[imagine1012]

Hi all - I've noticed this problem the other day - whenever I'm on Internet Explorer, a window will randomly pop up. It's usually the same window that comes up when you right click on the mouse. It's either the pull down menu for webpages: Back, Select All, etc or the pull down menu for links: Open, Open in New Tab, Open in New Window. My operating system is Windows Vista Home Premium. I wasn't sure where to post this topic, whether it's a Vista problem, or some type of virus. I've done a full system scan with Windows Defender and also the Windows Malicious Software Tool and nothing has come up. It's a rather annoying problem! Any help would be awesome, thanks!

-Kristin

[AnnMarie]

Hi Kristin. Close IE and go to Start Search and type:

iexplore.exe -extoff

iexplore.exe -extoff will appear at the top of the Menu. Click on it and IE will open with a message saying that IE is running without add-ons. Surf like this for a day or so and tell me if you still experience the same problem.

[imagine1012]

Thanks for the quick response AnnMarie! This will be the first item on my agenda when I get home from work today (crosses fingers). I will let you know how it goes. It took me 5 mintues to write a ten second email last night bc of the constant clicking off I had to do on the screens that phantomly appeared!

Thanks,
Kristin

[AnnMarie]

Ok. If it works, we still have a little more work to do. :)

[imagine1012]

Success! I followed your directions last night and I did not have any of those right click windows show up. I turned on my computer today and opened IE and it didnt say anything about disabled add-ons (like it did last night), I wasn't sure if I should repeat your directions or not, but I haven't had the windows show up today. You mentioned other things I needed to do though?

Thanks :happy:,
Kristin

[AnnMarie]

Hi Kristin, what we did when you ran that command was disable add-ons such as toolbars.

I turned on my computer today and opened IE and it didnt say anything about disabled add-ons (like it did last night), I wasn't sure if I should repeat your directions or not, but I haven't had the windows show up today.

Perhaps the problem has gone away. If so, that's fine but if not, we will need to find which toolbar is causing your problem.

[imagine1012]

Okay, sounds good - if they start popping up again, I'll reply to this post again. Hopefully not : ) Thanks for all your help!

[AnnMarie]

You are welcome. :)

[imagine1012]

Hi AnnMarie - The toolbar pop ups are baaaaaaaaaaaaaaaaack. Should I repeat the first steps you gave me, or start something new???

Thanks,
Kristin

[AnnMarie]

Not yet. It sounds as though you might have a toolbar installed that is causing the problem Kristin. It would be good to get rid of the problem permanently if possible. I would like you to provide a log for me please.

Go here (http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php?) and download Hijack This to your Desktop. When you have downloaded it, doubleclick to install. Once installed, open Hijack This and click on scan. Most of the files listed will be harmless and/or required so do not make any changes, just click on Save Log, copy it and post it back in this thread.

[imagine1012]

I always see people doing logfiles and wondered how the heck they knew how to do that - thanks for the directions or I'd be lost!

Now let's hope this is what you're looking for : )

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:08 AM, on 10/13/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\QuickTime\QTTask.exe
C:\OtherApps\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Windows\ehome\ehmsas.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "c:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\OtherApps\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/pr02/resources/VistaMSNPUplden-us.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal/cabs/Entriq_3_6_0_15_Silent.cab
O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal/cabs/NBCUniversal_1_0_0_9.cab
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\OtherApps\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: KService - Unknown owner - C:\Program Files\Kontiki\KService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 9891 bytes

[AnnMarie]

Because the problem went away last time we disabled add-on's, we can reasonably assume that one of the below programs is causing the issue:

Adobe Acrobat Reader
Norton Internet Security
Sun Java Runtime Environment.

Check for updates to the software and if any are available, install and reboot.

For instance, I know that you are not running the latest version of Sun Java. Go to Programs and Features in Control Panel and uninstall all versions Java/JRE (Sun Java Runtime Environment/J2SE Runtime Environment) and reboot. When you have done that, go here (http://java.sun.com/javase/downloads/index.jsp) and download and install the latest version of Sun Java (Java Runtime Environment (JRE) 6 Update 3). Reboot afterwards.

If the problem persists after you have done this, start IE normally and go to Tools > Manage Add-ons. Disable all add-ons and close IE. Restart IE and re-enable them, one at a time, until you find which one is causing the problem and then uninstall it.

[imagine1012]

Okay - not too successful so far.....

I uninstalled the Sun Java program, clicked on the link you provided and downloaded the updated version and installed it. While I was in the process of downloading it, pop ups still appeared. So I'm assuming it's not Sun Java....

I went to my 'managae add-ons' and disabled the 9 add-ons that were currently loaded in my IE. (The names are: Show Norton Tool Bar, Send To One Note, Adode PDF Reader Link, Research, Shockwave Flash Obj, InformationCardSigninHelp, Norton Confidential, SSV Helper Class, and Sun Java Console). After doing this, I still have had pop ups appear. I wasn't sure if I should not be working from 'add ons currently loaded in IE', but the other options had ALOT of add-ons.

As of right now (with the 9 current add-ons disabled) the popups are not as frequent as times. Sometimes they're up so often it's impossible to type one sentence without wanting to throw my computer. Especially when the pop up is the 'undo' pop up and anything I'm typing is erased :curse:

So, not too sure where to go from here??? I appreciate all of your help and assistance though!! :cool:

[AnnMarie]

Ok, re-enable your add-ons. I wonder if it is a problem with a context menu handler. Try Method 2 here (http://windowsxp.mvps.org/slowrightclick.htm) Kristin and let me know if this helped.

[imagine1012]

Hi AnnMarie-
Not sure if you're familiar with the ShellExView program, but I followed the directions, ran the scan, and two items (Norton items) were highlighted in red. So I clicked on 'disable' for those two items, a window prompt asked if I wanted to disable these items and I click 'yes'. The "Disabled" column still reads those two files as not disabled (it says 'no'). I guess I'm not sure how to use this program if I don't know what is disabled or not??

[AnnMarie]

Highlighted in red indicates a suspicious item. :D

I guess it could be a Norton issue, it's odd that they cant be disabled. Do you have your Product Key handy? If so, uninstall Norton reboot and tell me if the problem still exists. You can always reinstall if this makes no difference.

[imagine1012]

I would have gotten back to you sooner, but I've been in California ;)

Norton came installed on my computer. I know that my Norton Internet Security has run out of it's free subscription, but the Norton Antivirus Program is still good (I think). So not sure if I would have the product key?? Pop ups are still happening and sometimes so frequent I want to chuck my laptop out my second story window. I will email someone at ShellExView to find out why the items won't disable when I ask them to :curse:

Thanks,
Kristin

[AnnMarie]

No problem Kristin. :)

I know that my Norton Internet Security has run out of it's free subscription, but the Norton Antivirus Program is still good (I think).

While Norton may still scan, it will not be receiving updates if the subscription has expired and this puts you in a very vulnerable position.

If I were you, I would uninstall all Norton programs including Live Update, reboot and install a free antivirus program such as AVG (see here (http://free.grisoft.com/)). Also make sure that the Vista Firewall is activated after you uninstall Norton.

Let us know if this makes any difference.