I am running Windows XP Professional with IE6. While browsing the web the other day, I started getting an error message that pops up constantly:

Microsoft Visual C++ Runtime Library
Runtime Error!
Program: C:\Program Files\Internet Explorer\iexplore.exe
abnormal program termination

If I close this message, it pops back up within a few seconds, but if I just move it over and ignore it, it takes 3-5 minutes before another one pops up again. I have had as many as 10-12 of these messages on my screen at a time. When I close one, they all close, and if I have an instance of Internet Explorer open, it will close as well. Internet Explorer is working fine, except for when the messages are on the screen, IE6 doesn't save any URL's that I have typed in the Address Bar, which is no biggie, but annoying. I have uninstalled my Google toolbar because I read somewhere that it may be part of the problem.

I ran Windows Defender, which says everything is fine and running smoothly. I also have Symantec AntiVirus running locally that gets updated regularly by our network system administrator. I am so tired of this that I'm getting ready to have my PC re-imaged if I can't figure out what is causing this. I just hate to do that because it takes days to get everything back to normal again.

If anyone has seen this before or has any suggestions, I would greatly appreciate it.

Moderator Edit: Moved topic to more appropriate forum. ~ Animal

Hello,

You say that you have removed the google toolbar, have you disabled third party browser extensions?

Go to Tools:Internet Options:Advanced and uncheck the enable third party browser extensions.

Then restart your computer.

Hope this helps

Yes, I tried that too. But I continue getting the error messages.

Thanks for the response.

Al

Which version of Java do you have? Please run this test to rule out other issues. Do you have a program like Cyberwarner?

I'm not able to get OneCare to install. I disabled Symantec AntiVirus and tried it again, but the same result. I have admin rights on my machine. I think its having trouble getting through our firewall.

I just ran a search on Java... ...I see yellow exclamation points coming up in front of some of the results. It appears that I have both Java Runtime Environment 1.4.2 and 1.5.0 on my machine. I have never heard of Cyberwarner and do not have it on my machine.

Thank you for your help!

Al

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

* Download the latest version of Java Runtime Environment (JRE) 6.0
* Scroll down to where it says "Java Runtime Environment (JRE) 6
* Click the "Download" button to the right.
* Check the box that says: "Accept License Agreement".
* The page will refresh.
* Click on the link to download Windows Offline Installation, Multi-language and save to your desktop.
* Close any programs you may have running - especially your web browser.
* Clear Java Cache
To Clear the Java Runtime Environment (JRE) cache, do this:

* Click Start > Settings > Control Panel.
* Double-click the Java icon.
-The Java Control Panel appears.
* Click "Settings" under Temporary Internet Files.
-The Temporary Files Settings dialog box appears.
* Click "Delete Files".
-The Delete Temporary Files dialog box appears.
-There are three options on this window to clear the cache.
o Delete Files
o View Applications
o View Applets
* Click "OK" on Delete Temporary Files window.
-Note: This deletes all the Downloaded Applications and Applets from the cache.
* Click "OK" on Temporary Files Settings window.
* Close the Java Control Panel.

You can also view these instructions along with screenshots here.


It is possible that Microsoft JVM is still present on your computer.Check this as following: Start -- Run and type cmd. In the blac window type jview and ENTER. If Microsft JVM is present you will get version notification. If not present you wil get an error.

Please do the following if Microsoft JVM is present:
Download this tool to remove Microsoft JVM from your PC: MSJVM Removal Tool
Save the file on your desktop doubleklick and allow it to store it into his own folder. Dobleklick unmsjvm.exe en follow these instructions.
Please also download this regfile: RemoveJVM.reg.
Store the regfile onto your desktop doubleklick and allow the changes in your registry.



* Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
* Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Examples of older versions in Add or Remove Programs:
o Java 2 Runtime Environment, SE v1.4.2
o J2SE Runtime Environment 5.0
o J2SE Runtime Environment 5.0 Update 6
* Click the Remove or Change/Remove button.
* Repeat as many times as necessary to remove each Java versions.
* Reboot your computer once all Java components are removed.
* Then from your desktop double-click on jre-1_6_0_10-windows-i586-p.exe to install the newest version.

Than retry to run the test

I tried all your suggestions but the error box continues to popup. There are periods after running Spybot and AdAware that it doesn't popup for 30-40 minutes; however, once it starts it goes crazy, popping up every 5-10 seconds after I close one. I continue to stack error boxes over to the side of the screen because if I don't close them right away, it takes about 5 minutes before another one pops up and I can at least get some work done.

Thanks for your help,
Al

Try downloading the runtime libraries http://www.microsoft.com/downloads/details...;displaylang=en tell it to install and restart.

Well, after much searching; many different virus scans, spyware scans; adware scans; and lots of trial and error, I found the culprit. There was a process running in my Task Manager that looked odd because it was "_qbotinj.exe" or something like that (I stopped it from running and the messages stopped). I did a right mouse click on the file and it gave me the option to debug it, which I did, and found it was written in Assembly language. When I went to close it, it asked if I wanted to save it and showed me the path where it was residing on my machine:

c:\documents and settings\all users\_qbothome

There were several files in this folder, including:
_qbotinj.exe
_qbot.dll

It also held a file that I opened with a text reader that showed that it had accumulated at least 5 or 6 pages of personal information on me, including a credit card (fortunately, one that expired over 6 months ago). I couldn't believe the information in that file... it had everything.

Once I had the filename, I ran a search for it on the Internet and found that it was very malicious and that none of the Virus Protection programs, spyware and adware programs could detect it. The only program that could detect it was something from www.SuperSpyware.com. I was having so much trouble with my browser that I couldn't download the app, so instead, I started my machine up in Safe mode and deleted the entire "_qbothome" folder. That got rid of the problem but my ie6 browser was hammered. Thankfully, I had downloaded ie7 a while back and had not installed it yet, so I installed it and presto... my machine was back to normal again.

I hope this information helps someone else out with similar problems.

Thank you all for your assistance,
Al

Thanks for the feedback This is really a piece of work


A word of warning :
IMPORTANT NOTE: Backdoor Trojans are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms. Remote attackers use backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge. If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums. You should consider all your passwords to be compromised. They should be changed by using a different computer and not the infected one. Do not change passwords or do any transactions while using the infected computer because an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breech.