PDA

View Full Version : Explorer( 6 )shifts to the other side!



ayed
19-06-2008, 03:16 PM
Hello, folks right here and hope all of you have been very well.


When I click on a website, the interface of explorer 6 shifts to the left side?That is, File-Edit-Favourite-Tools jumps from the right side to the left side.My PC language is Arabic.Moreover, an address may not appear in the address bar!
Thank you in advance..
Ayed:thanks

wratterus
19-06-2008, 05:29 PM
Hi Ayed, what Operating System are you using? If it's XP, upgrade to IE7 and install any security patches. That will more than likely fix the issue.

ayed
19-06-2008, 11:02 PM
Hi Ayed, what Operating System are you using? If it's XP, upgrade to IE7 and install any security patches. That will more than likely fix the issue.

:thanks for your quick response , wratterus.My OS is XP .Thank you for your advice but I have tried IE 7 :horrified and had been very slower than IE 6.Thus, I like IE6 :thumbs: .
Thank you again
My best wishes for all

Ayed

jwil1
19-06-2008, 11:27 PM
Have you tried Firefox (http://getfirefox.com)?

The latest version (3.0) is very reliable and much more secure than Internet Explorer.

Speedy Gonzales
19-06-2008, 11:36 PM
By the looks of it FF3 final has a code execution vulnerability in it (http://blogs.zdnet.com/security/?p=1288)

And here (http://dvlabs.tippingpoint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30)

So be CAREFUL what you do in it

ayed
19-06-2008, 11:54 PM
Jwil1 and Speedy Gonzales for your suggestions.In fact, I do like IE 6 and won't replace it with any other explorer.
As for FF3 , I haven't tried it so far .
Thank you for your help and co-operation

Ayed

Speedy Gonzales
19-06-2008, 11:59 PM
Can you take a snapshot (press prt screen on the keyboard), of what youre talking about Ayed.

With some graphics program if u have 1. And upload it here (http://imagef1.net.nz/)

Click on advanced / upload the file and copy and paste the link it gives u back here

This spy file you've got what is it??

You may have something nasty on your system

jwil1
20-06-2008, 12:04 AM
Also post a HiJackThis log from Speedy's signature if possible - this should help eliminate the spy program.

Speedy Gonzales
20-06-2008, 12:05 AM
Where are you from SG? ;)

Is this a trick question ?

jwil1
20-06-2008, 12:06 AM
Is this a trick question ?

No - can you read Arabic? :)

EDIT: Changed my post to ask for a HJT log

Speedy Gonzales
20-06-2008, 12:11 AM
Ah no lol

Ayed may have an english version of Windows?

Its the screen I want to see. I dont have to understand what it says :lol:

ayed
20-06-2008, 12:14 AM
Sorry Speedy Gonzales to say I have no a key that to be pressed to take a snapshot ..
Here is the HJ log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:23:48 م, on 19/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\A\Local Settings\Temporary Internet Files\Content.IE5\C56FSPMF\HiJackThis[1].exe

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v2] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe" /source=HKLM
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: الدليل السريع - C:\WINDOWS\ww80.html
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Pardon - {302172A1-A2B4-4402-B1D0-F5D54C3E83C6} - C:\Program Files\Pardon 3\Pardon.exe
O9 - Extra 'Tools' menuitem: Pardon - {302172A1-A2B4-4402-B1D0-F5D54C3E83C6} - C:\Program Files\Pardon 3\Pardon.exe
O9 - Extra button: الدليل - {46012075-ED62-464b-9554-AD0BEC35D1EC} - http://ww80.com (file missing)
O9 - Extra button: (no name) - {46012076-ED62-464b-9554-AD0BEC35D1EC} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

--
End of file - 3381 bytes

Thank you all for your helpful and inderstanding
Ayed

jwil1
20-06-2008, 12:14 AM
Hello, folks right here and hope all of you have been very well.


When I click on a website, the interface of explorer 6 shifts to the left side?That is, File-Edit-Favourite-Tools jumps from the right side to the left side.My PC language is Arabic.Moreover, an address may not appear in the address bar!
Thank you in advance..
Ayed:thanks

:)

Speedy Gonzales
20-06-2008, 12:25 AM
Run hijackthis again Ayed (put it in its own folder first). Tick these then tick fix checked

Close browsers

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O8 - Extra context menu item: الدليل السريع - C:\WINDOWS\ww80.html

O9 - Extra button: الدليل - {46012075-ED62-464b-9554-AD0BEC35D1EC} - http://ww80.com (file missing)

Whats this?? If you dont know uninstall it and tick these entries

O9 - Extra button: Pardon - {302172A1-A2B4-4402-B1D0-F5D54C3E83C6} - C:\Program Files\Pardon 3\Pardon.exe

O9 - Extra 'Tools' menuitem: Pardon - {302172A1-A2B4-4402-B1D0-F5D54C3E83C6} - C:\Program Files\Pardon 3\Pardon.exe

Is winwea32.dll on your system?? Do a search for it, see if its there

If it is it looks like it belongs to a virus

It maybe or should be in C:\WINDOWS\SYSTEM32

And is this in the Windows folder?? C:\WINDOWS\ww80.html

Then reboot. See if its any better

Oops JW, I think I need glasses :D

Erayd
20-06-2008, 12:44 AM
To be honest this sounds more like a locale issue - if your normal language is Arabic, it makes sense that things would be right-aligned, because Arabic is a script intended to be read from right-to-left, unlike all modern Western scripts.

Are the sites you're viewing written in Arabic / Hebrew etc? If not, then my guess is that the problem is caused by a bug in IE, causing the entire browser interface to switch into left-to-right mode, rather than switching only the webpage viewport.

ayed
20-06-2008, 12:53 AM
Thank you Speedy for your speedy respnose and solutions..
Here are what you have just asked me to do:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:01:39 م, on 19/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\A\سطح المكتب\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v2] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe" /source=HKLM
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: الدليل - {46012075-ED62-464b-9554-AD0BEC35D1EC} - http://ww80.com (file missing)
O9 - Extra button: (no name) - {46012076-ED62-464b-9554-AD0BEC35D1EC} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

--
End of file - 2818 bytes
-----------------------
Surely, winwea32.dll IS hidden and latent on my PC registry?

After I have done HTJ log, I have a backups folder on the desktop, what should I do with this folder ?
Any suggestion?
Thank you
Ayed

ayed
20-06-2008, 01:48 AM
Here is the latest HTJ log of my PC :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:59:51 م, on 19/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Documents and Settings\A\سطح المكتب\HiJackThis.exe

O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v2] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2 a.exe" /source=HKLM
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &تصدير إلى Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {46012076-ED62-464b-9554-AD0BEC35D1EC} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: بحث - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe

--
End of file - 2668 bytes

Speedy Gonzales
20-06-2008, 10:27 AM
Looks ok to me now

ayed
20-06-2008, 02:49 PM
Thank you , Speedy .I deleted (winwea32.dll )from registry:thanks



...browser interface to switch into left-to-right mode, rather than switching only the webpage viewport.

Exactly so.This is what is happening and there is no address in the bar.The name of a website sometimes doesn't appear in the bar .

Ayed:thanks

Speedy Gonzales
20-06-2008, 02:53 PM
Ummm, run my computer then go to tools / folder options / view tab.

Tick show hidden files and folder. If winwea32.dll is/was in the registry, it must be on the hdd somewhere.

Do another search for winwea32.dll if you find it delete it as well

So, is it any better now, or not?

ayed
20-06-2008, 06:36 PM
Ummm, run my computer then go to tools / folder options / view tab.

Tick show hidden files and folder. If winwea32.dll is/was in the registry, it must be on the hdd somewhere.

Do another search for winwea32.dll if you find it delete it as well

So, is it any better now, or not?

Thank you Speedy for your follow-up.
I have just ticked show hidden files & folders.Winwea32.dll is no longer in the registry..
What I have so far is this:
That the browser interface still switches into the other side from right to left when viewing a site and the address of that site doesn't appear on the bar unless I refresh the page .
Thanks for help
Ayed

Erayd
20-06-2008, 08:29 PM
Is there any chance you'd consider upgrading to IE7? If not, are all current patches for IE6 installed? To be honest this sounds much more like a bug in IE6 than anything else.

Has this problem just started recently, or has it always been there?

ayed
20-06-2008, 10:43 PM
Is there any chance you'd consider upgrading to IE7? If not, are all current patches for IE6 installed? To be honest this sounds much more like a bug in IE6 than anything else.

Has this problem just started recently, or has it always been there?

Thank you, Bletch, for your follow-up .
It took place just when I reinstalled Windows XP three days ago.
Of course, there is a chance to consider upgrading to IE7 but I don't like that chance :D
If you have any solution ?
Is there any remover or fixer software to this bug?
Thank you in advance..
Ayed

Erayd
20-06-2008, 11:04 PM
I have to admit I'm a bit stumped - the only thing I can think of is to run Windows Update and make sure you have all current patches installed, as it's likely to be an older bug that has since been fixed.

If you have already installed all the new patches, then perhaps one of the new ones is causing it - try removing them and see what happens.

Just missed you in ChatF1 - I was in another browser tab, and by the time I returned you had vanished.

ayed
21-06-2008, 08:11 AM
try removing them and see what happens.



Thank you , Bletch, for help..
How can I remove that bug?
:thanks

Erayd
21-06-2008, 11:37 AM
Head over to Add/Remove programs, enable the option for showing windows updates, and remove any patches to IE6. If it fixes the issue, then add them back one at a time until you find out which one is causing your issue.

If removing them didn't fix your issue, then you'll need to try something else. If there is nothing to remove, try running Windows Update.

Which service pack do you have? (To find out, right-click 'My Computer', then click 'properties' - the box that appears should tell you).

ayed
22-06-2008, 05:24 PM
Head over to Add/Remove programs, enable the option for showing windows updates, and remove any patches to IE6. If it fixes the issue, then add them back one at a time until you find out which one is causing your issue.

If removing them didn't fix your issue, then you'll need to try something else. If there is nothing to remove, try running Windows Update.

Which service pack do you have? (To find out, right-click 'My Computer', then click 'properties' - the box that appears should tell you).

Thank you , Bletch..
I have ticked "show Windows updates" and removed all of these updates and the interface of IE 6 still switches from right side to the left side.
*Pack is Service Pack 2 , Windows XP Ver.2002
So, I am writing now as the IE 6 switches from right to left and your site URL is not shown on the address bar of my IE 6 ..

Erayd
22-06-2008, 08:48 PM
In that case, I have completely run out of ideas to try - I can't think of anything else that would cause this problem.

Try having a very close look at the language settings, and see if there is anything that looks relevant.

I recommend you reinstall all the updates you just removed - if they aren't causing the problem, then better to keep them.

ayed
23-06-2008, 07:21 AM
In that case, I have completely run out of ideas to try - I can't think of anything else that would cause this problem.

Try having a very close look at the language settings, and see if there is anything that looks relevant.

I recommend you reinstall all the updates you just removed - if they aren't causing the problem, then better to keep them.

Hello, Bletch! I :badpc: it!:lol:
I have just rooted out KasperSky 7 and installed KaserSky 8 .
I have run the test "sfc /scannow" and checked all system files.

I am not sure if that bug had been in KaserSky 7 or after I had done sfc /scannow?
It was fixed and that is it.:cool:

Thank you , Bletch , for your help and follow-up
My best wishes to all
Ayed

Erayd
23-06-2008, 11:15 AM
Glad to hear you fixed it :D.