res://ieframe.dll/acr_error in IE8

Viruses and worms
1

Hi,

I’m working on a Windows XP x64 laptop, Avast Free vs. is 2014 9.0.2011, todays definition file 140114-1.

I had never problems with IE 7 before, so I used it. Out of a sudden, I received messages since last Friday:
res://ieframe.dll/acr_error.htm
…when trying to open web sites (like google.com), then the usual message box: ‘IE has encountered a problem and needs to close’ pops up. The browser is trying to recover, it crashes again, messages are looping etc.

To fix it, I am working thru lots of pages for several days now (and it seems a common error!) - but did not succeed so far.

What I tried:

+all updates of the operating system

  • upgrade to IE8 with all security patches and updates available
  • did a full scan with Avast, as well as with Malwarebytes Anti-Malware: both found something, cleared / secured it, but still same error
    +uninstalled and re-installed IE8 (both via microsoft’s Windows update and as standalone installation)
    +of course deleting History and Cookies

What confuses me: If I am starting IE with no add-ons, then NO PROBLEMS OCCUR (that’s why I can post here now). However, error is back, when I run IE, and manually DISABLE ALL the add-ons. (How can this be??)

What confuses me, pt. 2: If I am in the IE after the Windows update, and starting from there another tab in the browser, then IT WORKS, browsing is fine, I will receive no error message.

…pt. 3: When I put in e.g. ‘google.com’, then the browser is trying to open ‘https…’ (instead of http:) file. Maybe something is wrong with the security options? Or maybe I didn’t pay attention to this before.

Finally, what I remembered was the last thing BEFORE the first IE crash, was to acknowledge a popup message from the Avast software. I am sorry, I can’t figure it out, but I think it was standard, about a successful update.

I installed Chrome browser, and it works without problems. - However, I can’t sleep very well with that IE failure, so hopefully I can get help here, which is highly appreciated.

Thanks, Lillebror

2

Hi,

Few of our tool is fully compatible with Windows XP x64based system. We will use a combination of tools.

Follow instruction for running only OTL tool.
http://forum.avast.com/index.php?topic=53253.0

And … FRST.

Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

3

Hi,

and thanks a lot!!

Just a question inbetween: FRST64 works in principle, but after starting, there is a popup:
“Autolt error
line 10702 (…frst64.exe)
error: variable used without being declared”

Behind, the FRST seems still searching (animated bar is wandering), but I’m not sure if it really does? When I click OK on the popup message, then also FRST closes.

How long does a scan usually takes? Waiting now ca 30 min…

Thanks, Lillebror

4

Hi,

while still scanning with FRST64, here are the OTL text files…

Thanks, Lillebror

5

Hi Lillebror,

Just a question inbetween: FRST64 works in principle, but after starting, there is a popup: "Autolt error line 10702 (...frst64.exe) error: variable used without being declared"

OK, stop the FRST and please wait a moment. I’ll ask the author of FRST tools, Farbar personally for advice. Please wait …

6

Hi Lillebror,
FRST is mainly designed for newer Windows systems. They are not designed (FRST64) to be fully compatible on any XP system, at least on XP 64bit. Thus is result of an error.

We shall use alternative tool. Zoek should work just fine, although it’s 32bit app.

Please download zoek.zip or zoek.rar by smeenk (
http://www.mcshield.net/personal/magna86/Images/Zoek_icon.png
) from here or here and save it to your Desktop.
Unpack the archive…

[*]Close any open browsers
[*] Temporarily disable your AntiVirus program. (If necessary)
If you are unsure how to do this please read this or this Instruction.

[*]Double click on zoek.exe to run the tool .
Please wait while the tool does not start…

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

CreateSRPoint;
Process;
SRInfo;
SystemSpecs;
Installer-List;
InstalledProgs;
Uninstall-List;
DIR /S /A:L "%systemdrive%\*">>"%temp%\log.txt";b
FilesRCM;
StartupAll;
Skipfix-IEDefaults;
FirefoxLook;
ChromeLook;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”

7

Hi Magna,

thanks for helping!!

Here’s the log file.

Lillebror

PS: Is it maybe ‘haih.exe’?? >:(

8

Hi,

Re-run zoek as you did before …

[*]Copy the text present inside the code box below and paste it into the large window in the zoek tool:

CreateSRPoint; 
EmptyCLSID;
IEDefaults;
{CE7C3CF0-4B15-11D1-ABED-709549C10000};c
C:\lotus\org6\organize\iehelper.dll;F
[HKEY_USERS\S-1-5-21-1931739231-1011750873-1489796066-500\Software\Microsoft\Windows\CurrentVersion\Run];R
"bawoznosobij"=-;R
"Keegqayf"=-;R
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run];R
"bawoznosobij"=-;R
"Keegqayf"=-;R
C:\Documents and Settings\Administrator\bawoznosobij.exe;F
C:\Documents and Settings\Administrator\Application Data\Urodod;FS
C:\WINDOWS\SysWow64\*.tmp;F
C:\WINDOWS\*.tmp;F
C:\*.tmp;F
C:\Documents and Settings\Administrator\Application Data\acccore;VS
dhkplhfnhceodhffomolpfigojocbpcb;CHR
C:\Program Files (x86)\Babylon;FS
EmptyAllTemp;

[*] Click on
http://www.mcshield.net/personal/magna86/Images/Run%20Script%20by%20zoek.png
button.
Please wait until a logreport will open (this can be after reboot)

[*]Save notepad to your Desktop and attach here zoek-results.log
Note: It will also create a log in the C:\ directory named “zoek-results.log”
[/list]

=========================================
Next …

Re-run OTL.exe.

[list][*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.

:COMMANDS
[CREATERESTOREPOINT]

:OTL
O2 - BHO: (IEHlprObj Class) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\lotus\org6\organize\iehelper.dll ()
O3:[b]64bit:[/b] - HKU\S-1-5-21-1931739231-1011750873-1489796066-500\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\browseui.dll File not found
O3:[b]64bit:[/b] - HKU\S-1-5-21-1931739231-1011750873-1489796066-500\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\browseui.dll File not found
O3:[b]64bit:[/b] - HKU\S-1-5-21-1931739231-1011750873-1489796066-500\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - %SystemRoot%\system32\SHELL32.dll File not found
O4 - HKU\S-1-5-21-1931739231-1011750873-1489796066-500..\Run: [bawoznosobij] C:\Documents and Settings\Administrator\bawoznosobij.exe File not found
O4 - HKU\S-1-5-21-1931739231-1011750873-1489796066-500..\Run: [Keegqayf] "C:\Documents and Settings\Administrator\Application Data\Urodod\haih.exe" File not found

:FILES
C:\lotus\org6\organize\iehelper.dll
C:\Documents and Settings\Administrator\bawoznosobij.exe
C:\Documents and Settings\Administrator\Application Data\Urodod

:COMMANDS
[EMPTYTEMP]

[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.

If the log doesn’t appear, it can be found here:

c:_OTL\MovedFiles\mmddyyyy_hhmmss.log

=========================================
Next … Re-checking

  1. Re-run OTL, just hit the QuickScan button and post me fresh created OTL.txt logreprot.

  2. Re-run Zoek as you did before, just click the More Options button and check the box for “Do a Quick Scan” and press the RunScript button. Post me fresh created zoek log.

9

Hi,

4 files attached.

Thanks!!
Lillebror

10

Good. Now run this Zoek script:

C:\Documents and Settings\Administrator\Application Data\acccore;FS
dhkplhfnhceodhffomolpfigojocbpcb;CHR
C:\Program Files (x86)\Babylon;FS
AutoClean;

Zoek shall ask your system for reboot, allow it. Therefore post me the created zoek log.

11

Hi,

here it is.

Lillebror

12

Are there any improvements, Zoek did clean up a lot of garbage from your system?

13

Hi,

system seems to be faster, but there is still the old message in a loop when I start to browse with IE in normal mode. Continue tomorrow? Thanks for your help, Magna!!

Lillebror

14

Hi Magna,

there’s is system’s restore point on 2nd January, this is definitely before the error stuff: Do you think, I should restore? If this works out, maybe something rules out? Never did a restore before, what is the risk?

Good night for now, really thanks a lot!
Lillebror

15

Hi Magna,

first of all: It works now!! :slight_smile: 8) ;D
Magna, I am really happy, thanks really a lot for all your help. (its MAGNA CUM LAUDE 4u :wink: )

But I think rest of the news is definitely worth to put here:
As I initially wrote, the last thing remembered before crashing was some Avast message […though not critical, as I think. And Avast was always stating afterwards, that Program, Updates, security state… are alright]

So (in an act of desperation), I un-installed Avast, and its fine!

But please tell me: Did you ever heard that Avast program gives such a conflict with IE7 or IE8? Maybe its the 2014 version, maybe it has problems with support of old IE7?

Any comment highly welcome, i will wait before install Avast again…

Thanks again, man, I’m happy, indeed!
Lillebror

16

Hi,

I’m glad you are happy. ;D

When user sees this error “res://ieframe.dll/acr_error” problem is in IE, not to AntiVirus. I’m with Zoek except that I was cleaning up trash attempting to reset IE settings back to default.

But if that does not help, disabling all extensions or simply reinstalling usually do the job. You may feel free to back & install AV. IE should work.

But I have to wonder, why do you attempt to use IE when you have Firefox and Chrome browsers besides?

Good workman always cleans up after himself.
• The following will implement some post-cleanup procedures:

=> Please download DelFix by Xplode to your Desktop.

Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup

http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

17

Hi,

because of: “Never change a running system”. [You can guess from my operating system, quite rare in 2014, as you say, but stable and solid]. I tried Firefox once, and didn’t like, and there was not Chrome in those ancient times 8) . But with these IE error messages (even when Chrome worked fine), I assumed some undercover malware or trojans at work, so I searched…

Btw, i found Chrome is not bad, so I’ll keep.

Will do the cleanup, thanks.

Magna, live long and prosper.

Lillebror

18

Thank you for your kind words.

Cheers :smiley:

19

OK, final statement after trying to reinstall Avast Free Antivirus: successful installation, but the old error in browser

It’s obviously mismatching or incompatible with IE, when having Win XP (x64) operating system, at least since Jan. 8th 2014 or so.

20

Hm …
Have you try to re-install IE now, while avast is active?

You might wanna think to contact avast support, as I am working on volunteer malware removal only. ;D