After installing new programs my internet now crashes.

[kitii]

Hello, newbie here.

I installed Winpatrol and Mcafee site advisor 2 days ago, after which my internet constantly crashes, particularly if I open more than one tab. I have a feeling it's site advisor that was the problem, as it demanded many registry changes, most of which I allowed, then I thought there were too many and disallowed the last one. Anyway I uninstalled these two programs and my internet is still crashing. I have the latest version of spybot, Windows XP SP2 and IE7. Obviously I want to return to how it was 3 days ago (working properly.)

When I look at the black and white list it shows numerous recent allowed registry changes such as:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects....
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar...
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate Page into English=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\&Google Search=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Cached Snapshot of Page=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Backward Links=

etc.

I've noticed Translate Page into English option is no longer available on my Google pages, but cached is.

The blocked registry changes page is blank, although I always tick remember this decision. Allowed processes and blocked processes are blank too.

Does uninstalling programs change the registry back to as before? If not, do you think it's these changes that are causing the crashes? If so how can I undo them?

Is there anything more I can do now to get internet explorer working properly?

I was thinking of maybe going to the XP system restore page (I haven't done registry backup on spybot) and restore to 3 days ago, or is that too drastic? Would that work anyway?

Here's the relevant resident log:

Allowed (based on user decision) value "WinPatrol" (new data: "C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe -expressboot") added in System Startup global entry!
Allowed (based on user whitelist) value "WinPatrol" (new data: "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot") changed in System Startup global entry!
Allowed (based on user decision) value "{0BF43445-2F28-4351-9252-17FE6E806AA0}" (new data: "McAfee SiteAdvisor") added in Global browser toolbar!
Allowed (based on user decision) value "{089FD14D-132B-48FC-8861-0048AE113215}" (new data: "") added in Browser Helper Object!
Allowed (based on user decision) value "SiteAdvisor" (new data: ""C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"") added in System Startup global entry!
Allowed (based on user decision) value "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" (new data: "") deleted in Global browser toolbar!
Allowed (based on user decision) value "&Google Search" (new data: "") deleted in Browser menu extension!
Allowed (based on user decision) value "&Translate English Word" (new data: "") deleted in Browser menu extension!
Allowed (based on user decision) value "Backward Links" (new data: "") deleted in Browser menu extension!
Allowed (based on user decision) value "Cached Snapshot of Page" (new data: "") deleted in Browser menu extension!
Allowed (based on user decision) value "Similar Pages" (new data: "") deleted in Browser menu extension!
Allowed (based on user decision) value "Translate Page into English" (new data: "") deleted in Browser menu extension!
Denied (based on user decision) value "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" (new data: "hex:00") added in Global browser toolbar!
Allowed (based on user whitelist) value "MSMSGS" (new data: "") deleted in System Startup user entry!
Allowed (based on user whitelist) value "MSMSGS" (new data: ""C:\Program Files\Messenger\msmsgs.exe" /background") added in System Startup user entry!
Allowed (based on user whitelist) value "MSMSGS" (new data: "") deleted in System Startup user entry!
Allowed (based on user whitelist) value "{089FD14D-132B-48FC-8861-0048AE113215}" (new data: "") deleted in Browser Helper Object!
Allowed (based on user decision) value "SiteAdvisor" (new data: "") deleted in System Startup global entry!
Allowed (based on user decision) value "WinPatrol" (new data: "") deleted in System Startup global entry!

[drragostea]

Do you mean the Internet disconnects frequently? Do you use a modem/router?

Uninstalling the programs does not necessarily "undo" the changes made the registry. What is done is done. Some programs remove themselves completely when uninstalled while others leave a few folders and registry keys behind.
--
In TeaTimer 1.5>>:

If you check "Remember this decision" on a registry change, the information concerning that change it is stored in a file. TeaTimer uses that information to automatically "Allow" or "Deny" similar registry changes for all future changes. To edit that information: Right click on the TeaTimer system tray icon (labeled "Spybot-SD Resident") and select Settings. This will bring up TeaTimer's "White & Black List". There are four (4) Buttons across the top of the "White & Black List":
Allowed registry changes
Blocked registry changes
Allowed processes
Blocked processes
You can review all the entries that you have stored by clicking on these buttons. If entries you are interested in are for registry changes, the entries that you should review are in "Allowed registry changes" and "Blocked registry changes". You can delete stored entries by clicking on the scripted black "X" to the right of the entry that you want to delete, answering "Yes" to the confirmation dialog and then clicking the "OK" button when you're done.

Basically the idea would be undoing the change made by TeaTimer (Remember my decision) as it is the only thing you can edit. Technically, it is impossible to undo changes that were allowed/denied once.

Another alternative would be disabling TeaTimer.
Or you can perform 'System Restore'. Which "brings" your computer back to it's state three days ago. I believe it does undo the registry. And don't worry documents and pictures are intact.

Is WinPatrol and Siteadvisor updated?
WinPatrol: v.15.5.2008
SiteAdvisor (IE/Firefox): 26.6
--

There should be the time values (time) with the 'relevant' log... Was it included?
What version of Spybot-SD are you using?

I need the time values so I can see the events occurring at what time and such.

[kitii]

Thanks for your reply.

I use a modem.

I have spybot 1.5.2.20

Yes the internet closes down, although only if I open more than one tab. If I'm reading a non English page the translate page or word into English, which appeared if you right clicked has disappeared as well, which is annoying as I'm a foreign languages student.

Like I said I always tick remember my decision, but the blocked registry changes don't show up, I don't know why.

As far as I'm aware I downloaded the latest version of WinPatrol and Siteadvisor, but like I said I have uninstalled them to no difference. It's strange because they were recommended and no-one else had a problem with them.

I ended process of tea-timer in the task manager, still no change.

So what do you recommend, that I remove all the entries involving WinPatrol and Siteadvisor in the allowed registry changes? I removed one, this one: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Translate Page into English=

But the translate page into English option hasn't returned.

Or should I do a system restore? As I know nothing about computers, is it a drastic procedure, a risky procedure? Can I redo my anti-virus updates (which it presumably undoes). By the way, if it's not a drastic procedure, is it a good idea to always do a system restore point before you download anything, then you can do a system restore if it messes up?

What do you recommend as I'm stuck.

Updated resident log:

18/07/2008 03:56:50 Allowed (based on user decision) value "WinPatrol" (new data: "C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe -expressboot") added in System Startup global entry!
18/07/2008 03:57:03 Allowed (based on user whitelist) value "WinPatrol" (new data: "C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot") changed in System Startup global entry!
18/07/2008 04:03:00 Allowed (based on user decision) value "{0BF43445-2F28-4351-9252-17FE6E806AA0}" (new data: "McAfee SiteAdvisor") added in Global browser toolbar!
18/07/2008 04:03:09 Allowed (based on user decision) value "{089FD14D-132B-48FC-8861-0048AE113215}" (new data: "") added in Browser Helper Object!
18/07/2008 04:03:21 Allowed (based on user decision) value "SiteAdvisor" (new data: ""C:\Program Files\SiteAdvisor\6261\SiteAdv.exe"") added in System Startup global entry!
18/07/2008 04:04:23 Allowed (based on user decision) value "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" (new data: "") deleted in Global browser toolbar!
18/07/2008 04:04:34 Allowed (based on user decision) value "&Google Search" (new data: "") deleted in Browser menu extension!
18/07/2008 04:04:51 Allowed (based on user decision) value "&Translate English Word" (new data: "") deleted in Browser menu extension!
18/07/2008 04:05:04 Allowed (based on user decision) value "Backward Links" (new data: "") deleted in Browser menu extension!
18/07/2008 04:05:10 Allowed (based on user decision) value "Cached Snapshot of Page" (new data: "") deleted in Browser menu extension!
18/07/2008 04:05:15 Allowed (based on user decision) value "Similar Pages" (new data: "") deleted in Browser menu extension!
18/07/2008 04:05:22 Allowed (based on user decision) value "Translate Page into English" (new data: "") deleted in Browser menu extension!
18/07/2008 04:05:35 Denied (based on user decision) value "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" (new data: "hex:00") added in Global browser toolbar!
18/07/2008 04:15:45 Allowed (based on user whitelist) value "MSMSGS" (new data: "") deleted in System Startup user entry!
18/07/2008 05:55:22 Allowed (based on user whitelist) value "MSMSGS" (new data: ""C:\Program Files\Messenger\msmsgs.exe" /background") added in System Startup user entry!
18/07/2008 06:19:28 Allowed (based on user whitelist) value "MSMSGS" (new data: "") deleted in System Startup user entry!
18/07/2008 06:21:30 Allowed (based on user whitelist) value "{089FD14D-132B-48FC-8861-0048AE113215}" (new data: "") deleted in Browser Helper Object!
18/07/2008 06:21:40 Allowed (based on user decision) value "SiteAdvisor" (new data: "") deleted in System Startup global entry!
18/07/2008 21:11:20 Allowed (based on user decision) value "WinPatrol" (new data: "") deleted in System Startup global entry!
19/07/2008 16:55:33 Allowed (based on user whitelist) value "MSMSGS" (new data: ""C:\Program Files\Messenger\msmsgs.exe" /background") added in System Startup user entry!

[drragostea]

It seems that the 'translate into English' is being removed.

Can you do a System Restore to the point back when the problem started? There would be anything drastic or risky involved. Just more like 'going back in time'.

Do you use a Firewall? How about Anti-virus? What are they?

Have you encountered any problems with viruses or spyware in the past?

Do you use a "translating" software? What is it?
--

Do a System Restore back 3-4 days ago. Uninstall Spybot-SD 1.5.2.20 and install the latest version (1.6.0.30) at:
http://www.safer-networking.org/en/mirrors/index.html

[kitii]

Just the windows firewall. Avast anti-virus. I don't use a translating software, just google. I've had a few viruses and spyware but it's been solved (I think) by avast, spybot and adaware. Btw, I just had a warning from avast about a trojan in my temporary internet files which I couldn't move to the chest because the file was being used by another process. So I had the choice of deleting or taking no action. I chose to delete and got this message from spybot:

Category : session manager
Change: value
Entry: boot execute
Old data: autocheck autochk* \lsdelete
New data: autocheck autochk* \lsdelete\aswBoot.exe/

I allowed it, is that OK? If I do a system restore now that won't affect it?

Or should I reboot and then do it?

Thanks again!

[drragostea]

You can safely allow. Does AdAware detect anything?

My solution would be to 'empty' out the Temp. files. Since that folder is temporarily, you can easily clear it out.

Try to do a System Restore back to 3-4 days ago. I hope the crashing stops.

When you say crash, do you mean IE freezes and does not respond or do you mean that it stops loading pages?

[kitii]

It just shuts the pages down and I have to reconnect. I'll scan again with adaware and avast and then try the restore, fingers crossed.

[drragostea]

I think you meant it doesn't respond and you had to force close it, correct?

If you have the time, run AdAware and avast! then do a System Restore.

[kitii]

Thanks for your time drragostea. That wasn't too painful! I did a system restore and everything is back to working normally like before I installed the programs. It seems simple but everything's slightly scary if you know nothing about computers.

One last question, is it OK to delete the old Spybot folder that is still there after I uninstalled spybot and installed the latest version?

And it's a shame I can't use Mcafee site advisor anymore as it's a useful program. If anyone knows a website warning program that won't mess up my browser feel free to recommend one.

[drragostea]

What have you done when upgrading to the latest version? Have you uninstalled it or installed it over the current one?

Where is the 'Spybot' folder located?

I think you can still use McAfee Siteadvisor : ). As long it's not causing problems.

Is it for Internet Explorer or Mozilla Firefox? Either way, SiteAdvisor works fine with both.