IE8 not saving search providers and closing

[CWB]

hi all ,

i just got done with cleaning out an infection (many thanks again to those here) and IE8 is doing the same thing that id did while the comp was infected ...

when i open IE and try to add a search provider IE pops up with the "IE has encountered a problem and needs to shut down" .

it the pops up the "reporting the error and hopefully there is a fix ..." .

when i open it up again the same sequence happens .

i can surf normally and do manual google searches with no problems .

i have tried uninstalling IE8 and rolling back to IE7 ( a quick check showed the "add/manage search providers" missing from the drop down box .

i then installed a fresh copy of IE8 via the windows updates ... same problems .

any ideas ?

(besides sticking with FF , that is)

[yardbird]

I see as of today you are in the Malware Forum with an expert helping you: http://forums.malwarebytes.org/index.php?s...mp;#entry308902

It would be best to finish with him in that forum, It may take him some time to reply, as he is working with other users. Hang in there. regards

[CWB]

hi ,

gammo and i are pretty much done getting rid of the infections .

as per our thread , i am running the machine to see how things go and am going to post sunday afternoon about how things are working ... a sort "testing phase" . he did reply with resetting the IE settings ... this did not fix the problem .

so far , this is the only issue that there is and it was one of the symptoms from the beginning .

i do not know if the problem with the integrated search happened before or during the infection(s) ... the laptop belongs to a friend that is truly a "button pusher" . not that i would ever want to say ill about anyone ... but ...

did you ever know someone and the thoughts of them with a screwdriver in their hand was plumb scary ?

[yardbird]

I still see your active in the Malware Forum !!!! You should direct your question to gammo! I am not part of the repair expert staff. But before gammo is done with you, post your IE problem to him. I don't want to be violating the rules. Someone higher than me can..... But I was told "once a user is in the Malware Removal Forum" he should confine his posts for the pc he is having trouble with... see what I mean... good luck over there... BTW: If you finish in that forum? and you have another problem you can post it in any of the other forums that fit the issue...someone will reply..

[CWB]

"But I was told "once a user is in the Malware Removal Forum" he should confine his posts for the pc he is having trouble with..." .

you are correct ... as in the army ; "follow your last order first and you can't go wrong" .

i did not quite understand the exacts .

as i cannot be 100% certain that the problem is not malware related it would be best to pursue the matter with gammo .

i was also going under the thoughts of (over there) they have "bigger fish to fry" .

thanks for the clarification on the matter .

[yardbird]

you got it CWB! in the army - once the Malware Removal Forum has you. its until your fixed...He's putting in lots of time reading your logs -free service. best regards

EDIT: @CWB - I just spoke to "gammo" he said go ahead & post your problem. post the issue right under this post,

EDIT #2 You were sent back here because your IE8 Search Providers is a Microsoft issue!

A forum of interest: http://social.msdn.microsoft.com/Forums/en.../iedevelopment/

another: http://msdn.microsoft.com/en-us/library/cc848862(VS.85).aspx

I only have one search provider - thats Bing in the top rt. box of the browser. You can re-post what you want to do, or what the problem is here or in the General forum.

[exile360]

Greetings

Please do the following, it may correct the issue:

Run the Fix Internet Explorer Utility:

• Please download the Fix IE Utility from Major Geeks and save it to your desktop.
  
• Extract the files and double click on Fix IE Utility.exe to run it
  
• Once it loads click on the Run Utility button
  
• Once it completes you will see a box that says Re-registered all files, click on OK
  

[CWB]

i ran the "fix ie utility" ... same problems as before .

i have also tried to run the MS "fix it" utility and it would not run ... says there's a problem .

will do some recon at the two addys provided above .

@ yardbird :

yep ... i use one search provider too , mine is google .

phoenix ... i lived near LHC for quite some time .

i loved going to apache salvage and reclamation .

[CWB]

i did a little research ...

seeings how one cannot completely uninstall IE(7) as it is integrated into the OS (just peachy) , i rolled back to 7 and did a reset from there ... the browser does not crash but i still cannot add any search providers .

sooo ... this pointed me towards a problem with IE7 or something in common with both .

i did some more digging and found that some individuals had the same sort of problem show up after installing "one note" .

any thoughts ?

[yardbird]

I use Google also! But I use Firefox or Orca browser over IE8..I hope another poster stops here with some ideas. 1. I would put (if you put back IE8) the browser to all MS defaults. Tools/Internet Options/Advanced Tab Restore & Reset.... I did find an MS site where someone has already posted topics like: Replying to IE8 not saving search providers

Website: http://answers.microsoft.com/en-us/default.aspx You can try the Search or Ask a Question

The Answer Forums has 2 posts in there already in Windows Vista/Internet Explorer if you can get in here: http://social.answers.microsoft.com/Forums...xplorer/threads

you may be able to follow it or post a question. Keep or Track this topic here in the event others may reply! regards & good luck

[exile360]

Please do the following:

• Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  reg query "HKCU\Software\Microsoft\Internet Explorer\SearchScopes" /s">"%userprofile%\desktop\Providers.txt"
  "%userprofile%\desktop\Providers.txt"
  del /f /q %0

  Once you've done that click on File and select Save As...
  

• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file Check.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Once it finishes it will open the file it created in notepad, please copy and paste the file's contents into your next reply.
  

[CWB]

thanks for the info and leads ...

i will pursue the matter and post my findings .

yeah , simply using FF would be a "work around" and (in my opinion) a better way to go ... however ...

there are a few sites out there that do not support FF and work through IE , netflix is one that readily comes to mind .

granted , one does not need the search function in order to navigate to netflix and watch movies ...

mine is more the case of trying to get a better handle on things when (not "if") due to mal/scum/foistware (etc.) more severe damage is done to IE .

the more personal side of this is "fixing it right" ... if i took my car to the bodyshop and they had fixed everything except for a ding in the driver side door it would cause my skeptical eyebrow to raise a few degrees .

for better or worse , IE is still used by a vast number of users , myself included .

alternative browsers are and have made headway in the last few years ... much as ubuntu has in the area of the OS .

[CWB]

i forgot to install IE8 ... early , low caffeine light blinking .

i ran the batch file , the icon disappeared from the desktop , a cmd window popped up very briefly ... it has been 10 minutes and nothing has shown up .

[exile360]

So no text file opened? Try this one, it will create a text file on your desktop, open it and copy and paste its contents into your next reply:

Create a Batch File:

• Please copy and paste the following text in the Code box exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  reg query "HKCU\Software\Microsoft\Internet Explorer\SearchScopes" /s>"%userprofile%\desktop\Providers.txt"
  del /f /q %0

  
  

• Once you've done that click on File and select Save As...
  
• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file Check.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  

[CWB]

that one worked :

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes

Version REG_DWORD 0x2

DownloadUpdates REG_DWORD 0x0

UpgradeTime REG_BINARY D751555B4B4FCB01

i have also re-installed IE8 ... same ol' thing as i originally noted ... can't save providers . trying to add a provider causes IE to shut down .

[exile360]

I notice the "DefaultScope" entry is missing, meaning it doesn't appear to even have Bing/MSN installed. Here's the output from my system when I run the same command:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes
	DefaultScope	REG_SZ	{32D76A86-E5EE-4110-A69C-297575DBE4AB}
	DownloadUpdates	REG_DWORD	0x1
	Version	REG_DWORD	0x2
	UpgradeTime	REG_BINARY	0FD307EA86EBCA01

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
	Deleted	REG_DWORD	0x1

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{20026263-A1AB-4C56-84FD-759F4102898E}
	DisplayName	REG_SZ	exile360's Malware Hunter
	URL	REG_SZ	http://www.google.com/cse?cx=010696523659172078663%3An61yczlbdhw&ie=UTF-8&q={searchTerms}&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3D010696523659172078663%3An61yczlbdhw
	Codepage	REG_DWORD	0xfde9
	OSDFileURL	REG_SZ	http://www.microsoft.com/windows/ie/searchguide/spbuilder.mspx?Encoding=UTF-8&Name=exile360's%20Malware%20Hunter&URI=http%3A%2F%2Fwww.google.com%2Fcse%3Fcx%3D010696523659172078663%253An61yczlbdhw%26ie%3DUTF-8%26q%3DTEST%26siteurl%3Dwww.google.com%252Fcse%252Fhome%253Fcx%253D010696523659172078663%253An61yczlbdhw
	FaviconURL	REG_SZ	http://www.google.com/favicon.ico
	FaviconPath	REG_SZ	C:\Users\Exile7x64\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{20026263-A1AB-4C56-84FD-759F4102898E}.ico
	SortIndex	REG_DWORD	0x2

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{32D76A86-E5EE-4110-A69C-297575DBE4AB}
	DisplayName	REG_SZ	Scroogle
	URL	REG_SZ	http://www.scroogle.org/cgi-bin/nbbw.cgi?Gw={searchTerms}
	Codepage	REG_DWORD	0xfde9
	OSDFileURL	REG_SZ	http://www.microsoft.com/windows/ie/searchguide/spbuilder.mspx?Encoding=UTF-8&Name=Scroogle&URI=http%3A%2F%2Fwww.scroogle.org%2Fcgi-bin%2Fnbbw.cgi%3FGw%3DTEST
	FaviconURL	REG_SZ	http://www.scroogle.org/favicon.ico
	FaviconPath	REG_SZ	C:\Users\Exile7x64\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{32D76A86-E5EE-4110-A69C-297575DBE4AB}.ico
	SortIndex	REG_DWORD	0x4

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C92582B2-9292-48D0-9C92-D91DA9D5C787}
	DisplayName	REG_SZ	Wikipedia (en)
	URL	REG_SZ	http://en.wikipedia.org/w/index.php?title=Special:Search&search={searchTerms}
	ShowSearchSuggestions	REG_DWORD	0x1
	SuggestionsURL_JSON	REG_SZ	http://en.wikipedia.org/w/api.php?action=opensearch&search={searchTerms}&namespace=0
	SuggestionsURL	REG_SZ	http://en.wikipedia.org/w/api.php?action=opensearch&format=xml&search={searchTerms}&namespace=0
	OSDFileURL	REG_SZ	http://en.wikipedia.org/w/opensearch_desc.php
	FaviconURL	REG_SZ	http://en.wikipedia.org/favicon.ico
	FaviconPath	REG_SZ	C:\Users\Exile7x64\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{C92582B2-9292-48D0-9C92-D91DA9D5C787}.ico
	SortIndex	REG_DWORD	0x3

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F5A698C3-C93F-44A0-AC01-5F09F08F6FFE}
	DisplayName	REG_SZ	Google
	URL	REG_SZ	http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
	ShowSearchSuggestions	REG_DWORD	0x1
	SuggestionsURL_JSON	REG_SZ	http://suggestqueries.google.com/complete/search?output=firefox&client=IE8&qu={searchTerms}
	SuggestionsURL	REG_SZ	http://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding}
	OSDFileURL	REG_SZ	http://download.microsoft.com/download/A/3/C/A3C89D63-E2F0-460D-9F5F-23B51EA52B5E/Google.xml
	FaviconURL	REG_SZ	http://www.google.com/favicon.ico
	FaviconPath	REG_SZ	C:\Users\Exile7x64\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{F5A698C3-C93F-44A0-AC01-5F09F08F6FFE}.ico
	SortIndex	REG_DWORD	0x2

You'll notice where mine says DefaultScope REG_SZ {32D76A86-E5EE-4110-A69C-297575DBE4AB}, meaning I currently have Scroogle set as my default. Yours doesn't show that entry, nor any search providers listed in any subkeys like mine does. We could try manually adding one into the registry, but I'm doubtful that it would help. Something is causing IE to crash, but I don't know what it is. It is likely related to the MS Fix-it issue, the same reason it can't run is likely the same reason IE crashes when you try to add search providers.

I'll see if I can find out exactly what that MS Fix-it does as it may give me a clue as to what the cause of the problem is.

[exile360]

OK, I think I found it but I want to make sure before I try to fix anything. Please do the following:

Create a Batch File:

• Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  reg query "HKEY_CLASSES_ROOT\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32" /s>"%userprofile%\desktop\Providers.txt"
  "%userprofile%\desktop\Providers.txt"
  del /f /q "%userprofile%\desktop\Providers.txt"
  del /f /q %0

  Once you've done that click on File and select Save As...
  

• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file Check.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Once it finishes it will open the file it created in notepad, please copy and paste the file's contents into your next reply.
  

Thanks

[CWB]

here you go :

HKEY_CLASSES_ROOT\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32

(Default) REG_SZ C:\Windows\system32\ieframe.dll

i see what you mean about entries missing .

it seems like a chunk is gone .

[exile360]

Darn, I was hoping that would be the issue. That entry is correct (the one you just posted). That means the cause is elsewhere, but I'm unsure where to look next.

I'll see if I can track down anything else from MS that may be of help.

[CWB]

sounds good ...

yeah , sometimes things aint always as easy as we would like them to be ...

but man , it would be nice just to have one every now and then !

[exile360]

I have a possible fix, but before you try it you need to create a backup in case we need to roll back the changes made:

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Note: If using Windows Vista or Windows 7 you will need to read the FAQ for additional precautions and instructions on proper use.

• Please download ERUNT from here
  
• ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
  
• Double click on erunt-setup.exe to Install ERUNT by following the prompts.
  
• Use the default install settings but say NO to the portion that asks you to add ERUNT to the Start-Up folder. You can enable this option later if you wish.
  
• Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
  
• Choose a location for the backup.
  
  • Note: the default location is C:\Windows\ERDNT which is acceptable.
    

  [*]Make sure that at least the first two check boxes are selected.

  [*]Click on OK

  [*]Then click on YES to create the folder.

Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

Once that's done, please do the following:

Note: Please print or save these instructions as you'll be closing this browser window shortly during the removal process.

Create a Reg File:

• Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor):
  

  Windows Registry Editor Version 5.00
  
  [-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]

  Press Enter twice on your keyboard to insert 2 blank lines at the bottom of the text file
  

• Once you've done that click on File and select Save As...
  
• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file Fix.reg (the .reg extension is very important)
  
• Save the file to your desktop but do not run it yet.
  
• Close all instances of Internet Explorer, including this web page then double-click the Fix.reg file you just created.
  
• When prompted by User Account Control, click Continue and then click Yes when asked if you want to add this information to the registry.
  

Open Internet Explorer again and see if you can now add search providers or not.

Please let me know how it goes.

Thanks

[CWB]

ok ... will do .

starting in on it now ...

will report back asap .

thanks .

[CWB]

same ol' same ol' ...

IE opens up , after a few seconds the "add providers" blurb page opens , click on "add google" ... nothing is saved to the providers list .

slicking on the search window in the browser causes the IE shut down , send report and auto-restart .

when IE is re-opened the same cycle repeats .

i tried saving three different provders ... including bing .

[exile360]

Alright, it was worth a shot. I've got another idea, but first I want to see the condition of the SearchScopes key after the previous step before we continue:

Create a Batch File:

• Please copy and paste the following text exactly as written into notepad (not wordpad or any other text editor):
  

  @echo off
  reg query "HKCU\Software\Microsoft\Internet Explorer\SearchScopes" /s>"%userprofile%\desktop\Providers.txt"
  "%userprofile%\desktop\Providers.txt"
  del /f /q "%userprofile%\desktop\Providers.txt"
  del /f /q %0

  Once you've done that click on File and select Save As...
  

• In the Save dialogue box click on the drop down menu next to Save as type and select All Files
  
• Name the file Check.bat (the .bat extension is very important)
  
• Save the file to your desktop and double click it to run it.
  
• Once it finishes it will open the file it created in notepad, please copy and paste the file's contents into your next reply.
  

Thanks

[CWB]

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes

DownloadRetries REG_DWORD 0x0

ps ... i did a sfc /scannow a couple of days ago ... i truncated the file to the "non-repaired" items .

i can send this if you think it would help .