[rowal5555]

This problem has surfaced over the last couple of days without any alterations I remember. Go to save a picture, destination box comes up, busy icon comes up and IE simply disappears.
Ran disk cleanup and reset IE, but still same problem.
Any ideas?
Cheers

PS. This is only in XP.

[rowal5555]

The same thing is now happening in FireFox, but not in OPERA ?????????

You never know Rob and it's worth a shot but;

Your computer could be infected with Malware.

• Malware is software designed to infiltrate or damage a computer system without the owner's informed consent.
  It is a combination of the words malicious and software.
  The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.

• Required Cleanup Steps
  1. Disable the Spybot Search & Destroy TEA TIMER if you use it and if it is enabled
  2. Run a Temporary file and cache cleaner (ATF)
  3. Run 2 Anti-Malware scanners (Listed Below)
  4. Run an Online Anti-Virus / Anti-Malware Scanner (Listed Below)
  5. Clear out old System Restore points
  6. If continued Malware type activity is present you may be asked to post a TrendMicro™ HijackThis™ Log file, do not do so unless requested.

The reason to run multiple scanners is to ensure that no single scanner is missing something.
The time it takes will vary depending on your system and your internet connection speed.
Typically the SUPERAntiSpyware and Malwarebytes scanners will take between 10 to 90 minutes.
The ESET online scan should take between 1 to 3 hours.
In most cases, these scans will suffice to clean and disinfect your computer.
Heavily infected systems or slower PCs can take much longer to scan and clean.

For best results print the following instructions and bookmark this Web page
To keep this guide printer-friendly, use your cursor to highlight the contents below.
From your browser select File - Print and in the printer dialog box under "Print range"
click the Selection choice to print out these instructions for removal of malware.

____________________________________________

STEP 1

• Disable Spybot Search & Destroys' TEA TIMER: (if installed, if not go to Step 2)
  1. Run Spybot-S&D in Advanced Mode.
  2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
  3. On the left hand side, Click on Tools
  4. Then click on the Resident Icon in the List
  5. Uncheck "Resident TeaTimer" and OK any prompts.
  6. Restart your computer.

__________________________________________________

STEP 2

• Follow these instructions carefully.
• Download ATF-Cleaner from Snapfiles.com to remove un-needed temporary files from your computer that may contain malware.
• You can also download it from Majorgeeks.com
• When you run ATF-Cleaner, check the items as shown below for Main.
• For FireFox, be sure to click on the FireFox tab on top and check the items as shown below for FireFox
• NOTE: If you don't have FireFox or Opera installed then they will be grayed out and can be ignored
• Then click on "Empty Selected".

.

__________________________________________________

STEP 3

• Install and run the free version (not the Professional version) of SUPERAntiSpyware from SUPERAntiSpyware.com
  • Accept any prompts to allow SUPERAntiSpyware to install the latest rules and infection definition files.
  • You do not have to send them your e-mail address, just click next.
  • You can leave the automated check for updates on.
  • You can uncheck "Send a diagnostic report to research center" if you don't want to send the information.
  • DO NOT allow SUPERAntiSpyware to protect your Home Page settings.
  • On the Top Left select the Scan your computer button.
  • Make sure there is a CHECK MARK on all Fixed Drives.
  • Click "Perform a Complete Scan". Click "Next" to Repair issues found and reboot the computer when prompted to do so.

__________________________________________________

STEP 4

• Install and run Malwarebytes' Anti-Malware from Malwarebytes - (direct download)
  • Accept all defaults for the installer
  • Allow the program to update the definitions
  • Click on the Quick Scan and click Next.
  • If any items are found allow it to clean them and then Reboot your computer.

__________________________________________________

STEP 5

• Run an online scan with ESET from Free Virus Scan: Use ESET's Online Antivirus Scanner
  • You must use Internet Explorer for this online scan. FireFox, Opera, etc will not work for this scan.
  • If your computer is running Window's Vista, then you must first start Internet Explorer as an Administrator. To do so, right-click on the Internet Explorer icon in the Start Menu and select "Run as administrator" from the popup context menu.
  • Accept the terms and click "Start".
  • Once the scanner is ready, check "Remove found threats" AND "Scan unwanted applications".
  • Click "Start" to begin the scan.
  • When completed restart your computer

__________________________________________________

Make sure your internet firewall security is enabled, and then please return to Free PC Help and tell us how the computer seems to be operating.
At that time, you will receive instructions to assist you in removing malicious programs from your Add/Remove program list if warranted.

If required this is the download link for TrendMicro™ HijackThis™
Unless instructed to by the Technician helping you then do not download this tool.

Once you and the Technician agree that your system appears to be clean then you should delete all your System Restore points and recreate a new one.
Please follow the instructions here
How to turn off and turn on System Restore in Windows XP
How to turn off and turn on System Restore in Windows Vista

[rowal5555]

Thanks Bob.

SAS runs at 3am each day and I ran a quick scan with Live OneCare yesterday. Nothing showed up so I spent about 7 hours running the full scan. Still nothing so will do a few more.

OneCare has just made a new restore point, so have deleted the old ones.

Cheers

Get back to us when all is done Rob please mate.

[rowal5555]

All flushed out and appear to be squeaky clean but the same problem exists. Doesn't matter whether I choose to show non-secure items or not so figure it has to be a setting in IE as no problem in FF now.

Will remove SP3 and reinstall IE7 if necessary, but will wait for further comments for a while.

Update. Have 2 instances of mcieplg.dll showing in WinPatrol IE Helpers which I think may be associated with Site Advisor. Going to get rid of them and see what happens.

[Seth]

Hi Rob,

Does this occur with both "Save Target As" as well as "Save Picture As"?

Can you copy/paste the picture on the desktop then open it?

Can you save any internet pictures?

[Seth]

I just though of something else Rob.

Try saving the picture to a couple of different folders and see what happens.

[rowal5555]

Hi Seth. Referring just to the image I am having trouble with - Copy and paste to Desktop - yes. Save Target As - greyed out. Trying this on another image worked on a background image, not foreground. Save to different Folder - IE doesn't stick around long enough, just disappears before I can even click SAVE. Getting rid of mcieplg.dll did no good. Suspect avisplitter.ax as contained in The KMPlayer and in the KLite Codec Pack as it is mentioned when I sometimes get an error msg before IE crashes. In the process of deleting and rebooting now. What a rigmarole, LOL, and now have lost all formatting in this post.

[rowal5555]

Early days, but appear to have cracked it after a great kerfuffle.

Deleted KM and KLite and rebooted but IE would not even start.

Restarted but Windows would not shut down requiring a hard reboot. Tried again and the same thing happened so installed UPHClean which has been sitting in my Download folder for weeks. Next reboot went smoothly.

Only had one try so far, but the problem image now saves OK, and Save Target As is now available, so fingers are crossed that this will continue.

Would be interested in any ideas why this would happen out of the blue, as I have used these programmes without strife for years

Cheers all.

[Seth]

That was a weird one.

Seems like a farkled or incompatible update.