when starting winmx, wanting to download ieframe.dll

[dapperwin2]

just started today. I closed winmx, then when I re-launch, I get a file download box, asking me whether I want to save this file (ieframe.dll).
never got this before, of course, I didn't download, I cancelled. when I do this, I can go back into winmx.
don't seem to have any workaround.
currently have iwinmx closed until I find out what this is. am running rootkit scan, then I will run boot scan.
any advise??
thanks.

[dapperwin]

I have since found out that ieframe.dll has to do with internet explorer. strange,but I have made no changes or d/l anything  since last starting wiinmx.. why now???

[GhostShip]

It does sound rather fishy Dapperwin I agree 

MS usually update files however and it may be that they have updated something and left out support for some functions because they moved them to another code class, I hope this is the case and it was simply downloading the new DLL because of such a reason.

[dapperwin]

I ran malwarebytes, avast root kit, avast boot scan, and superspyware. no problems found. I checked my event viewer, and found hundreds of 'crypto' trying to use windows update--all in the last few days. I turned this off years (at end of support, still using xp). I'm thinking about removing winmx, then re-install. I also reset internet explorer-although I dodn't use it anymore.
Do you know any reason winmx uses this file ieframe.dll ??

[dapperwin]

I started up winmx again, and re-read popup boxes. It says it wants to save this file "http_403_webOC" , type "unknown type" FROM ieframe.dll.
it seems to me that it's ieframe.dll that is initiating the download.

[dapperwin]

Ghostship, do you know, does winmx reach out to the same destination ip address each time, for everyone? my firewall is recording winmx dest. ip addr of 70.127.57.85.DNS.
how would I know or check that this is correct??
Thanks!

[GhostShip]

Hi Dapperwin sorry for the delay in responding to you 

WinMX connects via peer caches so when you contact one of those they deliver a quantity of nodes for you to connect to. The IP you mentioned is not one of the peer caches but it traces back to Florida in the USA.

WinMx does has a legacy component in it that uses some small part of MS browser code as used by IE, the update bar in the top left corner is the culprit for this but its more likely your problem lies with your host file as that is one of the few ways you can hijack that box by pointing it to a different IP.

A hostfile hijack wont appear in any virus scan as its simply a text file.

Another option to ensure you dont have any "rogue" DLL files messing with your system is to run the system file checker , open a cmd window and type in "sfc /scannow"   that will help you replace any corrupt or dodgy dll file versions used by the O/S.

[dapperwin]

thanks good suggestions. the hosts file you mention is "hosts" in the windows/system32 folder, correct?? I checked that, and the only 2 lines (other than comments) are:
127.0.0.1       localhost
54.152.144.243   www.winmx.com
I need the sp3 disk for sfc to work..only have orig. sp1.. need to think on that one.

[dapperwin]

ghostship. when winmx is installed, I always put in 'winmx' folder in c drive. other than the 'hosts' file, do you know of any other files that are loaded when winmx is run?
If I checked the hosts file, and re-installed winmx (emptied winmx folder), and I am still getting error, where is it coming from?
thanks again.
also, have determined that http_403 means "This error (HTTP 403 Forbidden) means that this program was able to connect to the website, but it does not have permission to view the webpage."

[White Stripes]

I need the sp3 disk for sfc to work..only have orig. sp1.. need to think on that one.

turning on automatic updates should get you sp3 on the install you have now along with a lot of improvements over sp1

I have since found out that ieframe.dll has to do with internet explorer

the question here is what version of internet explorer do you have installed? you need at least IE6 for winmx to work (you may be able to get away with 5.5 but nothing older)...
winmx loads a little sliver of internet explorer in the 'update' bar at the top left... it once pointed to winmx.com for update notifications...

If I checked the hosts file, and re-installed winmx (emptied winmx folder), and I am still getting error, where is it coming from?

if your hosts file does not have a redirect for the update bar it will continue to show this 403 error.... if, however, winmx is connecting you can safely ignore this little 'goof'

it would be best to click the 'patch' link up in the upper left corner of this site and use that version.. no need to mess with hosts and the patch filters out fake files...

good luck

[dapperwin]

thanks white stripes.. I currently am running sp3. when running sfc, It is asking for the xp pro install disk, I only have the sp3 upgrade file from microsoft, and it won't accept that. if I use the orig. xp install, I might be overlaying older files on top of newer ones.  running IE8. no changes have been made to winmx,hosts,ie, etc. in years.. question is.. why am I receiving this message NOW? using winmx version 3.54beta. thanks

[dapperwin]

all this talk of 'hosts' file got me thinking... I commented out the winmx line in the host file (54.152.144.243   www.winmx.com),
 and the file download/security message now does not appear when I start winmx. yah!
very good, except I'm left with WHY did this suddenly start happening? things like this drive me crazy?
Can I assume this winmx like in host file was there all the time (perhaps from when I used earlier versions of winmx??)
thanks to all.

[GhostShip]

This is one of the reasons we support the dll connection method here because as sites shut down, go offline or their fixed IP is reallocated to new owners problems occur, as the dll is domain name based we can point it to any IP thus making it seamless to the end user when such things occur.

I dont even recognise the IP you mention which is suspicious in itself.

[dapperwin]

question. ever since I removed, then re-installed winmx, I can d/l files, however no-one can upload from me.. they all are getting 'waiting for incomming connection', then timed out-waiting for incoming...'. I have re-started pc, re-started modem, sometimes these work, but not now.
any advice??
thanks.

[White Stripes]

are you using the same ports and are they forwarded through your router?

[dapperwin]

duh. I changed my ports 6 months ago, I used the old ports when I reinstalled this last time with winmx. Now it works. thanks for the heads-up.