[jpetersen]

Hello!

Have Windows XP Prof. SP 2
Pentium III
D-Link DI-624 router
cable connection provided by Cebridge.net

Trying to go to hotmail log-in and other sites, receive:
"page cannot be displayed" (IE)
"cannot find server " ( Mozilla Firefox)
"Action Canceled" or "Page cannot be displayed" (Smart Explorer, evaluation version)

Sites that cannot be accessed:

microsoft sites, except homepage loads
microsoft updates
hotmail.com, hotmail.msn.com
pcpitstop
ebay except homepage loads
dell, all sites!
msn.com works sometimes


Windows Inst. Messenger doesn't work. MS reports that it cannot do troubleshooting

Remote assistance does not work.
says mesenger not installed. Link for installing brings up error page (page cannot be displayed)


Cannot Windows XP restore to any available date !!


Secure sites work ok

ISP walked me through a settings check, including LAN settings. took me through pings, ipconfig renew, resetting modem and router.

ISP is Cebridge.net and they had an outage here May 15 right about the same time as when the problems started.

Cebridge sent out a tech who checked the connection with his computer and said the problem lies in some setting somewhere within the bowels of my computer. He said let him know what the problem is when I find it!


Did these:
did netsh int reset all and ipconfig/flushdns

Tried "automatically detect settings"

Told tools-options that the sites were trusted sites

Tried disabling all of the following:
Norton Anti-Virus in Systemworks 2003
WindowsFirewall
Microsoft Anti-spyware real-time protection
Spyware Dr OnGuard
Disabled all at once, too!



Javascript enabled
SSL 2.0 and 3.0 are checked




Here's the log, from last night:

Logfile of HijackThis v1.99.1
Scan saved at 12:23:54 AM, on 6/1/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\ArtecUSB\ScanPanel\ScnPanel.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\alg.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Opera\Opera.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://pccreg.antivi...0&VID=&PID=CIC0
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {CB5B2BC6-F957-4D8A-BE67-83F3EC58BA01} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\Run: [SpySweeper] "C:\RECYCLER\NPROTECT\00296607.EXE" /0
O4 - Global Startup: ScanPanel.lnk = C:\Program Files\ArtecUSB\ScanPanel\ScnPanel.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O15 - Trusted Zone: www.msn.com
O15 - Trusted Zone: www.hotmail.msn.com
O15 - Trusted Zone: http://www.paypal.com
O15 - Trusted Zone: http://www.realtor.com
O15 - Trusted Zone: http://www.rollanews.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.h.../qdiagh.cab?326
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe



Thank you very much

jpetersen
Lebanon, MO, USA

[Advertisements]

Hi jpetersen :

I only have one suggestion for you while you are waiting for someone to read your log. Try searching through the registry (after you have made a backup of it) and see if you can find any keys which may have Internet Explorer locked down. Something like this :

1) Click Start button then click Run. Type in regedit and click OK.
2) From Edit Menu in Registry Editor, click Find and either enter ‘restrictions’ (without quotes) or go directly to
KEY_CURRENT_USER/Software/Policies/Microsoft/Internet Explorer/Restrictions. Right click on NoBrowserOptions in right window pane, select Modify. If Value data is 1, set to 0 (Base Hex selected by default). May have to restart computer for change to take effect.


BTW, you might want to go to the Malware Section of this forum and read/follow the instructions posted there for doing a malware search/removal. That is the part of the forum that you should have posted your Hijack This log, but hopefully someone will help you here with it.

Ron

[Major Payne]

Hi jpetersen :

I only have one suggestion for you while you are waiting for someone to read your log. Try searching through the registry (after you have made a backup of it) and see if you can find any keys which may have Internet Explorer locked down. Something like this :

1) Click Start button then click Run. Type in regedit and click OK.
2) From Edit Menu in Registry Editor, click Find and either enter ‘restrictions’ (without quotes) or go directly to
KEY_CURRENT_USER/Software/Policies/Microsoft/Internet Explorer/Restrictions. Right click on NoBrowserOptions in right window pane, select Modify. If Value data is 1, set to 0 (Base Hex selected by default). May have to restart computer for change to take effect.


BTW, you might want to go to the Malware Section of this forum and read/follow the instructions posted there for doing a malware search/removal. That is the part of the forum that you should have posted your Hijack This log, but hopefully someone will help you here with it.

Ron

[jpetersen]

Thank you, Major!
No restrictions found under
HKEY_CURRENT_USER/Software/Policies/Microsoft/Internet Explorer

only 2 items there:
(Default) value = REG_SZ
Homepage value = REG_DWORD

If I have not followed your instructions correctly, let me know.

I will now proceed to move my post over to the malware section.
Thank you very very much, Major

jp

[muskolous]

Hi jpeterson

I was just wondering if you have solved your problem. I have the exact same thing on my parents machine. Have you any pointers?

Thanks

muskolous

[jpetersen]

Hello, Musk,
Just yesterday I absent-mindedly clicked on a dell site and browsed around to figure out the price on a new computer because I'm always dreaming of new one. Afterwards, I realized that was one of the sites I couldn't access!
So I went to hotmail and sure enough, there's the log-in page which I hadn't seen in over a month now. And everything is working just fine, thank you.
Since I did absolutely nothing to get this working, I can only surmise it's my stupid ISP. Every time I have had a problem, they first, blame my router. Then when that is shown to work, they blame my computer. If they would have just admitted this one was on their end, it would have saved me hours and hours of frustraction.

On another subject, today I uninstalled Norton Systemworks, the anti-virus never found anything anyway, and went and downloaded AVG anti-virus
( www.grisoft.com )
I understand this is a very good program, plus it's free.

I wish you well with your problem.
JP
PS my ISP is cebridge.net We wouldn't have the same one, would we?

[jpetersen]

Free version of AVG is here
http://www.grisoft.c...ng/ww/tpl/tpl01

or do search on home page for "free"

jp