[grey5730]

Out of the blue my nephew was unable to play his bingo games on Lycos. It seemed a problem with Java. I tried resetting the settings to allow it, but that did not work. No matter what we did we could not get his online games to work. I went to the Windows Update page to see if maybe when last we did an update it had reset things to its own liking (it seems to do that a LOT), but I couldn't even access Windows Update. I also found that I could no longer access his computer using pcAnywhere. The troubles seem progressive, since when he first began having troubles I could still use the pcA, but after a bit I could not.

I tried running the Panda ActiveScan, but it would not let me do that. I tried running the Kaspersky scan, with no better luck. So. SOMEthing has invaded my nephew's machine.

I tried downloading HJT, but a window popped up telling me that I did not have authorisation to download such things to the compter. I also could notI DL the Vundo.exe -- however, since I have these proggies on my own machine, I emailed them to his machine as attachments. I have run the HJT and here is his log:

Logfile of HijackThis v1.99.1
Scan saved at 11:24:46 AM, on 10/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Documents and Settings\Owner\My Documents\Services\SETI\seti_service.exe
C:\Documents and Settings\Owner\My Documents\Services\SETI\setiathome.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Blitzz\BWU713\WU713STA.EXE
C:\WINDOWS\system32\PRISMSVR.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\SETI@home\[email protected]
C:\Program Files\SETI@home\[email protected]
C:\Documents and Settings\Owner\My Documents\Proggies\AtomicTimeSync\ats.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Documents and Settings\Owner\My Documents\Services\KeepRAS\KeepRAS.exe
C:\Program Files\ToolBox\Toolbox.exe
C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us8.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.iwon.com/i...G=home&SEC=bnav
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us8.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us8.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [WU713STA.EXE] "C:\Program Files\Blitzz\BWU713\WU713STA.EXE" /START
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\WINDOWS\system32\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [seticlient] C:\Program Files\SETI@home\[email protected] -min
O4 - Startup: NaturalColorLoad.lnk = ?
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSubtract.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: [email protected] = C:\Program Files\SETI@home\[email protected]
O4 - Global Startup: Shortcut to ats.lnk = C:\Documents and Settings\Owner\My Documents\Proggies\AtomicTimeSync\ats.exe
O4 - Global Startup: Shortcut to KeepRAS.lnk = C:\Documents and Settings\Owner\My Documents\Services\KeepRAS\KeepRAS.exe
O4 - Global Startup: Toolbox.lnk = C:\Program Files\ToolBox\Toolbox.exe
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgree...eensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1127104041296
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://a284.g.akamai...aploader_v6.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SETI@Home Service (SETI@Home) - Unknown owner - C:\Documents and Settings\Owner\My Documents\Services\SETI\seti_service.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Thanks in advance,
Grey

[Advertisements]

Hi There

I am UKBiker and I will be helping you with this log.

let me read through it and see what is happening, then I shall post back later.

[ukbiker]

Hi There

I am UKBiker and I will be helping you with this log.

let me read through it and see what is happening, then I shall post back later.

[grey5730]

Will keep watching for your words of wisdom!

Cheers,
Grey

[ukbiker]

Hi there

There is nothing obvious in the log, but a few other things need to be checked out.

You mention that you use the Kerio Personal Firewall. You also have the Norton Firewall installed as well. Please ensure that only 1 firewall is enabled.

Try disabling All firewalls temporarily and see if that restores functionality.

To temporarily disable Norton Personal Firewall
1 In the main window, click Security.
2 In the lower-right corner of the window, click Turn
Off.
Norton Personal Firewall is automatically turned back on
the next time that you start your computer.


To disable the Kerio Firewall
1 Double click on the Kerio Icon in the systray
2 Right click and select "Disable" from the menu.

Let me know how you get on.

[grey5730]

Hi there

I'd already done that, to no avail (sorry I didn't mention that in the original post). We don't use Norton's firewall, nor the one they've put in XP. I pulled up the Norton AntiVirus, and there is no 'Security' tab there for me to click on, but I disabled the AutoProtect. I also disabled the Kerio, and checked to make sure the MS firewall was off.

I've got him sitting at his machine going through all of this again, just to be certain we didn't miss something the first time.

Nada. Nothing. Not a sausage. Still can't access a game, log in to anything, DL anything or use Windows Update. *sigh*

Okay, kind sir, where do we go from here?

Frustratedly,
Grey

[ukbiker]

Hmm
Ok then. From what I can see, all these features that you are in difficulty with require activex, not Java. make sure that Activex is enabled, also that 3rd party cookies are as well.

[grey5730]

The ActiveX controls were off, so I had him turn them on. I had him check cookie settings, and both 1st and 3rd party cookies were set to 'Prompt' as they always were. Still no joy. Still can't login to anything, still can't get to Windows update. I am having him check other settings in the Windows Update instructions again, although I'd already done that, too. Just making sure we haven't missed anything . . .

It's looking more and more like a systems restore, isn't it?

With fear and trepidation,
Grey

[ukbiker]

Hiya

Just do a system restore back to a date when it was working OK, you wont lose anything like emails and docs. Did this start happening after an event, ie a download or install? But First,

The other thing you might try is clearing all your temp Internet Files, temp files and cookies and having another go first.

What error did you get when you tried to get to the windows update page?

[grey5730]

Hiya

Just do a system restore back to a date when it was working OK, you wont lose anything like emails and docs.  Did this start happening after an event, ie a download or install? But First,

The other thing you might try is clearing all your temp Internet Files, temp files and cookies and having another go first.

What error did you get when you tried to get to the windows update page?

Hi there,

The error message griped about several things, including wanting us to add several URLs to the 'trusted sites' which we did. There was a problem with a couple of the URLs, however, since the 'trusted sites' box bellyached that all the URLs had to have 'https' and not just 'http' or it would not accept them, yet the Windows Update error message said to cut and paste the URLs that it gave us. Well, I told him to add that 's' to the URLs, even though they specifically said just to cut'n'paste, and now he can at least access the site (we have not yet tried to do a Windows Update, however).

Meanwhile, back at the ranch, he still can't access anything else that requires him to login. He tried to go to his personal startpage, and here is, in part, the error message he got (sans instructions on how to change the settings):

'Right now, your browser's settings are configured to disable cookies and/or javascript. In order to access your account, you must change your browser's settings to accept both cookies AND javascript.'

This is wrong. He HAS enabled cookies (at least to prompt, although we did, just for giggles'n'grins, temporarily allow ALL cookies, just to see if it would make a difference -- it did not), and javascript IS enabled.

And he still can't get to his bingo thingummy (bingo zone? It's that Lycos game site) to pull up a game.

Ran a cleanup and rebooted -- AGAIN. Still no joy.

Something strange: when he first tries to open an IE window, at the bottom of the window he gets a message about 'detecting proxy settings.' I've never seen that before all this mess started. I wonder if that's related somehow.

Oh, and I almost forgot: No, this did not start up after any particular event. The only thing he's downloaded and installed was that 'snapfish' thing from Walgreen's Photo, and that was running fine, and the machine was running fine for a few weeks after he installed it. That's the only thing he says he's done to his computer.

If we have to do a system restore, if I take him back a couple of months, will he lose the firewall settings (Kerio)? If so, I'll want to copy them down before we do, cos he needs specific permissions for various things that *I* need him to do! LOL (he helps out with testing in the 3d environment -- which reminds me, I just had him try to get into one of our worlds, and it works fine).

Okey dokey, what's next? System restore? How do I go about that? I know, I know, that question is SO lame, but I honestly forget!

Grey

[ukbiker]

Hiya

Im not sure if the kerio settins will alter, best copy them just in case. Dont forget, you can always undo the sys restore. You might like to think about a replacement for kerio by the way as it is being discontinued in December.

I just had a thought, try disabling your security apps 1 by 1, starting with spywaregaurd, and see if thats where the block is
also, check that the settings for activex, java and cookies are correct in both IE and Kerio

[grey5730]

Hiya

Im not sure if the kerio settins will alter, best copy them just in case. Dont forget, you can always undo the sys restore. You might like to think about a replacement for kerio by the way as it is being discontinued in December.

I just had a thought, try disabling your security apps 1 by 1, starting with spywaregaurd, and see if thats where the block is
  also, check that the settings for activex, java and cookies are correct in both IE and Kerio

I'll have him copy the settings from Kerio for me and email them to me, so we'll both have a copy of his settings (mine are different and I have a LOT more of them, so we can't just rely on using mine for a template). Let's talk more about a new firewall later, I'd like your input -- but right now the more pressing issue is this mess on his machine.

I'd already tried disabling all the anti-spyware and security apps, but it didn't work then and it didn't work this time either.

Something strange and rather disquieting: he seems to NOW have 'viewpoint' on his machine, which was not there before all this mess started. I had him do a search for recent changes, and this seems to have been installed on 16th September. It does not show up in the 'add or remove programmes' in his control panel (it DID show up on MY computer when I was having difficulties, but I was able to uninstall it and it did not reinstall itself). I have not deleted this folder until I hear what you want me to do about this.

The Kaspersky and Panda scans are still inaccessible. He can get to their web page, but clicking on the scan button does nothing.

*sigh*

[ukbiker]

Hiya

Viewpoint is bundled with AOL, so he will have got it with AIM, dont worry, its not an issue. You are being blocked from the scans because they cannot download the activex they need.

Go for the system restore - it wont hurt.

go, Start>programs>accesories>system tools>system retore.

[grey5730]

Hiya

Viewpoint is bundled with AOL, so he will have got it with AIM, dont worry, its not an issue.  You are being blocked from the scans because they cannot download the activex they need.

Go for the system restore - it wont hurt.

go, Start>programs>accesories>system tools>system retore.

Okay, I'll try that. I'll get him started copying down the 'rules' for the firewall, and we'll do a restore back to sometime around August or so (if that's possible). I PRAY that this will fix his blasted machine -- if it doesn't I think I'll crown him with it.

Back soon,
Grey

[grey5730]

It worked!!! Thank you, kind sir! You are a gentleman and a scholar!

Errant Nephew is happily testing out all his favourite pages. His start page is good to go, his bingo/Lycos/ thingummy seems to work just fine.

The only folder it renamed was the Cleanup, which I will reinstall shortly. It appears that the Microsoft Anti-Spyware app may also have to be reinstalled, as it does not appear in the systray, but we'll check that out later.

Meanwhile, I'm sending him first to Panda and then to Kaspersky, just to be sure. He is currently running the Panda scan. Will get back to you with results.

Looks like this MIGHT have cured the bloody thing. Keep your fingers crossed for us!

Cheers,
Grey

[ukbiker]

do not install cleanup! we have found some problems with it recently so just hold of on that one.