Options

IExplorer problem - Hijack this log included. Pls help a.s.a.p?

Unknown
edited January 2005 in Spyware & Virus Removal
Hello people, im a new member here. I've ran into some major problems with my internet, and while trying to fix them (with no luck) I ran into this website! Looks good and I hope you all can help me?

Here's the problem.

About a week back i've had something go wrong. I have no idea what it is as I am a relative newbie at computers, but I know what it does!

The main thing it does is, it stops me from entering secure websites such as MSN hotmail, mail.go.com, even my MSN explorer! I cant access web-shopping sites either. The "page cannot be displayed" with "Cannot find server or DNS Error, Internet Explorer" message comes up each time.

I run AOL 9.0 with DSL & IExplorer 6. I have been told (by AOL) to re-install both my modem drivers and AOL. I did these with no affect. IExplorer will not re-install. I can download the setup file from Microsoft, but when I run setup it does not allow me to install the program.

I have also been told to (by AOL) to turn off Iexplorer security and content advisor. Still, no affect.

I ran hijackthis and noticed O17 entries with ISP numbers beside them. After a bit of research, I found these may be bad and I should get rid of them? I dont want to do anything yet as to not completely mess-up my PC. I hope that with your help the problem may be resolved.

I've just downloaded and installed new versions of Spybot & ad-aware and Trojan hunter. Spybot found a few things and ad-aware found a lot. There were no trojans detected. So, i've run the 'hijackthis' again and the O17's are still there. My internet problem still remain.

I have run hijackthis and need help to determine if the problem may lie here?

Here is the new hijackthis log:

Logfile of HijackThis v1.99.0
Scan saved at 16:08:05, on 10/01/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\System32\GSICON.EXE
C:\WINDOWS\System32\dslagent.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\WINDOWS\System32\ctfmon.exe
E:\Spybot\Spybot - Search & Destroy\TeaTimer.exe
E:\AOL\AOL 9.0\AOL 9\AOL 9.0\aoltray.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
E:\AOL\AOL 9.0\AOL 9\AOL 9.0\waol.exe
E:\AOL\AOL 9.0\AOL 9\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Documents and Settings\Ish\Local Settings\Temp\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe Reader 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [THGuard] "E:\Program Files\Trojan hunter\TrojanHunter 4.0\THGuard.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Spybot\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = E:\AOL\AOL 9.0\AOL 9\AOL 9.0\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531617909
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C09099C-D9EB-4D0F-9706-0416940E0091}: NameServer = 195.93.32.134
O17 - HKLM\System\CCS\Services\Tcpip\..\{62F25100-262D-4436-AA91-B0DA33042293}: NameServer = 152.163.0.26 205.188.64.153
O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE

Could someone help me please? Thank you, Mo.

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Fix this entry; O17 - HKLM\System\CCS\Services\Tcpip\..\{4C09099C-D9EB-4D0F-9706-0416940E0091}: NameServer = 195.93.32.134
    It's an Amsterdam address.

    Close IE and go to Start > Run and run the following commands one after the other, each line followed by 'enter':

    regsvr32 shdocvw.dll
    regsvr32 urlmon.dll
    regsvr32 comcat.dll
    regsvr32 actxprxy.dll
    regsvr32 Shell32.dll
    regsvr32 Oleaut32.dll
    regsvr32 Mshtml.dll
    regsvr32 jscript.dll

    Run each line individually. After each run, you should see a short message stating the command was successful. Reboot.
  • momoghal
    edited January 2005
    Hi, thanks for the help justlooking but it did not help. The O17's have dissapeared after I fixed the entry u told me to, but the IExplorer problem still persists. Do you or anyone else have any more ideas?

    Here is an updated log;

    Logfile of HijackThis v1.99.0
    Scan saved at 15:34:00, on 11/01/2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    C:\WINDOWS\System32\drivers\CDAC11BA.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    C:\WINDOWS\System32\atiptaxx.exe
    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    C:\WINDOWS\System32\GSICON.EXE
    C:\WINDOWS\System32\dslagent.exe
    C:\WINDOWS\System32\ctfmon.exe
    E:\Spybot\Spybot - Search & Destroy\TeaTimer.exe
    E:\AOL\AOL 9.0\AOL 9\AOL 9.0\aoltray.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\wbem\wmiprvse.exe
    C:\Documents and Settings\Ish\My Documents\Setup Files\HijackThis.exe
    C:\WINDOWS\System32\wuauclt.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Adobe Reader 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Spybot\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
    O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
    O4 - HKLM\..\Run: [THGuard] "E:\Program Files\Trojan hunter\TrojanHunter 4.0\THGuard.exe"
    O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
    O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Spybot\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: AOL 9.0 Tray Icon.lnk = E:\AOL\AOL 9.0\AOL 9\AOL 9.0\aoltray.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097531617909
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Try running IEFIX.htm which will repair IE and run a System File Check.
  • momoghal
    edited January 2005
    I ran the IEfix.htm program you suggested however, when it asked to re-install IExplorer.exe I clicked on 'ok'. During installation of a setup file which I downloaded from Microsoft, it came up with the error

    "the software you are installing did not pass windows logo testing to verify its compatability with windows XP"

    Each time I tried to re-install Iexplorer before, this message comes up. Also in control panel, add-remove programs - the Internet explorer is not there (before I ran IEfix.htm), therefore I cannot use the repair function either.

    What should I do?

    I've considered re-installing Windows XP as im getting fed up...

    Thank you justlooking, your help has been greatly appreciated
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    You should find IE in add\remove programs under Windows Components.

    Open IE and go to Tools\Internet Options. Go to security and click the default button. Hit apply then OK.
  • momoghal
    edited January 2005
    The IEfix program has removed Iexplorer now! I clicked on the 'apply' button to reset the value to '0'. Then clicked on the re-install button. It removed Iexplorer completely and the same error came up as before when trying to re-install Iexplorer. Its completely gone now.

    I already tried resetting the security to default before with no effect. I think its best to re-install windows now. I dont think i'm going to be able to fix this. Thanks for the help though! Much appreciated!
Sign In or Register to comment.