Options

Help!My internet connections and network don`t work any more.

Unknown
edited February 2005 in Spyware & Virus Removal
I have used Nvc and deleted 3 infected files with W32.NewDotNet.C and I have used both Spybot and Ad-Aware. The local IP adress and the networkmask have got a different adresses. I use DHCP and I have also tryed to install them manualy without helping. ( My TELES Isdn card is only for fax, not internetconnections)
Thank you and have a good day.

Logfile of HijackThis v1.99.0
Scan saved at 20:10:00, on 12.02.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Programfiler\Microsoft Hardware\Keyboard\type32.exe
D:\Programfiler\ahead\InCD\InCD.exe
D:\NORMAN\Nvc\BIN\ZLH.EXE
C:\PROGRA~1\FELLES~1\TerraTec\SCHEDU~1\TTTimer.exe
C:\Programfiler\Caere\OmniPagePro90\opware32.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programfiler\TELES\ISDN Tools\tisdnmon.exe
C:\Programfiler\Office Mouse\moffice.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programfiler\Office Mouse\MOUSE32A.DAT
D:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Programfiler\TELES\ISDN Tools\cwd.exe
D:\Norman\Nvc\BIN\Zanda.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\NORMAN\Nvc\BIN\nvcoas.exe
C:\WINDOWS\System32\alg.exe
D:\NORMAN\Nvc\BIN\NIP.EXE
D:\NORMAN\Nvc\BIN\NVCSCHED.EXE
D:\NORMAN\Nvc\BIN\NYMSE.EXE
D:\NORMAN\Nvc\BIN\NJEEVES.EXE
D:\NORMAN\Nvc\BIN\nipsvc.exe
D:\NORMAN\Nvc\BIN\npfmsg2.exe
D:\NORMAN\Nvc\BIN\cclaw.exe
D:\Programfiler\Real\RealOne Player\RealPlay.exe
D:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hardware.no/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.online.no:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\googletoolbar2.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Programfiler\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] D:\Programfiler\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\Programfiler\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [HGTXPEI] C:\WINDOWS\system32\FirstReboot.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [WinVNC] "D:\Programfiler\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [Norman ZANDA] D:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [TerraTec Scheduler] C:\PROGRA~1\FELLES~1\TerraTec\SCHEDU~1\TTTimer.exe
O4 - HKLM\..\Run: [OmniPage] C:\Programfiler\Caere\OmniPagePro90\opware32.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundFusion] RunDll32 hercplgs.cpl,BootEntryPoint
O4 - HKLM\..\Run: [TISDNMonitor] C:\Programfiler\TELES\ISDN Tools\tisdnmon.exe
O4 - HKLM\..\Run: [BPT] "C:\Program Files\Bpt\bpt.exe"
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programfiler\Office Mouse\moffice.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 1.1.3.lnk = D:\Programfiler\OpenOffice.org1.1.3\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\programfiler\newdotnet\newdotnet6_38.dll' missing
O16 - DPF: {1DA3C4AB-E6B6-47A6-B0F3-1BD81524B51B} (ActiveWorldsDownload Control) - http://www.activeworlds.com/products/ActiveWorldsDownload.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1.1.48-deleon/GoogleNav.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - https://www.gamespyid.com/alaunch.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_07) -
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} - file://H:\SuperCD\IntraLaunch.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - http://security1.norton.com/SSC/SharedContent/sc/bin/cabsa.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} - http://photos.msn.no/r/neutral/controls/MsnPUpld.cab?5,0,1730,0
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4288/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7B0A12AC-07A9-4531-9533-A6C12E857F01}: NameServer = 217.13.4.21,217.13.7.136
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA9D3700-B5BC-4C9E-9DC2-617211B514DF}: NameServer = 217.13.4.21,217.13.7.136
O17 - HKLM\System\CS1\Services\Tcpip\..\{7B0A12AC-07A9-4531-9533-A6C12E857F01}: NameServer = 217.13.4.21,217.13.7.136
O23 - Service: Norman API-hooking helper - Unknown - D:\NORMAN\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown - D:\NORMAN\Nvc\BIN\NJEEVES.EXE
O23 - Service: Norman Type-R - Unknown - D:\NORMAN\Nvc\BIN\NPFSVICE.EXE
O23 - Service: Norman ZANDA - Unknown - D:\Norman\Nvc\BIN\Zanda.exe
O23 - Service: Norman Virus Control on-access component - Norman ASA - D:\NORMAN\Nvc\BIN\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - D:\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: System Commander 7 MBR check - Unknown - C:\SC\WINMBR.EXE
O23 - Service: VNC Server - RealVNC Ltd. - D:\Programfiler\RealVNC\WinVNC\WinVNC.exe

Comments

  • Buckeye_SamBuckeye_Sam Columbus, Ohio
    edited February 2005
    Download this tool and run it on the affected computer. It will repair your connection.

    http://www.snapfiles.com/get/winsockxpfix.html
  • El-Gil
    edited February 2005
    Thank you for answering so quiclky I am online again.

    Logfile of HijackThis v1.99.0
    Scan saved at 00:01:27, on 14.02.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\Programfiler\Microsoft Hardware\Keyboard\type32.exe
    D:\Programfiler\ahead\InCD\InCD.exe
    D:\NORMAN\Nvc\BIN\ZLH.EXE
    C:\PROGRA~1\FELLES~1\TerraTec\SCHEDU~1\TTTimer.exe
    C:\Programfiler\Caere\OmniPagePro90\opware32.exe
    C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Programfiler\TELES\ISDN Tools\tisdnmon.exe
    C:\WINDOWS\system32\ntvdm.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Programfiler\Office Mouse\moffice.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Programfiler\Office Mouse\MOUSE32A.DAT
    D:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    D:\Norman\Nvc\BIN\Zanda.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programfiler\TELES\ISDN Tools\cwd.exe
    D:\NORMAN\Nvc\BIN\NYMSE.EXE
    D:\NORMAN\Nvc\BIN\NIP.EXE
    D:\NORMAN\Nvc\BIN\npfmsg2.exe
    D:\NORMAN\Nvc\BIN\nvcoas.exe
    D:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    D:\NORMAN\Nvc\BIN\NJEEVES.EXE
    D:\NORMAN\Nvc\BIN\nipsvc.exe
    C:\WINDOWS\System32\alg.exe
    D:\NORMAN\Nvc\BIN\cclaw.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Programfiler\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\System32\msiexec.exe
    C:\Programfiler\Internet Explorer\iexplore.exe
    C:\Programfiler\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\wuauclt.exe
    D:\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hardware.no/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.online.no:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\downloaded program files\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\downloaded program files\googletoolbar2.dll
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [POINTER] point32.exe
    O4 - HKLM\..\Run: [IntelliType] "C:\Programfiler\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] D:\Programfiler\ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [LogonStudio] "D:\Programfiler\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
    O4 - HKLM\..\Run: [HGTXPEI] C:\WINDOWS\system32\FirstReboot.exe
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Programfiler\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
    O4 - HKLM\..\Run: [WinVNC] "D:\Programfiler\RealVNC\WinVNC\WinVNC.exe" -servicehelper
    O4 - HKLM\..\Run: [Norman ZANDA] D:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [TerraTec Scheduler] C:\PROGRA~1\FELLES~1\TerraTec\SCHEDU~1\TTTimer.exe
    O4 - HKLM\..\Run: [OmniPage] C:\Programfiler\Caere\OmniPagePro90\opware32.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SoundFusion] RunDll32 hercplgs.cpl,BootEntryPoint
    O4 - HKLM\..\Run: [TISDNMonitor] C:\Programfiler\TELES\ISDN Tools\tisdnmon.exe
    O4 - HKLM\..\Run: [BPT] "C:\Program Files\Bpt\bpt.exe"
    O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Programfiler\Office Mouse\moffice.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: OpenOffice.org 1.1.3.lnk = D:\Programfiler\OpenOffice.org1.1.3\program\quickstart.exe
    O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: &Google Search - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\windows\downloaded program files\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
    O16 - DPF: {1DA3C4AB-E6B6-47A6-B0F3-1BD81524B51B} (ActiveWorldsDownload Control) - http://www.activeworlds.com/products/ActiveWorldsDownload.cab
    O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/en/deleon/1.1.48-deleon/GoogleNav.cab
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - https://www.gamespyid.com/alaunch.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.1_07) -
    O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} - file://H:\SuperCD\IntraLaunch.CAB
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - http://security1.norton.com/SSC/SharedContent/sc/bin/cabsa.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} - http://photos.msn.no/r/neutral/controls/MsnPUpld.cab?5,0,1730,0
    O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4288/mcfscan.cab
    O23 - Service: Norman API-hooking helper - Unknown - D:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown - D:\NORMAN\Nvc\BIN\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown - D:\NORMAN\Nvc\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown - D:\Norman\Nvc\BIN\Zanda.exe
    O23 - Service: Norman Virus Control on-access component - Norman ASA - D:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - D:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: System Commander 7 MBR check - Unknown - C:\SC\WINMBR.EXE
    O23 - Service: VNC Server - RealVNC Ltd. - D:\Programfiler\RealVNC\WinVNC\WinVNC.exe
Sign In or Register to comment.