Internet only works in safemode...?

Unknown

Hey-

OK, i've got a problem in which i have no CLUE what to do.

Basically, i'm running windows XP and can only get the internet to work when i run 'safemode with networking.' I'm on a college network (ethernet card) and it runs fine in safe mode, but when i try and run Internet Explorer when the computer boots up regularly, it acts like theres no connection whatso ever... pretty odd if u ask me.

Could some fire-wall-ness be acting up, perhaps? I'm guessing theres a conflict somewhere, but beats me if i know how to fix it. Any help? I could SURE use it! Thanks for even takin the time to read this tho... i appreciate it.

-Fred Matthews

P.S. Here's my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:03:00 PM, on 3/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\AIM\aim.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Jeff Gill\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Dexter

You appear to have a remnant of an adware problem:

O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll

See:

http://www.trendmicro.com/vinfo/grayware/graywareDetails.asp?SNAME=ADW_ISEARCH.A

First check and see if you get other internet communication in normal mode: e-mail, an instant messenger app, etc. If so, then remove that entry above in HJT, and delete that file, it should work. If not, you may need to run your antivirus app with the latest definitions (assuming you have one that detects adware threats.) If not, do the online scan at Trend Micro:

http://housecall.trendmicro.com/housecall/start_corp.asp

And if that still does not work, you may need to manually remove the Reg entries listed in the first link.

For future reference, please post HJT logs only in the Spyware forum:

http://www.short-media.com/forum/forumdisplay.php?f=57

Dexter...

fredmatthews

Hey-

First off, lemmie appologize for re-posting. I know that can get annoying, but I didnt want to keep replying to something that was in the wrong forum. The orignal link is here:

http://www.short-media.com/forum/showthread.php?p=254816#post254816

Anywho, my problem goes like this:

Basically, i'm running windows XP and can only get the internet to work when i run 'safemode with networking.' I'm on a college network (ethernet card) and it runs fine in safe mode, but when i try and run Internet Explorer when the computer boots up regularly, it acts like theres no connection whatso ever... pretty odd if u ask me.

I tried the links that Dexter posted on the other link, but no luck...

Could some fire-wall-ness be acting up, perhaps? I'm guessing theres a conflict somewhere, but beats me if i know how to fix it. Any help? I could SURE use it! Thanks for even takin the time to read this tho... i appreciate it.

-Fred Matthews

P.S. Here's my HijackThis log: (after trying what Dexter suggested...)

Logfile of HijackThis v1.99.1
Scan saved at 1:09:52 AM, on 3/19/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\AIM\aim.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Jeff Gill\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

fredmatthews

Thanks for the reply!!!

Sad to say, it didnt fix the problem... I ran the online virus check, and it got rid of some stuff, but i'm still not gettin any internet access. Not sure why... any other ideas?

I REALLY appreciate the fast responce tho. You da man Dexter. I posted the same Q at the following link tho in the 'propper' area. :-)

http://www.short-media.com/forum/showthread.php?p=254826#post254826

Thanks again for all the help tho!

-Fred Matthews

SpywareShooter

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

That's the only thing that I see that is bad in your log. Fix that entry and delete counter.cab and you should be free of spyware. That file is not restricting your Internet access though. You may want to ask for help in the Networking forum if you haven't already.

Dexter

SS - this post was moved in from Networking or Windows originally.

fredmatthews - did you try other forms of internet in normal mode? Can you get e-mail, or use an instant messenger in normal mode? How about run an update on your anti-virus app? This will tell us if you can communicate at all in normal mode, and if the problem is just with IE.

Another option is to download Firefox and see if that will let you access websites. You can click the link in my signature to download Firefox.

If no other programs can not get a connection in normal mode, then it is definitely a networking problem. If other apps do work in normal mode, then you have an IE problem, and may need to re-install IE.

Dexter...