Strange problem with Internet Explorer !

[G-Money]

I got this virus and deleted it, after that IE would not connect to the internet !

I had downloaded Mozilla Firefox at one time so I installed it and it works just fine !

Internet Explorer is the only thing that cant connect to the net !!

Anyone run across this strange problem before ?

Thanks !!

 

[Henyman]

any idea on what virus it was?

 

[muzikool]

Have you checked IE's proxy settings? Something could still be hijacking the browser, so you might download and run HijackThis or check your HOSTS file to see if there is something wrong there.

HijackThis: http://www.spychecker.com/program/hijackthis.html
HOSTS file: C:\Windows\system32\drivers\etc (open with Wordpad)

 

[G-Money]

dont remember the virus.. Just removed it ! I have checked all the setting in IE under tools>internet options>Connections - and they are all as they should be !

I will check out the link !

This is what is in my host file

" # Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com "


Does this look right ??

 

[muzikool]

127.0.0.1 localhost - this is all that has to be in the HOSTS file

The other line isn't necessary, but I don't think that it would effect IE in such a way. Hopefully HijackThis will shed some light on it.

 

[PseudoKiller]

whats the error you get when you use IE ... 404 450 ??

 

[G-Money]

Here is what HijackThis came up with

" Logfile of HijackThis v1.97.7
Scan saved at 4:41:41 PM, on 5/17/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\Program Files\Common files\updater\wupdater.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Windows Media Bonus Pack for Windows XP\PowerToys\mpxptray.exe
C:\PROGRA~1\ICQ\ICQ.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Moto-Cross\Desktop\HijackThis.exe

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1517.0\en-us\msntb.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Startup: MPXPTray.lnk = C:\Program Files\Windows Media Bonus Pack for Windows XP\PowerToys\mpxptray.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: WeatherBug (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/crack.cab

 

[G-Money]

PseudoKiller This is what happens when I start IE ! I get the same screen on all web pages !!

 

[j79zlr]

Make sure you have all browser windows closed and fix the following

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll (file missing)
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - http://cabs.roings.com/cabs/crack.cab

Isn't Weather Bug spyware? You might want to remove that as well.

 

[Henyman]

can you do a favour + restart, then try to get on net. also goto run and type cmd to open up commands prompt, then try to ping websites such as:

ping www.google.com


i have what sounds like same prob on my main pc @ mo i haven't had time to look in detail at it yet. but after a restart the net works fine for a few mins, then i get "page cannot be displayed" , but i can ping sites fine + msn etc still work i also had a trojan a while ago on their i think, but i dont use that comp - i use my laptop

outher points i noticed while having a quick look:
AVG wont start - no errors
Cant install / uninstall programs
can ping sites, but cant see in ie/firefox
can ping router
laptop works fine
no extra processes running

2morrow i am going to look @ my hosts file, as well as possible proxys (ahould be none) + run hijack this. will also look @ serveces.

 

[j79zlr]

could be a LSP problem, try this utility, http://cexx.org/lspfix.htm

 

[Henyman]

i am building up a list of things to try on it 2morrow, i'm not 2 fussed, by my dads moaning

 

[G-Money]

Deleted the items... still doesnt work !

I can ping from the CMD !

Here is something strange ! If I open my computer and type a web page in there.. works just fine !!!

I just dont want to re-install windows !! Its a pain in the #$% !!!!!!!

 

[Henyman]

dam it does sound like we have the same problem what do you mean by my computer? also if it does work wait for like 10 mins + see if it still works

 

[j79zlr]

Run sfc /scannow from the command line, you might have some corrupted files, this should repair them.

 

[PseudoKiller]

can you go to any sites?? and have you checked your connection settings in IE??

 

[G-Money]

dam it does sound like we have the same problem what do you mean by my computer? also if it does work wait for like 10 mins + see if it still works

Click on the MY computer icon in the top left corner !!

I can ping everything !!!

ICQ works.. Warcraft works ... Mozilla Firfox works ..... e-mail works.... on and on....

 

[G-Money]

can you go to any sites?? and have you checked your connection settings in IE??

Connection setting are the same as they where when it work ! I cant open anything with IE !

Now Mozilla's not bad, but I dont like system my not to work right and I also dont want to re-install windows !

 

[G-Money]

Run sfc /scannow from the command line, you might have some corrupted files, this should repair them.

That didnt work.... Looks like its re-install time ! Going to make an image file of my fresh install this time !!!!

Thanks

 

[Henyman]

i'm gona carry on having a play with my system this morning