browser loves to go to certain ip address

[2cxc]

Hello, I ran spybot AND adaware, I have a hardware firewall, Norton 2004 didn't pick up anything, I also run zoneAlarm (free version), every thing configured properly, I even tried resestin the hard-firewall and my problem persists:

When I go to some sites, I get "page cannot be displayed" instead of the site the browser is trying to load page: 216.235.150.21 or .30
For example if i go to dmoz.org and search the directory the browser tries to go to that ip address. What happens is the browser firstly tries to seach for it, then the explorer page symbol (on the botton left of the browser) turns into a magnifing glass with the world (globe) behind it then the page cannot be displayed appears. Please help me... why is this happening? I have updated IE and have newest vervion for Windows 98, and i have DSL.

 

[tb525]

It sounds like a domain hijacker. Download 'Hijack This!'. Unzip, doubleclick HijackThis.exe, and hit "Scan".
When the scan is finished, click "Save Log", and copy and paste it in a reply.

http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

 

[2cxc]

thanks for the help:

Logfile of HijackThis v1.97.3
Scan saved at 12:12:57 PM, on 10/27/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OUTLOOK.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\FLOW.EXE
C:\PROGRAM FILES\WINRAR\WINRAR.EXE
C:\WINDOWS\TEMP\RAR$EX00.823\HIJACKTHIS.EXE

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\ACROBAT\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1.1\SDHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -

http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {69DEAF94-AF66-11D3-BEC0-00105AA9B6AE} (Symantec RuFSI Utility Class) -

http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) -

http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -

https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) -

https://www-secure.symantec.com/techsupp/activedata/SymAData.dll

 

[2cxc]

I tried to add the ip address that keeps haunting me to the restricted site in the browser internet options but i keep getting this message:

The site you specified already exists in another zone. Please remove the site from that zone before
adding it to the current zone.

Any thoughts?

 

[tb525]

The only thing unusual I see is this running process:
C:\PROGRAM FILES\INTERNET EXPLORER\FLOW.EXE

Is Flow.exe something you installed? If it's not, could you email me a zipped copy to analyze? You can email it here:
tbeck41@adelphia.net

 

[2cxc]

thanks tb525 but i screwed around with it for 12 hours yesterday and now the browser doesn't default to that particular IP address regardless of. But i do have a new issue which i'm sure is a run off of the previous situation:
When i start IE 6 i get this message each time... what do you make of it:

"Internet Explorer Compatibility Mode"
"This is being run in compatibility mode and not all features are enabled."

 

[sqaguy]

Join the club 2cxc. I did something to my nice newly installed clean system after loading VS 2003, and now about half of my secure sites can not connect, and if I try to click a hyperlink in email or a newsgroup to open a web site I get the "compatibility mode" crap. I'm thinking of going back to Netscape. :-0

 

[bcastner]

Sounds like a DLL replacement and/or registration issue:

http://www.mvps.org/sramesh2k/IEFIX.htm

Enable the option to permit an SFC /Scannow

 

[bcastner]

Apologies, you do not have an SFC /Scannow option under Windows 98.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q281679