Browser Won't Work

[drm184]

Every Monday morning for the past 3 weeks, a user tries to get on the Internet when they come in and they are unable to. It will start to load the page, usually displaying any banners across the top of the page, and then stop. The progress bar makes it look like it's still loading the page but it's not. If I try to get to browse the Internet on that machine logged in as the Admin, I have no trouble. Every week I run 2 different virus scans, CW Shredder, Spybot, Ad Aware, Kill2Me, LSPFix, and WinsockFix. Only after I run all of those will it start to work again. CWShredder never finds anything, and Spybot and Ad Aware don't seem to display the same thing every week either. I was trying to see if there was a common one that when it was deleted it would allow the browser to work but there isn't. Any ideas on what I can do to get this to stop? Thanks in advance.

 

[carrr]

Sounds to me like something is whacking your winsock stacks furing removal (could be any of the removal tools), but that it's the LSP fix/Winsock fix that's straightening you out. (Remembering that neither of these tools is for spyware/malware cleaning, but rather to ammeliorate the side effects of some malware removal.)
I'm wondering if you're running XP on this problem machine and if you've ever disabled system restore before clean up. If not, you're caught in an endless loop...

http://service1.symantec.com/SUPPOR...2001111912274039?OpenDocument&src=sec_doc_nam

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[drm184]

The machine is running Win2k Pro. LSPFix hasn't found anything to fix or remove in all the times I've run it so far. I thought that WinsockFix was the one that would take care of the problem so this past Monday, I tried just running it, but it didn't work. I had to run all 6 programs to get it to work again.

 

[carrr]

I assuming that you're trying a program, then testing for operation, right? This can help you pinpoint which one is getting the job done, not to mention, the respective log can help you ID your culprit. I'd be curious to know which one is doing the job for you, then what the repeat offender turns out to be.

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[drm184]

I tried that, yet it was only after I ran them all that it started to work again. That's why I figured it was the WinsockFix that was correcting the problem. Yet, when I ran only WinsockFix, it didn't fix it. I ran all 6 again in the original order and then it worked.

 

[carrr]

If you'd oblige, it would be interesting to see a Hijack This! log of the machine in question (when it's back up to its old tricks again, that is)

http://tomcoyote.com/hjt/

Tired of waiting for an answer? Try asking better questions. See: faq222-2244

 

[drm184]

Here is the log file, I had done one this week.


Logfile of HijackThis v1.97.7
Scan saved at 9:11:36 AM, on 5/10/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINNT\system32\internat.exe
C:\WINNT\explorer.exe
Q:\Utilities\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://v4.windowsupdate.microsoft.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://smbusiness.dellnet.com/

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37776.5072337963

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4320/mcfscan.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{8950B433-5ACF-4D62-BC26-A9F40628DCA6}: NameServer = 166.102.165.13,166.102.165.11

 

[ordisecours]

seem to have the same problem, my solution was to remove the dial up and tcp relate from windows , reboot and reinstall it , reboot and everything came back working.
Hope it will help you.

PII 200MMX, not big but enough...

gilles

 

[drm184]

Last week when the user came in everything worked, but this week the problem is back again. Tried removing the TCP as stated above and reinstalled, but still gave me the same problem.

 

[ordisecours]

A suggestion; did a log like above in ADMINISTRATOR previlege and user privilege and compare the difference.

another : try to remove all running program before connect to internet ( including firewall and viruscan )

question ...are you on high speed modem or 56K ?

 

[ordisecours]

what happen if you ping an ip address ? does it respond well

what happen when you ping your adress or ip carp ?

what happen if you try to connect with an ip adress in the adress bar ?

 

[drm184]

Our connection is a DSL line. When I ping an IP address, including my own, it responds and at the usual speed. It never seems to matter if I use an IP address or the actual web address to conenct to the site, it does the same thing.

Next week when it does it I will take the advice about comparing logs from the Admin profile and the users profile.

 

[ordisecours]

ordisecours to drm184...

did you get it right or worse ?

just want a follow up .thanks