Can't load any pages with IE6

[Mike Taylor]

I can't load any pages with IE6. Outlook Express works, and I can download
files through the internet. I can ping yahoo.com, google.com, etc. and get
good response times. However, when I load IE all I get is the screen you get
when you have no internet connection.

I have recently gotten Zone Alarm (have a cable modem), Spam Net from
Cloudmark, Ad Aware and use NAV. Ad Aware has removed many things from my
computer and helped clear up some worms that had redirected links and my
start page, etc. with IE. I'm wondering if in the successive inspections
I've done with Ad Aware it's deleted something it shouldn't have.

This all started the beginning of this week. When I got home from work I was
surfing the web and walked away from the computer. When I came back I
clicked on a link for one of my favorite web sites and I got the no
connection screen.

Can anyone help me figure out what to do next? Remember, I can't go to web
sites to read information or download files apparently.

I've tried installing IE6, etc. and can't seem to get anything to change.
I'm using Windows 98.

 

[wolver1ne]

I'm having the same issues. I think it might have to do
something with zonealarm. I've seen this happen to
someone else and they also had zonealarm. It might be
firewalls in general or just specific with zonealarm.
Refreshing usally does the trick, or you can close zone
alarm and see if the problem goes away. Ofcourse not
using a firewall with all the crazy worms out there isn't
too great an idea.

 

[Mike Taylor]

I don't believe Zone Alarm is the culprit. One of the first things I did was
shut it down, as well as Spam Net and NAV to see if there was a connection.

I've now run through some other posts and have run Ad Aware in safe mode. It
found a couple more problems, but even after quarantining them and deleting
the directories they were in, no change to IE.

I can't download Spy Bot or run the parasite checks or the Cool Web Shredder
since I need IE to download them.

Am I stuck?

 

[Mike Taylor]

How can I get LSP Fix without IE working? It sounds promising.

 

[Mike Taylor]

OK, I realize that the recommendation is to post "Hijack This" logs to their
forum, but since I can't access the internet forums I'll try here. Hopefully
someone here can either forward this to the proper forum or can spot
something that will help in the log:

Logfile of HijackThis v1.97.7
Scan saved at 5:52:06 PM, on 6/13/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\LOGITECH\MOUSE\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\CLOUDMARK\SPAMNET\OE\SNOE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
file://C:\WINDOWS\SYSTEM\SearchBar.htm
R3 - Default URLSearchHook is missing
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program
Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM
FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [EM_EXEC] c:\logitech\mouse\system\em_exec.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common
Files\Real\Update_OB\realsched.exe -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD
Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec
Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec
Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone
Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [dRMON SmartAgent] drmon\SmartAgt\SmartAgt.exe
O4 - HKLM\..\RunServices: [BCDetect] C:\WINDOWS\SYSTEM\BCDetect.exe defer
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton
Utilities\NPROTECT.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec
Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common
Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [TrueVector]
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - Startup: Image.LNK = C:\Program Files\Norton Utilities\IMAGE32.EXE
O4 - Startup: Cloudmark SpamNet for OE.lnk = C:\Program
Files\Cloudmark\SpamNet\OE\snoe.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
present
O8 - Extra context menu item: Open Frame in &New Window -
C:\WINDOWS\WEB\frm2new.htm
O8 - Extra context menu item: &Highlight - C:\WINDOWS\WEB\highlight.htm
O8 - Extra context menu item: &Web Search - C:\WINDOWS\WEB\selsearch.htm
O8 - Extra context menu item: &Links List - C:\WINDOWS\WEB\urllist.htm
O8 - Extra context menu item: Zoom &In - C:\WINDOWS\WEB\zoomin.htm
O8 - Extra context menu item: Zoom O&ut - C:\WINDOWS\WEB\zoomout.htm
O8 - Extra context menu item: I&mages List - C:\WINDOWS\Web\imglist.htm
O8 - Extra context menu item: &Document Tree - C:\WINDOWS\web\tree.htm
O8 - Extra context menu item: View Partial So&urce -
C:\WINDOWS\web\source.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MS&N Messenger Service (HKLM)
O9 - Extra 'Tools' menuitem: &Document Tree (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: PhoenixNet (HKLM)
O9 - Extra button: ATI TV (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O12 - Plugin for .scr: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37869.697615740
7
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) -
https://sodddm03.extra.daimlerchrysler.com/iNotes.cab

 

[Robert Aldwinckle]

Am I stuck?

It depends on how deeply imbedded the malware is.
Try to do some things which may help make your browser usable
at the cost of some functionality.

Try using the Control Panel's Internet Options applet to reset things, especially (for example)
- change your Home page to About:Blank
- disable search from the Address bar
- uncheck Enable third-party browser extensions (requires restart)
- set Security level for Internet zone to high

You should do that while iexplore.exe is not an active process.
Usually it is sufficient to close all IE windows to achieve that state
but you should use Task Manager to check (e.g. in case some malware
is running in a hidden window.)

Delete or rename your HOSTS file.

Either reboot normally after disabling all unnecessary start up programs
(e.g. using msconfig) or boot in safe mode with networking.
In fact, it might be a good idea to doublecheck that your changes are
still in place after the boot; if not, redo them.

BTW if you have some spare harddrive space another alternative
would be to create a second partition, do a clean install of Windows there,
and use its browser.


Good luck

Robert Aldwinckle

 

[Mark Stephan]

I am having same problem with no solution so far. Try
installing different brower from Mozilla. Works quite well
and is quicker than IE. go to
http://www.mozilla.org/start/1.6/ at least you can then
function... download files etc.

-----Original Message-----

It depends on how deeply imbedded the malware is.
Try to do some things which may help make your browser usable
at the cost of some functionality.

Try using the Control Panel's Internet Options applet to

reset things, especially (for example)

 

[Guest]

Im using Windows 2000NT (not by choice) and I cant download anything or open any files off the internet with IE either. I have followed a few steps on here, I cant even download Adaware or view PDF files off the net. so frustrated. I had alot of Windows hotfix 2000 updates in my Add/Remove programs window, and now, i dont even see Internet Explorer in there. I do know I have version 6, but where is it? This is a mess. Cant even upgrade off Microsoft site, nothing downloads.

Friday (Vicki)

 

[Robert Aldwinckle]

I can't download Spy Bot or run the parasite checks

Try installing different brower from Mozilla.

Mark,

Mike would need an FTP link for that suggestion to help him.

 

[Mike Taylor]

I appreciate the advice. I tried all of those things and get no change in
IE. BTW, the only HOSTS file I found was in my Windows directory and was
just simply hosts, no extension. Is that the one? If so, I renamed it.

At work today I downloaded CWShredder, LSP Fix, SpyBot and tried the manual
install for Incredifind. I also ran Bazooka. None of these things, even when
run in Safe Mode are helping.

How do I find my Winsock and delete it so Windows 98 will reinstall a new,
clean version? I figure that's my last attempt before reformatting my hard
disk and starting over.

I'll also post my Hijaack This log from work.

 

[Robert Aldwinckle]

Im using Windows 2000NT
....

I do know I have version 6, but where is it?

Sometimes the Add/Remove entry is lost on that OS
You could try doing the equivalent thing that it does
by Run... (press Win-R and enter

rundll32 setupwbv.dll,IE6Maintenance

Try the Repair option first. It causes a reboot so you might
as well close all other applications first. In case you have
some security programs which might be interfering with the
real effect of the repair after the boot it may be better to
disable them instead of just stopping their current processes.
Alternatively do the boot first in safe mode.

BTW there is now a more comprehensive repair for NT5

<TITLE>831429 - Windows XP stops responding when you download updates from Windows Update</TITLE>
< http://support.microsoft.com/default.aspx?scid=kb;en-us;831429 >

For your convenience here is the main procedure for your OS

<quote>
Windows 2000
Method 1: Register your system files
To register your system files, follow these steps:
1.. Click Start, click Run, and then type:
regsvr32 /i Urlmon.dll

2.. Click OK.
3.. When you receive the "DllRegisterServer in urlmon.dll succeeded" message, click OK, and then try to use the Windows Update
site.
4.. If the problem repeats, repeat steps 1-3 for each of the following commands:
a.. regsvr32 /i Shdocvw.dll
b.. regsvr32 Msjava.dll
c.. regsvr32 Actxprxy.dll
d.. regsvr32 Oleaut32.dll
e.. regsvr32 /i Mshtml.dll
f.. regsvr32 /i Browseui.dll
g.. regsvr32 /i Shell32.dll
If the issue is not resolved, some system files may be incorrect. Go to the next method.
Method 2: Run the Internet Explorer Repair Tool
</quote>

The point of doing Method 2 will be to make use of the that tool's
verification procedure, since the actual list of modules re-registered
will only be a subset of the first.


HTH

Robert
---

Im using Windows 2000NT (not by choice) and I cant download anything

or open any files off the internet with IE either. I have followed a few steps
on here, I cant even download Adaware or view PDF files off the net. so
frustrated. I had alot of Windows hotfix 2000 updates in my Add/Remove
programs window, and now, i dont even see Internet Explorer in there. I do
know I have version 6, but where is it? This is a mess. Cant even upgrade
off Microsoft site, nothing downloads.

 

[Robert Aldwinckle]

OK, I realize that the recommendation is to post "Hijack This" logs to their
forum, but since I can't access the internet forums I'll try here. Hopefully
someone here can either forward this to the proper forum or can spot
something that will help in the log:

Seeing all those ZONELABS things in there reminds me of all the
problems I have seen in the past which seemed to be associated
with improperly configured ZAP. In one case the user discovered
that even though he had attempted to remove it bits of the product
were still left behind and *working* enough to cause error symptoms
such as the one you are describing. Further there have been reports
of more problems seen with it from users of a newer version.

I would try uninstalling your ZAP, rerunning HJT, comparing the log
to verify all traces of ZAP are gone and then retrying. You do need
some kind of port protection however before accessing the internet
again without a firewall. I know that it is possible using NT's standard
dialogs. Unfortunately I am using XP at the moment which has different
dialogs (as well as its own imbedded firewall service).

I don't think it is a complicated as this:

<title>KB813878 - How to Block Specific Network Protocols and Ports by Using IPSec</title>


Yeah, try this:

<title>KB826955 - Virus Alert About the Blaster Worm and Its Variants</title>

<extract>
Recovery for Windows 2000 and Windows NT 4.0
The Internet Connection Firewall feature is not available in Windows 2000
or Windows NT 4.0. If Microsoft Internet Security and Acceleration (ISA)
Server 2000 or a third-party firewall is not available to block TCP ports 135,
139, 445 and 593, UDP ports 69 (TFTP), 135, 137, and 138, and TCP
port 4444 for remote command shell, follow these steps to help block the
affected ports for local area network (LAN) connections. Note that TCP/IP
Filtering is not available for Dial-up connections. If you are using a Dial-up
connection to connect to the Internet, you should enable a firewall.

1.. Configure TCP/IP security. To do this, use the procedure for your
operating system.

Windows 2000
1.. In Control Panel, double-click Network and Dial-up Connections.
2.. Right-click the interface that you use to access the Internet, and then click Properties.
3.. In the Components checked are used by this connection box, click Internet Protocol (TCP/IP), and then click Properties.
4.. In the Internet Protocol (TCP/IP) Properties dialog box, click Advanced.
5.. Click the Options tab.
6.. Click TCP/IP filtering, and then click Properties.
7.. Click to select the Enable TCP/IP Filtering (All adapters) check box.
8.. There are three columns with the following labels:
a.. TCP Ports
b.. UDP Ports
c.. IP Protocols
In each column, click the Permit Only option.
9.. Click OK.

Notes
a.. If your computer shuts down or restarts repeatedly when you try
to follow these steps, disconnect from the Internet before you
turn on your firewall. If you connect to the Internet over a broadband
connection, locate the cable that runs from your external DSL
or cable modem, and then unplug that cable either from the modem
or from the telephone jack. If you use a dial-up connection,
locate the telephone cable that runs from the modem inside
your computer to your telephone jack, and then unplug that cable
either from the telephone jack or from your computer.
b.. If you have more than one computer sharing an Internet connection,
use a firewall only on the computer that is directly connected to the Internet.
Do not use a firewall on the other computers that share the Internet connection.
c.. Using a firewall should not affect your e-mail service or Web browsing,
but a firewall can disable some Internet software, services, or features.
If this behavior occurs, you may have to open some ports on your firewall
for some Internet feature to work. See the documentation that is included
with the Internet service that is not working to determine which ports you must open.
See the documentation that is included with your firewall to determine
how to open these ports.
d.. These steps are based on a modified excerpt from Microsoft Knowledge Base article 309798.
</extract>


Good luck

Robert
---