When i connect to the internet (aol v9.0) the inbulit internet explorer wont load anything, i am using firefox at the moment which i prefer but my mother wants to use the aol, and also my firewall (blackice v3.6.coo) keeps picking up the same two things:

10/10/2005 06:21:42, SQL_SSRP_StackBo, 221.236.223.132, 1

10/10/2005 06:21:42, SQL_SSRP_Slammer_Worm, 221.236.223.132, 1

but as much as i block them they keep appearing and use different ip adresses each time but the name stays the same, can you help me at all?


Logfile of HijackThis v1.99.1
Scan saved at 16:48:46, on 10/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\apps\ABoard\AOSD.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ISS\BlackICE\blackice.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\WINDOWS\slrundll.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\steve\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tesco.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tesco.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.tesco.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tesco internet access
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Wanadoo - {8B68564D-53FD-4293-B80C-993A9F3988EE} - C:\WINDOWS\system32\WSBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P31 "EPSON Stylus Photo RX420 Series" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [EPSON Stylus Photo RX420 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9CE.EXE /P40 "EPSON Stylus Photo RX420 Series (Copy 1)" /O6 "USB001" /M "Stylus Photo RX420"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tesco.net
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C59F6091-B4E1-4FEC-B8D6-A36CAE7A603A}: NameServer = 205.188.146.145
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

You probably have a LSP in the system causing some issues. AOL makes it convienient to fix things up, from my experience the rebuild/uninstall AOL Adapter utility will resolve it *temporarily*.

(Quoting from AOL Help, http://help.aol.com):

•

•

•

•

Rebuild/uninstall the AOL Adapter

A damaged AOL Adapter may cause this issue. Windows networking requires a network adapter for any application that must access the Internet. The AOL® software uses the AOL Adapter to access the Internet.

Note: Please make sure the AOL software is closed before you follow the steps.

To rebuild/uninstall the AOL Adapter:
1. Click the Start button, select All Programs or Programs, select America Online, then click AOL System Information.
2. Click the Utilities tab.
3. Click the Uninstall AOL Adapter or Rebuild AOL Adapter button.

Note: If Windows displays the message 'The AOL Adapter was successfully uninstalled' or has already been uninstalled, click the OK button.

4. Click the Close button.
5. Restart the computer and start the AOL software again. The AOL Adapter will be rebuilt automatically.

Any other questions, feel free to PM me, as I fix AOL software daily.

Actually, we ask that members keep troubleshoots "on the forums" rather than use mechanisms like PMs, email, chat, etc. By doing so, we provide helpful information not only to the member currently experiencing the problem, but also to others who may be having similar problems.

From the related section of our forum rules:

No problem.

i dont seem to have america online on my computer, i am in Britain, will that make any difference? Oh and i am not networked to any computer and AOL came on my computer dont know if this makes any difference, but i thought i may as well tell you) and any advice on the black ice detection, its quite a new thing, but i think its comming from the inside as its so regular.

P.S Was there anything out of the odinary in the hijackthis log?

Thanks for your time and patience
Steve

Er- the following entries in your HJT log indicate otherwise:

Running processes:
.
.

C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\AOL 9.0\shellmon.exe


Your log is clean, and as it does not indicate that you are running any SQL database software, I'd guess that the BlackIce messages are warnings of probes from the outside; the IP addresses would be those of the attacking/probing computers. BlackIce will block these, but there's really nothing you can do to stop the probes entirely.

If you are running an SQL server, you need to apply all of the most current security patches ASAP.

well ofcourse i knew that AOL was an abbreveation of america online, honest... :o thanks for the help i will try this now.

ok, i have tried rebuilding the AOL adapter but it has not helped, also i have discovered that when you just type a web adress into the AOL adress bar then it tries to connect to the ip adress 205.188.146.146, which is one of the ip adresses that the SQL has tried to come from.

hope you understand what i have just said, again thanks for the help and patience you have given

That sounds a little odd. In the past with Black ICE it would give me false positives (not on purpose). What if you lowered it down a bit, or allowed aol.exe, acsd.exe, waol.exe, aolservicehost.exe "fully allow" or equivalent in the program?

lol :mrgreen:

205.188.146.146, and the 205.188.146.145 address listed in your 017 HJT log entry, are the addresses of AOL proxy servers. Your AOL software uses those servers to access the Internet; this is normal.


A couple of things to try:

1. Disable BlackIce entirely before trying to troubleshoot anything else. Firewalls often get confused or corrupted, and block traffic that they should not.


2. If disabling the firewall has no effect, see what happens when you try to reach a site by its IP address instead of its URL. Using Google as an example, type the following into AOL's address bar and let us know the results:

http://66.102.7.147


3. I'm probably preaching to the choir here, but in all honesty I'd really suggest trying to wean your mother off of AOL. AOL has always caused its fair share of headaches, and each new version is more bloated than the last, adding more layers of crud and complexity to your system as a whole.