Member Avatar for spookfish

(first posted in the internet explorer forum)

i think i've somehow managed to block a program or service with my firewall software which is required to load certain images and access files, sounds dodgy i know, and it all depends on if you class shooshtime.com dodgy, none of the pictures load up, no big deal i know, but it's bugging me and no doubt you'd want to fix a computer problem that was bugging you too

i've been thru the list of programs and checked what most of them do via google, granted access to the safe ones, denied the spyware which i can't seem to keep off the computer

i know you might think it was a IE settings problem, but i braved the crap on the net and switched off my firewall for a few minutes, the site loaded fine

anybody have any ideas what program i've blocked that i shouldn't have?

(caperjack said)

This problem can occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log

(hijackthis log)

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UStorSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\sstray.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\NORTON~2\navapw32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE
C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
C:\Program Files\RimArts\B2\B2.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Norton] C:\Program Files\ASUS\WLAN Card Utilities\NorExec.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0F2.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"
O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\Elaborate Bytes\CloneCD\CloneCDTray.exe
O4 - HKLM\..\Run: [ElbyCheckElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0527.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0527.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{01048EEE-0726-4132-9F93-9F5574B2C692}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{01048EEE-0726-4132-9F93-9F5574B2C692}: NameServer =

  • 5 Contributors
  • 4 Replies
  • 102 Views
  • 14 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

Practical checklist to isolate a firewall-caused page/resource failure and recover cleanly.

  • Prepare: export or back up the firewall rules (or take screenshots). That makes it safe to experiment. Update the diagnostic tool you already used and run it with all browsers closed so the output is complete; save the log file for later reference.

  • Narrow the blocker: enable the firewall�s activity/logging, then load the page and check the log for denied outbound entries (time, protocol, port, program). If the log names the program being blocked, allow that program temporarily and retry. If the firewall UI doesn�t show program names, use netstat -ano and a browser reload to correlate short-lived connections to process IDs, or use a simple HTTP test such as telnet host 80 (replace host with the image/asset host).

  • Target third-party content: right‑click a broken image and copy its URL. Many pages pull images from different hosts; a single blocked host or helper process (plugin/content helper) will make many images fail. Allow the browser executable and any trusted helper processes to make outbound HTTP/HTTPS while testing.

  • Safe reset: if you clear the blocked list as suggested, export first. If that doesn�t help, restore defaults or create a single “allow” rule for testing, then re-enable stricter rules once you identify the culprit.

  • Capture if needed: a short packet capture (or an HTTP proxy like Fiddler) will show whether requests are sent and what responses arrive, which proves whether the firewall or something else is dropping traffic.

As and pointed out, use an up‑to‑date scan/log and run it correctly; as warned, close browsers when producing the diagnostic. Post the updated log plus the firewall product/version if further help is needed.

Recommended Answers

All 4 Replies

Member Avatar for OurNation

First off it doesnt show the HJT version so i think that is caused when you dont make a new file for HJT and only HJT so do that and dont run internet explorer while scaninng with HJT

Member Avatar for Sphyenx

open up your firewall blocked files, programs ect. and delete the list or clear it. What firewall is it? When it clears up then block all the badies you dont want again.

Member Avatar for DMR

First off it doesnt show the HJT version...

Yes- your log is missing that bit of information, and it is important. If you don't have it already, you can download the latest version of HijackThis (1.99.0) from the link in my sig below.

and dont run internet explorer while scaninng with HJT

Again, yes- HijackThis cannot fully perform its fixes while you have any instances of your web browser running. The following entry in your log indicates that you did indeed have at least one instance of Internet Explorer running when you ran HJT:

C:\Program Files\Internet Explorer\IEXPLORE.EXE

Please print out the instructions that we give you before performing any fixes we suggest. Because your web browser needs to be closed when you do the fixes, you won't be able to refer to what we post here as you are following our instructions.

Member Avatar for crunchie

Hi. First of all you need to update hijackthis to version 1.99. Run hijackthis & go to *Config\Misc Tools\Check for update on-line*. If the site is down, go Remove the old version by opening the program, going to config\misc tools, then uninstall & exit. You then have to delete the file manually. Unzip the new version into the hijackthis folder.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.