Member Avatar for fenarro

Logfile of HijackThis v1.99.1
Scan saved at 21:00:46, on 05/03/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Ahead\InCD\InCDsrv.exe
C:\Archivos de programa\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Creative\ShareDLL\CtNotify.exe
C:\Archivos de programa\EPSON\Ink Monitor\InkMonitor.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgcc.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Archivos de programa\TGTSoft\StyleXP\StyleXP.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\a2\a2guard.exe
C:\Archivos de programa\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\Archivos de programa\Creative\ShareDLL\MediaDet.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\hj\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.diarioti.com/
O4 - HKLM\..\Run: [Jet Detection] C:\Archivos de programa\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Archivos de programa\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Archivos de programa\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [a-squared] "C:\Archivos de programa\a2\a2guard.exe"
O4 - Global Startup: NaturalColorLoad.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Archivos de programa\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Archivos de programa\FlashGet\jc_link.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FlashGet\flashget.exe
O12 - Plugin for .spop: C:\Archivos de programa\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: WB - C:\ARCHIV~1\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: runbatch (AppToService_runbatch) - Basta Computing - C:\WINDOWS\system32\AppToService.exe
O23 - Service: userlist (AppToService_userlist) - Basta Computing - C:\WINDOWS\system32\AppToService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Archivos de programa\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: StyleXPService - Unknown owner - C:\Archivos de programa\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe

  • 6 Contributors
  • 8 Replies
  • 308 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by JANINE

Dani AI

Generated

Summary and targeted troubleshooting based on ’s description and the HijackThis output: intermittent “page cannot be displayed” / DNS errors over WiFi are usually caused by one of three things — DNS/server problems (ISP or router), local interception (proxy/LSP/adware), or wireless/link instability. The log shows things often associated with HTTP/DNS interception (MediaPass, ErrorNuker, the O9 related.htm entry and a Winlogon notify fastload.dll). Suggestions already posted by , and hit useful points, but a focused isolation + safe cleanup sequence is required rather than untrusted one‑shot “fix” zips.

Quick isolation steps (run in a Command Prompt) — note what each output shows before changing anything:

ipconfig /all
nslookup www.citibank.cl
ping <paste-IP-from-nslookup> -n 4
tracert www.citibank.cl
ipconfig /flushdns

How to interpret results:

  • nslookup returns no IP → DNS problem (router/ISP or poisoned settings).
  • nslookup returns IP but browser still fails → local interception (proxy/hosts/LSP) or browser issue.
  • ping/tracert failing after IP resolution → network path problem (router/ISP/WiFi).

Safe remediation plan

  • Roll back any third‑party Winsock fixer that made things worse (use System Restore to a point before the tool ran). Avoid unknown “winsockfix.zip” packages.
  • Boot into Safe Mode, uninstall obvious PUPs (MediaPass, ErrorNuker, FlashGet) from Add/Remove Programs, and disable suspicious startup entries (msconfig or Autoruns).
  • With a known good DNS temporarily set (e.g., 8.8.8.8), retest nslookup/browser. If the system supports it, a controlled Winsock rebuild (official tools or documented Microsoft methods) can be used — only after a restore point is created.
  • Use an updated anti‑malware scanner (reputable product) to remove leftovers, then reboot and re‑scan with HijackThis. Remove the O9 related.htm and clearly malicious O20/Winlogon notifies only after confirming the file origins and backing up the registry.

Final checks

  • Test the same sites from another device or via wired Ethernet to isolate PC vs router/ISP.
  • If problems persist after cleaning, collect nslookup/tracert outputs and contact the ISP or check the router’s DHCP/DNS settings. Avoid running advice from unknown sites; prefer restore → measured diagnostic steps.

Recommended Answers

All 8 Replies

Member Avatar for caperjack

try winsockfix.zip download ,unzip it and run it see if that helps .

Member Avatar for fenarro

With th winsock fix its woirking worse. Thanks though, but do you have any other suggestions?

Fenarro

Member Avatar for crunchie

Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} -

Can you give some more information on your problem. Do you get that message all the time? What sites do you get the error message etc?

Please go here & install ALL critical updates required for your system, including service pack 1a for both XP and IE6.

Member Avatar for fenarro

Thnks Very much.
I have a wifi conecction, and a lot of times when i am trying to go to a web The page cannot be displayed error occurs or some time it says NOT FOUND, i some page i can use the reload botton and the page come through but for example in www.citibank.cl is hard to reach the page, its imposible.

here is my new hijack log please hellllpppp

Logfile of HijackThis v1.99.1
Scan saved at 12:36:59, on 06/03/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Ahead\InCD\InCDsrv.exe
C:\Archivos de programa\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\CTSVCCDA.EXE
C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\DRIVERS\WtSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\Creative\ShareDLL\CtNotify.exe
C:\Archivos de programa\EPSON\Ink Monitor\InkMonitor.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgcc.exe
C:\ARCHIV~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Media Pass\MediaPass.exe
C:\Archivos de programa\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Media Pass\MediaPassK.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\a2\a2guard.exe
C:\Archivos de programa\SEC\Natural Color\NaturalColorLoad.exe
C:\Archivos de programa\Creative\ShareDLL\MediaDet.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\hj\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.diarioti.com/
O4 - HKLM\..\Run: [Jet Detection] C:\Archivos de programa\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [Disc Detector] C:\Archivos de programa\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [Ink Monitor] C:\Archivos de programa\EPSON\Ink Monitor\InkMonitor.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPass.exe
O4 - HKLM\..\Run: [Error Nuker] C:\Archivos de programa\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKCU\..\Run: [STYLEXP] C:\Archivos de programa\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [a-squared] "C:\Archivos de programa\a2\a2guard.exe"
O4 - Global Startup: NaturalColorLoad.lnk = ?
O8 - Extra context menu item: Download All by FlashGet - C:\Archivos de programa\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Archivos de programa\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIV~1\FlashGet\flashget.exe
O12 - Plugin for .spop: C:\Archivos de programa\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: WB - C:\ARCHIV~1\OBJECT~1\WINDOW~1\fastload.dll
O23 - Service: runbatch (AppToService_runbatch) - Basta Computing - C:\WINDOWS\system32\AppToService.exe
O23 - Service: userlist (AppToService_userlist) - Basta Computing - C:\WINDOWS\system32\AppToService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSVCCDA.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Archivos de programa\Archivos comunes\EPSON\EBAPI\SAgent2.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Archivos de programa\Ahead\InCD\InCDsrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Archivos de programa\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: StyleXPService - Unknown owner - C:\Archivos de programa\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\DRIVERS\WtSrv.exe


Thnks again

Fdo

Member Avatar for fenarro

I have tried everything, and still working bad

Please help

Fdo

Member Avatar for puks

i have the same problem. some pages show up, others dont. i'm using wifi. please help. i've tried flushing the dns, winsocksfix. thanks!

Member Avatar for JANINE

try reinstalling IE. even though i dont have wifi i had this problem a few months ago and it really got me down. i uninstalled and reinstalled IE and checked all my user account settings (TRY THIS) and it worked and still working today.

sometimes, especially during the busier times of the day i get error 404 - not found or cannot find DNS server (DNS means Domain Naming Service/server).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.