Member Avatar for madoxryder

A month or so ago something happened with my browsers (I have both IE and Firefox). I couldn't get into anything from yahoo, including my mail or my hotmail account and the sites that I did get into loaded extremely slow. I've tried winsock, ip-release, mulitple virus/spyware/adware scans, contacted my isp and all with no luck. The only thing that does work is a system restore and I think it's a little silly to have to do that everytime I want to check my mail, so in an act of desperation to get rid of this thing I'm posting this incase someone knows what's wrong.


Logfile of HijackThis v1.99.1
Scan saved at 10:31:59 PM, on 5/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\cFos\cFosDNT.exe
C:\PROGRA~1\SRNMIC~1\SOLOSENT.EXE
C:\PROGRA~1\SRNMIC~1\SOLOCFG.EXE
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\Ashampoo\Ashampoo Media Player+\AMPplus.exe
C:\Program Files\BitTorrent\btdownloadgui.exe
C:\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [cFosDNT] C:\Program Files\cFos\cFosDNT.exe
O4 - HKLM\..\Run: [SoloSentry] C:\PROGRA~1\SRNMIC~1\SOLOSENT.EXE
O4 - HKLM\..\Run: [SoloSchedule] C:\PROGRA~1\SRNMIC~1\SOLOCFG.EXE
O4 - HKLM\..\Run: [SoloSysCheck] C:\PROGRA~1\SRNMIC~1\SYSCHECK.COM
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O16 - DPF: ppctlcab -
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe

  • 2 Contributors
  • 2 Replies
  • 347 Views
  • 19 Hours Discussion Span
  • Latest Post Latest Post by madoxryder

Dani AI

Generated

Short summary and likely cause: the behavior you describe (both IE and Firefox lose access or become very slow, and a System Restore fixes things temporarily) strongly points to a persistent network-level change — a proxy/DNS/hosts redirect or a Winsock/LSP hook — rather than just cached pages. ’s cache/cookie step was useful but would not remove a proxy, hosts entry, or a Layered Service Provider that reattaches after a reboot. (learn.microsoft.com)

Immediate troubleshooting sequence (do these in Safe Mode with Networking if possible):

  1. Check and clear proxy settings (IE: Internet Options -> Connections -> LAN Settings; Firefox: Tools -> Options -> Advanced -> Network -> Settings).
  2. Check the Hosts file at C:\Windows\System32\drivers\etc\hosts for unexpected entries and remove any lines that redirect normal sites.
  3. Reset Winsock and the TCP/IP stack (run an elevated command prompt and execute the commands below, then reboot): 
netsh winsock reset
netsh int ip reset c:\resetlog.txt
ipconfig /flushdns

These commands rebuild Winsock and reset TCP/IP parameters; on XP the Winsock reset behavior is documented by Microsoft and may require reinstalling VPN/firewall clients afterward. (support.microsoft.com)

Next-level checks and cleanup:

  • Use Autoruns (Sysinternals) to inspect and disable suspicious auto-start items, Browser Helper Objects (BHOs), AppInit DLLs and Winsock/LSP entries — these are the places browser-redirect components commonly persist.
  • Run up-to-date on-demand scanners (AdwCleaner + a full Malwarebytes or equivalent scan) to remove PUPs/adware/rootkit traces; repeat scans in Safe Mode and consider an offline rescue disk if something resists removal. (learn.microsoft.com)

If the problem still returns after a clean scan, check DNS settings for rogue servers (DNS-change malware has a long history of redirecting traffic), disable or delete old System Restore points while cleaning, then create a fresh restore point once clean. If multiple security products are installed they can conflict during cleanup — consider temporarily disabling third-party AV/firewall while you troubleshoot (re-enable them after). If uncomfortable with these steps, an OS reinstall from trusted media is the surest fix. (wired.com)

Notes: start with the proxy/hosts/Winsock checks (fast, non-destructive). If results are posted later, note exact proxy/DNS values and Autoruns entries and mention them so advice can be narrowed down.

Recommended Answers

All 2 Replies

Member Avatar for crunchie

Try deleting the entire cache contents and also the entire load of cookies. Write down any passwords first as you may lose them.

Member Avatar for madoxryder

I've deleted both cache and cookies from both browsers, but it didn't work.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.