Another I need help with my PC thread!

Factual Questions
1

My daughter’s PC stopped all access to the internet today. I do not know why; I have come here for help. Here’s the skinny:

PowerSpec 8360 P4 1.7 GHz
Win XP Home Version 5.1.2600 (totally updated, according to Microsoft)
IE6 ( again totally updated)
ZoneAlarm Firewall
Norton SystemWorks 2003
AdAware 6.0.1 (not as updated as it should be, but no net access to do so)

I ran all of the XP tutorials/ troubleshooters to try and fix it to no avail. I can ping, (meaning I can run ipconfig, see my IP address, and ping me, if that’s what “pinging” means.) Four packets sent, all of them received. This is what makes me think the network card is okay. Overall our net connection is fast, and I even brought her PC down to my office and hooked it up - no success- just checking that it wasn’t a router problem.

I have backed everthing important up, in case I need to do a full system restore (I have no restore disk, so how do I do this???) All of my system restore points have disappeared! When the PC starts, it states to press TAB to go to POST screen, or DEL to enter setup. I tried to press TAB, it did not work.

My daughter said Kazaa stopped working last night, so she downloaded another copy, and all hell broke loose. I have since uninstalled Kazaa and all associated spyware.

Please help! I am willing to wipe out everthing on the PC if necessary ( I just do not know how!)

Thank you in advance!

FWIW, here’s my HijackThis! log:

Logfile of HijackThis v1.97.3
Scan saved at 7:51:13 PM, on 5/19/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\gearsec.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1
opdb.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\iPod\bin\iPodService.exe
A:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hkcu
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm
R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL (file missing)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM…\Run: [ccApp] “C:\Program Files\Common Files\Symantec Shared\ccApp.exe”
O4 - HKLM…\Run: [ccRegVfy] “C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe”
O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 - HKLM…\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM…\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKLM…\Run: [Belt] C:\WINDOWS\Belt.exe
O4 - HKLM…\Run: [RunDLL] rundll32.exe “C:\WINDOWS\Downloaded Program Files\bridge.dll”,Load
O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot
O4 - HKCU…\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
O4 - HKCU…\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
O9 - Extra button: AIM (HKLM)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/14186d497d79874fe821/netzip/RdxIE601.cab
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/2000XP/CDTInc/bridge.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

2

You can get rid of these:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hkcu
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm
R3 - URLSearchHook: (no name) - _{0428FFC7-1931-45b7-95CB-3CBB919777E1} - (no file)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL (file missing)
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll
O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 - HKLM…\Run: [Belt] C:\WINDOWS\Belt.exe
O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/2000XP/CDTInc/bridge.cab

Have you updated and run Spybot and Ad-aware?

Can you ping 216.109.127.28?

You can try this as well.

3

Kazaa contains spyware that frequently damages the Winsock module of windows networking. Download LSPfix form the following link:

http://www.cexx.org/lspfix.htm

It should restore your internet connection.

4

My daughter’s computer slowed to a crawl after she had toyed with Imesh and Kazaa, luckily we never lost our Internet connection, and were able to recover using ad-aware and other free downloadable software tools.
A lot of the files in the p2p universe seem to be Trojan horses pregnant with viruses or browser hijackers, all tend to wreak havoc on a systeam, making it sicker over time.
The Ad-aware can probably clean out most of the evil malware crap that has infected your computer, but you can’t download the cure if you can’t get on line, catch 22.
A fresh install of your windows OS will set things right, (a straight forward process, albeit a tedious one) although it may seem to be admitting defeat to the cyber-vandals or demented marketers, IMHO with out the proper software tools these kinds of attacks tend to be very stubborn and difficult to wring-out of a corrupted system. So a fresh start may be the simplest cure. Good luck.

5

I’ve recently used McAfee to clean such a computer, and I highly recommend it - it does a good job at picking out suspect spyware as well as true viruese

Obviously, yes, if the XP install disks are handy, then that’s the option - but people are sold an XP system in the way they’re sold a Hi-Fi - “this is all you’ll ever need”…I have full sympathy for people who didn’t understand about updating

6

I deleted those HJT entries, I downloaded updated versions of AdAware and Spybot, I also tried both Winsock fixes listed above. NOPE.

Also, I cannot ping 216.109.127.28. Does this mean the network card is bad?

7

How would I go about doing a complete system restore; i.e. restoring the PC to the “factory condition”. Nothing of importance (that hasn’t been backed up) is really on the drives.

8

Hi caymus28
I’d try the LSP fix one more time…and reboot before I did a repair to XP. Or even consider trying one of your restore points?
But if you insist:
In short…

Put your CD in it’s drive…and boot up. Wait for the instructions to “Press any key to boot from CD” . Do so.

You’ll get a screen that says:

To setup Windows XP now, press ENTER. (This is the one you want…so press enter.)

To repair a Windows XP installation using Recovery Console, press R.

To quit Setup without installing Windows XP, press F3.
Press ENTER to set up Windows XP.
Then a screen will come on asking you to agree to the licencing, press F8 to agree to the license agreement.

Make sure that your current installation of Windows XP is selected in the box, and then press R to repair Windows XP.

Follow the instructions on the remaining screens to reinstall. After you repair Windows XP, you may be required to reactivate your copy of Windows XP.

Perhaps better said.

Make sure you have a firewall enabled before going online after the repair. You risk getting hit by the Blaster worm.

9

When you say you can “me” does that mean another computer on your network? Can you ping the router? If you can ping the router then your card should be fine. I would not think that the card is bad.I would try a couple of things before re-install.

What does Device Manager say about the running condition of the network card? I would delete the network card from Control Panel and have XP reinstall the drivers on a restart and see if that helps. Check that the IP address is correct for the machine.

I would use System Restore and see if that helps. It helped me once or twice. If you happen to find viruses then make sure to turn off Sytem Restore before running any scans.

10

If you open a command prompt and run ipconfig /all, what does it say?

11

If I do not have the XP disk, will this help? I tried the lsp fix again. Thanks in advance.

12

Nope. That’s only needed if you can’t make your cd boot from the cdrom.

13

So, I got the restore disk from my wife’s ex (another story all together). I did a full system restore, resetting everything to “factory condition”. Still no internet connection. The actual connection is good, as I am sending this plea from the same cable used to test my daughter’s PC. When I unplug the CAT 5 cable from the PC, the “network cable unplugged” notifcation pops up, leading me to beleieve that the network card is functional, but I am no expert on the functionality of hardware. Any ideas now? :confused:

14

On attempting log in to a broadband cable provider Sunday PM my log on name and password were not accepted. I had logged on earlier in the day without difficults.

A call to the ISP was of no help as they were overwhelmed with troulbe calls.

Called about 6:00 AM EST this morning, got some live help, the correct ISP #, reset the values in “Control Panel” , “Networking” and after a couple of additionl corrections, all is now well.

15

caymus, you must be in the same Workgroup as the other computer. How have you got the network connections set up? Are the computers using the same IP addressing scheme?