Internet Explorer Question

[mykidsmylife]

Could anyone tell me what is going on with my computer? I can't type in a web address and go to that in the address window. It will only go to places I have saved in my favorites or home page. If I want to go to a website I have to change my home page in the tool menu. I can navigate thru any website I eventually get to....just cant type the URL in the address window and go there.

I run XP and have all the Microsoft updates. It just has me stumped. Plus the recharger cord on my laptop is broke and I REALLY miss that and hate this stupid one anyways :sad:

:help:

[Ems]

Yeah, something funky is definitely going on there. If I were you I would just download Mozilla Firefox, lots of people prefer it to Internet Explorer.

Link: http://www.mozilla.com/firefox/

[joephys]

Shhhh, if it becomes to popular, all the people who write spy ware and stuff will start writing it for that.

[mduros]

Shhhh, if it becomes to popular, all the people who write spy ware and stuff will start writing it for that.Sorry, Firefox is already publishing lists of new vulnerabilities almost weekly. Still a tad better than IE, but not as safe as it was when it first came out.

[dougall]

Shhhh, if it becomes to popular, all the people who write spy ware and stuff will start writing it for that.
They do already..


besides you could switch to Opera..

and MKML, try a virus scan and/or malware scan. if you don't have anything current or installed on your PC try Housecall (http://housecall.trendmicro.com/)

[mduros]

Could anyone tell me what is going on with my computer? I can't type in a web address and go to that in the address window. It will only go to places I have saved in my favorites or home page. If I want to go to a website I have to change my home page in the tool menu. I can navigate thru any website I eventually get to....just cant type the URL in the address window and go there. :help:Sounds like you got infected with spyware. Besides, installing something like Firefox, go to download.com and download, install and run Ad-Aware SE Personal Edition 1.06 by Lavasoft. This should clean off the spyware sufficiently to run IE again. You may have to run it in safe mode to have it clean everything off properly.
Good luck,
Mary.

[tomdkat]

Sounds like a spyware infection to me as well (or a hi-jacked browser).

Install and run the following: Ad-Aware (http://www.lavasoftusa.com/) Spybot S&D (http://www.safer-networking.org/) Spy Sweeper (http://www.webroot.com/) X-Cleaner (http://www.supportcave.com/x-cleaner.html) Run Ad-Aware first, then Spybot, then Spy Sweeper, then run X-Cleaner.

Spy Sweeper is a commercial product, but their trial is great and will find a TON of stuff. When done with the Spy Sweeper scan, you can uninstall it unless you want to buy it.

Be sure to run updates on Ad-Aware, Spybot, and Spy Sweeper before scanning.

When done running these apps, you should have a clean system. Make sure you have Service Pack 2 (SP2) installed and make sure the Windows firewall is enabled. I recommend Zone Alarm (http://www.zonelabs.com/) over the Windows firewall but that's a different discussion.

I also concur with switching from IE to Mozilla Firefox, Mozilla Seamonkey, or Opera. However, if you're not wanting to learn a new browser start scanning your system more frequently for spyware. malware, etc.

EDIT: Tell me you have anti-virus software installed? :) If you don't, install the free version of AVG (http://free.grisoft.com/).

Good luck!

Peace...

[ScottoMacD]

Yes it's a browser hijack for sure.

I'm not a big fan of most of the spywares out there now a days.

They all work but they also all seem to have their little glitches that drive me nuts.

Since you are running XP you should download the free microsoft one "Antispyware". considering that it is a microsoft product it actually works very well and is updated very often. Because well it's microsoft and they have to help fix there crappy products.

After the spyware is removed using whatever prog you decide to use. The next thing you have to do is fix the browser.

Go here http://www.cybertechhelp.com/download/file/hijack-this
and download HiJack This.

It is a program to show if and what has been hijacked in IE.

When you run it it will give you a log. You can save it as a notepad file and then post it here and we can clean it up from there.

You log will look something like this:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY... io&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...rio&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wilkes.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY... io&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://rhapsody.com/hpoem
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll

But longer and will be specific to your cpu not this one that I grabbed off the web.

One more thing. Join here http://www.cybertechhelp.com/forums/index.php?

They are an awesome group of people that can help you out anytime in a pinch. Even with all my geekiness they have gotten me out of a couple of dousy jams.

Even if you don't join you can always go there and browse and search for similar problems that they have already helped people with.

Geez I sound like I own the site...they should pay me for the free advertising.

[mykidsmylife]

Thank you all!! To answer a few questions. Yes I have all the Microsoft updates as well as their free anti-spyware downloaded as well. Yes I have a virus scan (PCillian) and I keep it updated.

I will follow all instructions and let y'all know how it goes

Thanks again for all the help. AC people ROCK!

[tomdkat]

Since you are running XP you should download the free microsoft one "Antispyware". considering that it is a microsoft product it actually works very well and is updated very often.I recently tried this out on a XP machine I was working on and it didn't find anything when I did my first scan with it. I scanned the system using the Microsoft tool after scanning with Ad-Aware and Spybot and it didn't find anything. Then I scanned with Spy Sweeper and it found additional stuff, along with X-Cleaner (free). The cool thing about Spy Sweeper is it also protects the system from various kinds of system changes (like apps trying to install themselves to start when the system starts, etc) over and above spyware scanning.

I do second your recommendation for running HiJack This, great tool.

Peace...

[OrionGirl]

Be careful with HiJack This--yes, it's great, but the report is NOT designed to be read by non-tech people. In other words--everything that shows up on the report is not necessarily something that's bad and should be removed. So, use a website like the one Scott posted to interpret the results!

[ScottoMacD]

The cool thing about Spy Sweeper is it also protects the system from various kinds of system changes (like apps trying to install themselves to start when the system starts, etc) over and above spyware scanning.


Tom:

You are 100% correct. I use Spysweeper as well it is a great product.

I don't know how I forgot about it.

Orion is also right. If help is needed with the HJT log feel free to post it here and I or any of the other cpu geeks here can help you out.

[mykidsmylife]

Okay...I ran all the different spyware. I ended up buying the Spy Sweeper because I liked it. I can now go from one site to another. I ran the Hijack This. I haven't done a thing with it but here is the log.

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer .exe
C:\WINDOWS\CDProxyServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\pctspk.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 5.exe
C:\WINDOWS\System32\hphmon04.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\System32\HPHipm11.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Tammy\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aquariacentral.com/forums/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe"
O4 - HKLM\..\Run: [WebTrapNT.exe] "C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 5.exe
O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe
O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\ScanSoft\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Startup: Event Reminder.lnk = C:\Program Files\Mindscape\PrintMaster\PMREMIND.EXE
O4 - Global Startup: Pagis Schedule Monitor.lnk = C:\Program Files\ScanSoft\Pagis\Monitor.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139544398984
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer .exe
O23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe

[ScottoMacD]

Did you find any spyware when you did your searches?

This one seems to come up quite a bit when I was checking out your HJT log.

O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A

This particular file seems to be one piece of a dialer type hijack.

A couple of other things that I find odd
There are no R0 or R1 listings anywhere in you HJT log with the one exception for AC. This could be explained if you did find spyware but even in that case your new homepage and deafult search pages should still be there.

I would post your log at that website I gave you to double check because other than those two issues I can really find nothing that may be causing your issue.

On another note however. I did notice that you have allot of things running that you really don't need to have going that are most likely just eating up memory.
IE:
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ScanSoft\Pagis\Monitor.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\iPod\bin\iPodService.exe


These (and a couple of others) are all things that you can shut down when you are not using them. Either by using your msconfig tool for the startup or the ctrl-alt-delete option and just ending these processes.
If these sevices are needed when you are using the cpu they should restart automatically.

Tom or anyone else. Do you see anything that I may have missed?

[mykidsmylife]

Thank you Scott. Yes I ran the 4 different spyware programs and found several of them. I also had several "cookies" that it deleted.

I will join and post the log to the forum you suggested as soon as I get my kiddo's to bed.
Thanks again

Oh..btw..ADORABLE kids you got there. We have an Amanda too.

[sublime1184]

The cool thing about Spy Sweeper is it also protects the system from various kinds of system changes (like apps trying to install themselves to start when the system starts, etc) over and above spyware scanning.

Spybot does that too with TeaTimer...I love that and WinPatrol for live monitoring of the registry.

[tomdkat]

Spybot does that too with TeaTimer...I've enabled TeaTimer on one XP system and found it somewhat problematic in that the dialog that appears when a registry setting is changed, etc., is incorrectly sized such that the buttons you click to take an action aren't visible and the information displayed is all garbled, etc. Spy Sweeper's display is much better and has the added benefit of finding stuff and traces of stuff left behind by Spybot.

Peace...