Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Explorer Errors

Posted on 2004-09-30
22
Medium Priority
?
535 Views
Last Modified: 2010-04-11
Hi, I recently got infected with the .com.org and yeah.com Internet Explorer DNS problem and my internet ever since has been running pretty slowly and pages will cease to load or will time out and sometimes when they do load they load like a total wreck . I restored my computer and after 2 days I noticed it didn't fix a darn thingI fixed the yeah.com stuff (I hope) by installing some registries from other sites and turned off search in IE address bar (under Tools > Internet Options > Advanced). I also installed a new web browser (Mozilla Firefox) but timeouts, pages not responding and pages loading horribly, all these errors stilll occur.
( example: http://24.18.36.125/problems/internet%20problems.JPG )

I'm not sure what to do, hijackthis didn't pickup anything funky to my knowldege (scanned through it) and no spyware/adware removal program will find anything nor will Norton Antivirus 2004. I think this question might be a little hard to answer because not even I know what's bogging down my explorers, so any help would be greatly appreciated. Thanks in advance.
0
Comment
Question by:TornSoul
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 10
  • 6
  • 2
  • +2
22 Comments
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12196086
First let us take all the spywares down and then see if you situation would improve

a) First this

Some of the experts here have helped in compiling all the important spyware tools and they are listed in this thread
http://www.experts-exchange.com/Web/Browser_Issues/Q_20975384.html
My recommendation would be to start with spybot ,ad-ware ,CWshredder and get the log from Hijackthis and save the log and paste it here http://hijackthis.de/index.php?langselect=english to analyze it  

After installing them, First Update them and then run

b) Turn off system restore

c)  Remove temporary internet files, folders and cookies
Also remove windows Temp files going to

1) Start --> run --> typein:  %systemroot%/temp
2) Start  --> run --> typein: %temp%

d) Start --> run --> Type in "msconfig" and press "Enter"
goto Startup tab
Disable all the applications there except Anti-virus.Reboot the machine and check if the error occurs.
If not, then enable one at a time in the same startup tab and find the application that might cause this
at startup

Post back what happens after doing all these

SR
0
 

Author Comment

by:TornSoul
ID: 12196969
I already had Ad-Aware, I installed Spybot and CWShredder.

Here's my CWShredder logfile:

CWShredder v1.59.1 scan only report
Please understand that a CWShredder 'Scan only' report
might not be sufficient to troubleshoot an infected system.
You can use HijackThis for that:
http://www.merijn.org/files/hijackthis.zip
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Windows XP (5.01.2600 SP1)
Windows dir: C:\WINDOWS
Windows system dir: C:\WINDOWS\System32
AppData folder: C:\Documents and Settings\TheAmazingZLJ!!1\Application Data
Username: TheAmazingZLJ!!1

Found Hosts file: C:\WINDOWS\System32\drivers\etc\hosts (734 bytes, A)
CWS.Msconfig Registry value: HKLM\..\Run [msconfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINDOWS\system32\userinit.exe,
Found Win.ini file: C:\WINDOWS\win.ini (487 bytes, A)
Found System.ini file: C:\WINDOWS\system.ini (227 bytes, A)

- END OF REPORT -

I disabled system restore first of all, the site that scans my hijackthis log didn't find much.

Ad-Aware found some tracking cookies and spybot found Avenue A, Inc, Alexa Related, DSO Exploit and WildTangent.

I got rid of these problems and the problem doesn't seem to be bothering me at the moment but it takes a good few minutes to hours browsing the internet, so I shall find out. Thanks for your support..
0
 

Author Comment

by:TornSoul
ID: 12197374
I'm getting timeouts it seems, I'm not sure why..

http://24.18.36.125/problems/argh.jph
0
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

 
LVL 38

Expert Comment

by:Rich Rumble
ID: 12197546
Do you have Kazaa? or otjer P2P sotware? These love to install these headaches.
I'm really suprised to see a Mozilla product affected... might be your hosts file, or something rewriting your DNS requests...
Do you have McAfee AV available... try turing on "find joke programs, find potentially unwanted programs"
http://www.bio.fsu.edu/complabs/graphics/me99b.jpg McAfee 8.0i got rid of the problem for me when I had it.... can't remmeber the file it found...
-rich


0
 

Author Comment

by:TornSoul
ID: 12197624
Nope, I don't have MaCafee AV. But yes, even Mozilla's being affected by my problem.

=(
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12199018
TornSoul u are running XP, right ??
so create a new user account(administrative rights) and check there for the problems ??
same issues ??

if YES then try a SFC scan,
Goto START>RUN and type  sfc /scannow
u will need ur WinXP CD in order to fix the corrupted windows system files, if found by scan.

Post Back and Good Luck :)
0
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 12199606
It's not mozilla itself, like most of the active-x and spy-ware programs that get a hold of IE... it's something running on top of the NIC or intercepting and redirecting the DNS requests.
Try the free version of ZoneAlarm, it will show you what is doing what to your NIC...
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=dyncomp_za
once it tells you what program is trying to act like a dns server... locate that program in task manager, kill the process, and delete the file once you search it out on the HD...
GL!
-rich
0
 
LVL 1

Expert Comment

by:Grinler-
ID: 12201702
Can you post a hijackthis log, so we can take a look at it?
0
 

Author Comment

by:TornSoul
ID: 12204548
Logfile of HijackThis v1.98.2
Scan saved at 3:35:12 PM, on 10/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\apachefriends\xampp\apache\bin\Apache.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\apachefriends\xampp\apache\bin\Apache.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\System32\wuauclt.exe
C:\apachefriends\xampp\apache\bin\ApacheMonitor.exe
C:\apachefriends\xampp\mysql\bin\winmysqladmin.exe
C:\Program Files\Teamspeak2_RC2\server_windows.exe
C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\TheAmazingZLJ!!1\Application Data\Microsoft\Internet Explorer\Quick Launch\Navigation\Privacy & Protection\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamespot.com/index.html?tag=gs_head_home
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1096336212250

0
 
LVL 1

Expert Comment

by:Grinler-
ID: 12204915
The lock is clean...do this.  Go into msconfig again and click on the startup tab, then click on the enable all button.

Close msconfig, but do not rebooot and post a new log
0
 

Author Comment

by:TornSoul
ID: 12707521
Here's my new log

Logfile of HijackThis v1.98.2
Scan saved at 8:32:17 AM, on 11/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Documents and Settings\Admin\Desktop\apachefriends\xampp\apache\bin\Apache.exe
C:\Documents and Settings\Admin\Desktop\apachefriends\xampp\FileZillaFTP\FileZilla Server.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\Admin\Desktop\apachefriends\xampp\apache\bin\Apache.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\D-Tools\daemon.exe
C:\windows\system32\netdaemon.exe
C:\Program Files\Babylon\Babylon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\ctfmon.exe
C:\FRAPS\FRAPS.EXE
C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Admin\Desktop\apachefriends\xampp\apache\bin\ApacheMonitor.exe
C:\Program Files\Teamspeak2_RC2\server_windows.exe
C:\Documents and Settings\Admin\Desktop\apachefriends\xampp\FileZillaFTP\FileZilla Server Interface.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\AIM\aim.exe
C:\Documents and Settings\Admin\Desktop\apachefriends\xampp\FileZillaFTP\FileZilla Server Interface.exe
C:\Program Files\Teamspeak2_RC2\server_windows.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
C:\Documents and Settings\Admin\Desktop\Downloads\HijackThis.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50193
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50193
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50193
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Local Spool Net support DLL - {41943050-65CC-454B-81E4-9C8A9D7CBAEA} - c:\windows\system32\localsplnet.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8DA5457F-A8AA-4CCF-A842-70E6FD274094} - C:\PROGRA~1\COMMON~1\WinTools\WToolsT.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common Files\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [netdaemon] c:\windows\system32\netdaemon /v
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [eDonkey2000] "C:\Program Files\eDonkey2000\eDonkey2000.exe" -t
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Program Files\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Fraps] C:\FRAPS\FRAPS.EXE
O4 - HKCU\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1100576672328

and the same problems still occur only I've tried to live with them for awhile :(
0
 
LVL 49

Expert Comment

by:sunray_2003
ID: 12707530
have you already used the analyser site i had posted

Download Hijacthis from here http://www.softpedia.com/public/cat/10/17/10-17-69.shtml.
Get the log from Hijackthis and save the log and paste it here
http://hijackthis.de/index.php?langselect=english to analyze it.
 The analyser site is used so that you donot gum up the thread with the entire log.

Check this tutorial aswell : http://aumha.org/a/hjttutor.php

Remove the bad ones that the site reports. If it says unknown process, then use a search engine to check if those are bad ones. If bad remove them , if you still cannot find then post those files alone here.
0
 

Author Comment

by:TornSoul
ID: 12707790
Alright I scanned it and everything looked alright except some webhancer and new.net entries and I'm trying to get rid of  O10 - Hijacked Internet access by New.Net but I'm having problems. Spybot got rid of the rest of those pesky files though.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12707813
Tron try running this tool >> http://www.spychecker.com/program/lspfix.html
0
 
LVL 65

Accepted Solution

by:
SheharyaarSaahil earned 1500 total points
ID: 12707882
And after running that, use msconfig to untick unwanted progrmas as described here >> http://netsquirrel.com/msconfig/
Then Download these tools if you have not them already(note that these are the latest versions),

========================================================
AdAware ==> http://www.spychecker.com/program/adaware.html
SpyBot  ==> http://www.spychecker.com/program/spybot.html
CoolWebShredder ==> http://www.softpedia.com/public/cat/10/17/10-17-150.shtml
New.net uninstaller program >> http://www.new.net/support/uninstall5_48.exe
Stinger ==> http://vil.nai.com/vil/stinger
========================================================

Turn off ur System Restore >> http://www.pchell.com/virus/systemrestore.shtml
Then Disable ur Messenger Service if its running >> http://www.itc.virginia.edu/desktop/docs/messagepopup/
After that here are some "canned" Instructions of mine, If u want u can follow them to check if they can work for u or not :)

1. Restart ur machine in safemode and Login as Administrator
2. Run the AntiVirus tool and delete all viruses it found
3. Run the Spyware Removal tools and delete everything they detect
4. Then goto My Computer>Tools>Folder Options>View and turn on the feature of Show Hidden Files
5. Goto C:\Documents and Settings\your usernmae\Local Settings\Temp and delete all files present here
6. Goto C:\Documents and Settings\your usernmae\Local Settings\Temporary Internet Files, and delete the folder of ContentIE
7. Goto C:\Documents and Settings\your usernmae\Cookies, and delete all cookies present here
(ofcourse im assuming that u have already saved all the login passwords for ur websites :)
8. Goto C:\Windows\Temp and delete all files present here
9. Reboot back in Normal Mode and check if problems are gone or not

And from here we have to work further on your new problem >> http://www.experts-exchange.com/Operating_Systems/WinXP/Q_21224867.html

coz at present your system is already running junks.... so working on another issue while leaving them is not at all a wise step..... so First we will get rid of these nasties and then we will work out on the other problems... is it ok with you ?? :)
0
 

Author Comment

by:TornSoul
ID: 12708091
Sure. I've got to install some of that software first.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12708111
so is the problem solved..... or you Accepted my suggestion as "just" :-o
0
 

Author Comment

by:TornSoul
ID: 12708187
I haven't accepted an answer at the other topic as I'm still getting timeouts and errors. If you're telling me to use the newer topic now though then I'll accept yours for this topic.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12708206
ok no problem, if the recent problem is timeouts and other erros then we will move there.... but plzz confirm first that if that Webhancer and New.Net is removed from the system or not..... !!
0
 

Author Comment

by:TornSoul
ID: 12708344
Yes they're gone. Nothing's coming up in hijackthis.
0
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12708368
good so let's move to the new question...... :)
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Check out what's been happening in the Experts Exchange community.
A new hacking trick has emerged leveraging your own helpdesk or support ticketing tools as an easy way to distribute malware.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question