Author Topic: Help Unable to View Links with IE 6 (Read 18506 times)

littlep24 · « **on:** March 16, 2007, 09:58:38 AM »

I am not able to view links on most webpages; if I move the cursor it changes to a hand but there is actually no word or picture so I know what the link is. Is it do to my Java security settings?

CBMatt · « **Reply #1 on:** March 16, 2007, 10:02:00 AM »

What OS is this on?
Is this the latest version of IE6?
Do you have the latest version of Java?
When did this problem start, and what changes did you make before it started?
Have you tried another browser such as Firefox to see if this still happens?
Have you tried restoring your default settings?

Tools > Internet Options > Advanced > Restore Defaults > OK

Posting as much info as possible helps us help you.

littlep24 · « **Reply #2 on:** March 16, 2007, 10:21:28 AM »

Hi Chris,

Sorry didn't post more info
OS Windows XP
My version is 6.0.29 with sp2
Latest version of JAVA I have no idea.
I have had this problem on and off on different websites. Unforunatley, I can not tell you what changes I have made since I have been trying to trouble shoot on my own; big mistake
Last week I was on the net trying to find out how to fix it did some kind of fix (don't know what) was able to see links later that day went on couldn't see links again
I don't know anything about how to change browsers
Yes, I tried restoring my defaults
Also, I don't see an information bar

CBMatt · « **Reply #3 on:** March 16, 2007, 10:45:54 AM »

Your OS and IE seem to be up-to-date.

Go here to update your Java. I don't think that's the problem, but it's always a good idea to have the latest version.

I would also like for you to download Firefox and use it for a little while, just to see whether or not this problem is limited to IE.

What exactly do you mean by "information bar"? Are you talking about the bar at the bottom of the browser window that displays links and the loading bar? If so, go to View and make sure Status Bar is checked.

littlep24 · « **Reply #4 on:** March 16, 2007, 03:09:16 PM »

I had trouble downloading JAVA it kept saying there was already an installation in progress so I rebooted the computer but I still got the error message
I downloaded firefox and now I am able to read links
I guess I am just not comfortable with firefox since I just "assume" ie is the one to use
any thoughts on why this is happening on IE and clue me into the difference of using firefox vs ie

CBMatt · « **Reply #5 on:** March 17, 2007, 01:40:31 AM »

I had a feeling this might be exclusive to IE. Let's try a thing or two...

First, try the manual download of Java and see if that works for you.

Second, I want you to download CCleaner. We'll use that to clear out your temp files and IE junk. You could just do this through IE, but CCleaner is more thorough, and it comes in handy for other things. Anyway...before you run the program, make sure Internet Explorer (and Temporary Internet Files in particular) is checked. If you don't want to delete them, you can uncheck History, Recently Typed URL's, and Autocomplete Form History...it shouldn't make a difference either way. Also make sure System > Temporary Files is checked. Now, click on Analyze. This will give you a big list of everything the program will delete. CCleaner doesn't delete anything important, but if you see something that absolutely want for some reason, now's the time to back it up or move it. Then click on Run Cleaner and it will clear out all of those files.

Oh, and just to be on the "safe" side, don't have IE open while you do all of this. We don't want to take a chance of it interferring with the cleaning process.

Alright, now that you've done the above, try using IE for awhile and let me know if this has made a difference at all.

As for the difference between IE and Firefox...well, I don't know a whole lot about Firefox, as I don't normally use it. All I can really tell you is that the two browsers run on different engines, so they read codes somewhat differently. If you want, you can read the Wikipedia entries on Firefox and IE. I don't know if doing so will answer your question, but it might help you understand the two programs a little better.

Fed · « **Reply #6 on:** March 17, 2007, 12:52:39 PM »

1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Security tab
6. Reset all 4 security zones to Default

1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Privacy
6. Restore 1 Default button

1. Start
2. Settings
3. Control Panel
4. Internet Options
5. Advanced
6. Restore 1 Default button

You may need to do the following as well

1. Start
2. Settings
3. Control Panel
4. Internet Options
5. General tab
6. Remove cookies, temporary files and history

Kudos to Raptor.

littlep24 · « **Reply #7 on:** March 17, 2007, 05:19:26 PM »

I have done all the things asked; Cleaner and the post by Raptor resetting everything none of these have allowed me to view the links through ie

Fed · « **Reply #8 on:** March 17, 2007, 05:44:36 PM »

Can you post a link to one of the pages where this happens and a screen shot of what you see?

littlep24 · « **Reply #9 on:** March 17, 2007, 05:49:10 PM »

OK; what do you actually mean by a screen shot?

Fed · « **Reply #10 on:** March 17, 2007, 05:55:32 PM »

While you're looking at the screen in question push the 'print screen' button on your keyboard. That will load the screen into ram, then open 'paint' or any picture program and paste the picture that is saved in ram.
Then upload that saved picture to CH in a post for our viewing pleasure.

Fed · « **Reply #11 on:** March 17, 2007, 06:04:01 PM »

Like this...
EDIT: After you paste the picture in your paint program you may have to save it as a jpg or gif file to reduce it's size below the 250Kb limit imposed.

littlep24 · « **Reply #12 on:** March 17, 2007, 06:06:41 PM »

i really appreciate your help, i have it in paint how do i upload

Fed · « **Reply #13 on:** March 17, 2007, 06:09:22 PM »

Look below the box you type in to see where it says Attach & Browse.
Browse to the picture where you saved it on your computer and select it from there.

littlep24 · « **Reply #14 on:** March 17, 2007, 06:11:15 PM »

ok you will see the screen as I send it to you and then if you go to the page match.com you will see that there should be links across the top that are not on my page

Fed · « **Reply #15 on:** March 17, 2007, 06:22:16 PM »

I think I have to be signed in to get a comparable screen to the one you posted.
Do you have a more straight forward example of the problem ie a different website?

littlep24 · « **Reply #16 on:** March 17, 2007, 06:29:55 PM »

I'm sorry it happens to be a site like this, however, I am not signed in when I took the screen shot and this is the one that I currently can think of that has the problem.

Fed · « **Reply #17 on:** March 17, 2007, 06:41:12 PM »

As a test try putting the website into your IE trusted sites.

littlep24 · « **Reply #18 on:** March 17, 2007, 06:47:47 PM »

I did try that it was already in

Fed · « **Reply #19 on:** March 17, 2007, 06:54:46 PM »

Make sure it's not in your restricted sites too, have a read here.
http://www.microsoft.com/windows/ie/ie6/using/howto/security/settings.mspx
I'm not sure which setting takes precedence if it's in both?

littlep24 · « **Reply #20 on:** March 17, 2007, 07:02:55 PM »

Read the article and I have no sites in my restricted. Should I be removing ie and re downloading it?

Fed · « **Reply #21 on:** March 17, 2007, 07:08:39 PM »

No but I think you should go to windows update and let it do it's thing just to level the playing field.

littlep24 · « **Reply #22 on:** March 17, 2007, 07:12:19 PM »

ok is this off of the microsoft website

Fed · « **Reply #23 on:** March 17, 2007, 07:17:17 PM »

Yes, the microsoft website.
You should also download & run ccleaner.
Ccleaner
(During install, uncheck the Yahoo Toolbar option)
And please double check your IE defaults as listed above.
I have to go & scrape a wall for a while.

dl65 · « **Reply #24 on:** March 18, 2007, 02:42:02 AM »

littlep24........ For some reason your browser isnt loading all of the top banner........ How many sites act the same way as this one or is it the only one....... Have you toggled the IE settings to default ?
You didnt mention how long this has been occurring for.
Is your machine doing anything else odd ?

dl65

littlep24 · « **Reply #25 on:** March 18, 2007, 06:02:20 AM »

Hi wen to download, did Cleaner made sure all settings were at default
I don't know how long it has been happening and there was a time it happened with other sites unfortunately I haven't tried to use them in awhile so I don't know what they are no the computer is not doing anything else weird
I realized that there was a more basic page, after I cleared my cookies etc that showed the problems of me not seeing all the links (it is not just the top border I can't see there are also links on the right that don't come up)
here is the basic view that you would see if you went to the site

Fed · « **Reply #26 on:** March 18, 2007, 01:13:15 PM »

Are you running any programs to 'speed up your internet connection'?
How about a Hijackthis log so we can see what's running on your computer.
It's easy to do, you'll work it out.
BTW, congrats on the screeshot/uploading exercise, you figured it out with almost no input from me.

littlep24 · « **Reply #27 on:** March 18, 2007, 02:08:27 PM »

that I know of I am not using anything to speed up my computer but that doesn't mean there is nothing runnning what is hijackthis

CBMatt · « **Reply #28 on:** March 18, 2007, 03:02:15 PM »

littlep24,
Since I've basically run out of ideas for the time being, the least I can do is give you a link for HijackThis...

http://merijn.org/files/HijackThis.exe

Download that file and save it to C:\Program Files\HJT. The run the program and tell it to scan and save a log. Once it's done scanning, a Notepad file will open up. Copy everything from that file and paste here. Keep in mind that it will probably take two or three posts (we have a character limit on the board).

littlep24 · « **Reply #29 on:** March 19, 2007, 07:29:46 PM »

Logfile of HijackThis v1.99.1
Scan saved at 9:29:05 PM, on 3/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Microsoft Works\MSWorks.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Stacy\Local Settings\Temporary Internet Files\Content.IE5\RRA7MTCD\HijackThis[1].exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 64.136.29.30;64.136.21.30;64.136.29.34;searchap.untd.com;127.0.0.1;localhost;*microsoft.com;*windowsupdate.com;*wustat.windows.com;*.pogo.com;*.worldwinner.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkassociates.com;<local>
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\Stacy\Application Data\Mozilla\Profiles\default\pp1y1wvn.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Stacy\Application Data\Mozilla\Profiles\default\pp1y1wvn.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet3_88.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\Toolbar.dll (file missing)
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O15 - Trusted Zone: http://www.match.com
O15 - Trusted Zone: http://www.mcartsworkshop.com

littlep24 · « **Reply #30 on:** March 19, 2007, 07:30:29 PM »

here is my logfile
thanks
stacy
O15 - Trusted Zone: http://www.webkinz.com
O16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} - http://download.sidestep.com/get/k42037/sb026.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm1,0,2,5.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqaio/downloads/msxml4.cab
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} (Rite Aid One Hour Photo Online Control) - https://photos.riteaid.com/control/RiteAidOneHourPhotoOnline.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

littlep24 · « **Reply #31 on:** March 19, 2007, 07:31:05 PM »

here is my logfile
thanks
stacy
O15 - Trusted Zone: http://www.webkinz.com
O16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} - http://download.sidestep.com/get/k42037/sb026.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm1,0,2,5.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqaio/downloads/msxml4.cab
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} (Rite Aid One Hour Photo Online Control) - https://photos.riteaid.com/control/RiteAidOneHourPhotoOnline.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

dl65 · « **Reply #32 on:** March 19, 2007, 10:30:14 PM »

littlep24.... Ouch..... yup you are infected ........ Dont use Hijackthis to correct anything at this time.I am not seeing any anti virus application on your machine ..... what have you been using ?
The first thing I would like you to do is ..... download LSP - Fix from
http://www.majorgeeks.com/download4180.html ( Don't run it yet ....) Save it to a folder on your desktop to be used later.
Then go to http://www.bleepingcomputer.com/forums/topic3095.html
and follow the removal instructions.

If you require additional assistance please ask.
Good luck.

dl65

CBMatt · « **Reply #33 on:** March 20, 2007, 03:59:09 AM »

Eww, looks a lot like one of my practice logs. Stacy, you're going to want to run your HijackThis from a permanent location. You're running it from a temporary folder where it (and its backups) will eventually be deleted. You should create a folder called HJT in C:\Program Files and move HijackThis there where it's nice and safe. And of course, follow dl65's instructions; he'll help you get rid of your infection.

oddjob · « **Reply #34 on:** March 20, 2007, 06:22:50 AM »

Hi all

Hope you don't mind me butting in ... this will also need attention after the new.net infection is sorted ...

O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm1,0,2,5.cab

Go to Add/Remove Programs and remove iWon Plus. You will probably also want to remove the iWon EZ Setup entry which is the installer.

OJ

littlep24 · « **Reply #35 on:** March 21, 2007, 06:51:05 AM »

Ok,

Well I guess I am not running any virus protection (yikes) so I did the bleeping computer and removed the program and ran hijackthis how do I know what entries to check to be fixed in hijackthis?

thanks for all your help

oddjob · « **Reply #36 on:** March 21, 2007, 07:06:01 AM »

You must have AV running otherwise it's pointless trying to fix your system. We would all be wasting our time.

Here are some ....

AVG > http://free.grisoft.com/doc/1

Avast > http://www.avast.com/eng/avast_4_home.html

Antivir > http://www.free-av.com/antivirus/allinonen.html

Comodo > http://www.antivirus.comodo.com/

AntidoteLite >
http://www.vintage-solutions.com/English/Antivirus/Super/index.html

Clamwin > http://www.clamwin.com/

************

As to the HJT log please post it here. it will probably take several posts to get it all in.

Do not fix anything with HJT until you here from us again.

OJ

littlep24 · « **Reply #37 on:** March 21, 2007, 08:02:44 AM »

thank you for the links downloaded a spyware
here is my log attached

CBMatt · « **Reply #38 on:** March 21, 2007, 08:12:48 AM »

littlep24,
Scan with HijackThis again, but this time, select "Do a system scan and save a logfile". That will open up a log in Notepad. Copy everything from that file and paste it here. It will take at least two posts. A screenshot doesn't give all of the details and it's much harder to work with.

littlep24 · « **Reply #39 on:** March 21, 2007, 08:18:34 AM »

Logfile of HijackThis v1.99.1
Scan saved at 10:18:00 AM, on 3/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Program Files\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 64.136.29.30;64.136.21.30;64.136.29.34;searchap.untd.com;127.0.0.1;localhost;*microsoft.com;*windowsupdate.com;*wustat.windows.com;*.pogo.com;*.worldwinner.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkassociates.com;<local>
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/bookmark/7_1/home.html"); (C:\Documents and Settings\Stacy\Application Data\Mozilla\Profiles\default\pp1y1wvn.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Stacy\Application Data\Mozilla\Profiles\default\pp1y1wvn.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\Toolbar.dll (file missing)
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.match.com
O15 - Trusted Zone: http://www.mcartsworkshop.com
O15 - Trusted Zone: http://www.webkinz.com
O16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} - http://download.sidestep.com/get/k42037/sb026.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm1,0,2,5.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqaio/downloads/msxml4.cab
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} (Rite Aid One Hour Photo Online Control) - https://photos.riteaid.com/control/RiteAidOneHourPhotoOnline.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwi

littlep24 · « **Reply #40 on:** March 21, 2007, 08:18:51 AM »

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

unlovedwarrior · « **Reply #41 on:** March 21, 2007, 08:43:41 AM »

[highlight]dont delete anything until oddjob says so!!!![/highlight]

C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\snmp.exe

these have me worried what do you think oddjob the first one google showed nothing

dl avg anti-spyware 7.5 and trojan hunter

hope you dont get mad oddjob

unlovedwarrior

littlep24 · « **Reply #42 on:** March 21, 2007, 09:05:39 AM »

I didn't do this yet should I have done it or wait? When I rebooted my computer spyware came up and said there was infections I ignored them since I wasn't sure where we where in this whole process when should I run it and repair?

O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm1,0,2,5.cab

Go to Add/Remove Programs and remove iWon Plus. You will probably also want to remove the iWon EZ Setup entry which is the installer.

OJ

unlovedwarrior · « **Reply #43 on:** March 21, 2007, 09:11:33 AM »

if he asked you to do it then yes follow his instructions.

and dl avg anti-spyware and trojan hunter like i said and wait for oddjob to reply

littlep24 · « **Reply #44 on:** March 21, 2007, 09:20:02 AM »

I went to my add/remove programs and those two iwon items were not there.

oddjob · « **Reply #45 on:** March 21, 2007, 09:52:13 AM »

unlovedwarrior ... no problem. Please add anything at any time if you feel it would be useful.

Nhksrv.exe > Should be OK. See here ..
http://www.liutilities.com/products/wintaskspro/processlibrary/nhksrv/

snmp.exe > Again, should be OK. Microsoft SNMP Agent service that allows the user to configure and manage the SNMP (Simple Network Managament Protocol).

****************

littelp24 ... You should print this put to help you follow the advice.

Make sure you have exposed all Hidden Files & Folders.

To enable the viewing of Hidden files follow these steps:

   1. Close all programs so that you are at your desktop.
   2. Double-click on the My Computer icon.
   3. Select the Tools menu and click Folder Options.
   4. After the new window appears select the View tab.
   5. Put a checkmark in the checkbox labeled Display the contents of system folders.
   6. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
   7. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
   8. Remove the checkmark from the checkbox labeled Hide protected operating system files.
   9. Press the Apply button and then the OK button and close My Computer.

***********************

Download Ewido/AVG Anti Spyware from here ….

http://www.ewido.net/en/

It has a fully working 30 day trial period.

Install it and update it to the latest definitions.

Do NOT use it yet.

Now boot to safe mode. Here’s a “how to” if you’re not sure ..

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

[FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].

*******************

STILL in safe mode ... open HJT ... click on scan ... put tick/check marks next to these entries IF they are still present ...

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\Toolbar.dll (file missing)
O15 - Trusted Zone: http://www.match.com
O15 - Trusted Zone: http://www.mcartsworkshop.com
O15 - Trusted Zone: http://www.webkinz.com
O16 - DPF: {70522FA2-4656-11D5-B0E9-0050DAC24E8F} - http://download.iwon.com/ct/pm3/iwonpm1,0,2,5.cab

Remember to close ALL open browser windows – including this one – before clicking on “Fix Checked” at the foot of the HijackThis window.

NOTE >> The 015 fixes above are optional. I would never keep anything in the Trusted Zone. It's just too dangerous. However, it's your choice to fix them or not.

*******************

Reboot to normal mode and use the computer as you would usually do.

*******************

Update your Webroot Spysweper to the latest definitions and scan the computer with it. Let it fix what it wants to.

*******************

Make sure you have the latest version of java installed. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications"…..
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6-windowsi586-p.exe to install the newest version.

*******************

Also make sure your antivirus and firewall are both fully up to date.

*******************

Run a full system-wide search of your computer for iwon. Post back the results here giving the locations of anything found.

Also post back a fresh HJT log and the scan report from AVG Anti Spyware.

Let us know if anything has improved.

OJ

Computer Hope Forum

News:

Author Topic: Help Unable to View Links with IE 6 (Read 18506 times)

littlep24

CBMatt

littlep24

CBMatt

littlep24

CBMatt

Fed

littlep24

Fed

littlep24

Fed

Fed

littlep24

Fed

littlep24

Fed

littlep24

Fed

littlep24

Fed

littlep24

Fed

littlep24

Fed

dl65

littlep24

Fed

littlep24

CBMatt

littlep24

littlep24

littlep24

dl65

CBMatt

oddjob

littlep24

oddjob

littlep24

CBMatt

littlep24

littlep24

unlovedwarrior

littlep24

unlovedwarrior

littlep24

oddjob