Help

Start a discussion
UNSOLVED

djscas

updated

20 years ago

D

djscas

47 Posts

0

12775

March 18th, 2007 21:00

For 1972vet, as requested

Ok. picking up the remaining issues... re, Internet Options hanging up when trying to update the tabs/ options in this dialogue box, e.g., setting the home page, deleting the history files, checking/unchecking boxes in the advanced tab, and changing the security levels.  Those problems are still occurring as of this evening.
 
Please refer to the following link in this forum for add'l information.
 
windows xp hyperlink redirection problem / Software - HijackThis
...   Message Edited by djscas on 02-25-2007 02:51 PM
 
Regarding your last note on the Norton problems...  I haven't had any notes or error messages that the program is not functioning as it should.  In your last post for the above message, you indicated that the last log showed that some of the Norton components were missing.  I ran Norton Autofix and it did not show any problems.
 
Please advise so I can look into those areas.
 
Thanks, again for your time and support.  Will await your next posting.
 


Message Edited by djscas on 03-18-2007 07:53 PM

Message Edited by djscas on 03-19-2007 06:00 AM

Message Edited by djscas on 03-19-2007 06:01 AM
  • 1

    1972vet

    3305 Posts

    711

    0

    Posted March 19th, 2007 12:00

    OK, here we go...the most probable cause(s) of the interference with IE 6 & 7 would have to be a common denominator present while each browser is installed and designated as primary.
    These common denominators are:
    Your Windows Defender software
    Your Symantec "nprotect" feature
    ...and the following entry that is present in all of your hjt logs:
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    Of those, the more likely candidate is the "O6" entry that appears in your hjt log. That entry indicates to me that you either have, or have had the application "Spybot Search and Destroy" (or some similar software) installed and have employed the use of it's Administrative Lock Down feature. Be advised...that's actually a good thing, but will cause heartburn to users who aren't aware of the down side. That is, these features will prevent the current user (or all users depending on it's configuration settings) from making any changes to certain system settings. IE start page of course is one of those.

    So...to troubleshoot this issue properly, let's tackle those suspects one at a time. After each attempt to resolve this issue, we will go back to the IE options and try the "Delete All" function and try changing the start page to see if the issue remains. If so, then we abandon that one and go on to the next...see?

    So...for your first step, open your on board Spybot Search and Destroy, click the Mode option from the menu at the top and select "advanced" then answer "Yes". You'll see three more options available to you now at the bottom in that left side pane. Click the Tools link from those options. Now, from that drop down list of options, click the "IE tweaks" link. Are there any checks in those boxes in the right pane window? If so, click to remove them, then click "Apply" and close the application. Try your "Delete all" and changing the IE start page now to see if that resolves the issue.

    The missing symantec component (Symantec Service Framework) is represented by all of these entries from your last hjt log:
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

    O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

    All three actually represent only one component but, that component is serving these three functions...or it's supposed to. The log indicates that the service element "ccSvcHst.exe" is missing...although, with hjt, the "O23" entries are not always relied upon as having accurate information regarding this "file missing" message. Each time we see this, the issue must be thoroughly researched. In this case, the alternative message from hjt "no file" is what's important here.

    If it were to have said "no file" instead of "file missing" I would recommend reinstalling the software again. But in this case, the message "file missing" may simply imply that the service is present, but just not running. You can check this in your Services panel.

    To do this, Right-Click on My Computer and select "Manage". When the "Computer Management" console opens, click "Services and Applications" from the left pane at the bottom. Now Double-Click "Services" in the right pane. Click the "Standard" tab at the bottom to move the text over so you can read it better. Now scroll down and locate the following Service Names
    (ccEvtMgr)
    ccSetMgr
    CLTNetCnService

    For each one located, double click on it to open it's properties box. Now, click the Startup type drop down arrow and select Automatic. Under "Service status" click the Start button. Apply it, OK it, and close the properties box. Do this for each of those services listed above. When finished, close the Computer Management Console and reboot to properly record the changes made to the disk.

    Post back and let us know your results. Thanks!
  • 1

    1972vet

    3305 Posts

    711

    0

    Posted March 19th, 2007 16:00

    And by the way, getting back to the "Shkdobw.exe" issue, there is one theory that perhaps the findit scan presented the file that way based upon the user log on. Can you advise us as to whether or not the initials "Sh" appear anywhere in your user account that you were using while logged on during that findit scan?


    I've tested this theory by creating the same Registry entry in my "System" value under the winlogon and can find the entry for it's discovery during the SilentRunners scan...however, even though I've created the same Registry entry that you had, I still cannot create the same findit log with those criteria...which sort of implies to me, that this may indeed be a new "as yet unknown" infection.

    Please advise, thanks!
  • D

    djscas

    47 Posts

    711

    0

    Posted March 19th, 2007 23:00

    I did a quick search in Windows Explorer.
     
    There are three "ccCommon" files listed in the following folder:
     
    C:/Program Files....... /Symantec Shared/SPManifest/
     
    ccCommon.grd
    ccCommon.sig
    ccCommon.spm
     
    Note that they are not in the Symantec Shared folder but one step down in the SpManifest folder.
     
    Again, not sure if that has any meaning or significance, but I thought you might need to know.
     
    Thanks, again.
  • D

    djscas

    47 Posts

    711

    0

    Posted March 19th, 2007 23:00

    I'll address the issues you raised in both of the boxes....
     
    1.  My user account is David Sheneman (computer administrator).  So, yes, there is an "Sh" in the user account.
     
    2.  Spybot Search and Destroy........   There are no boxes checked in the IE Tweaks section of the Advanced Mode page.  All three are unchecked.
     
    3.  Regarding the following three items:
     
           (ccEvtMgr)
           ccSetMgr
           CLTNetCnService

    I don't have these three listed exactly as you're showing them from the log file, as such, in the services sections.  I do, have those same three line items covered, though as follows:

    _________________

    Your first listing from the forum posting:

    O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

    This is the path entry for the Symantec Event Manager service from My Computer:

    "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon

    The service is listed as already started and running under "automatic"

    ________________________

    Your second listing from the forum:


    O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

    This is the path entry for the Symantec Settings Manager service from My Computer:

    "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon

    This service is listed as already started and running under "automatic"

    ________________________

    Your third listing from the forum:


    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

    This is the path entry for the Symantec NetConnect service from My Computer:

    "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon

    The service is listed as already started and running under "automatic"

    __________________
     
    Haven't a clue........ I don't know (out of my league) as to why the logs are recording the properties lines for those three services and showing that a file is "missing"  The services tab shows all three as started and running under the automatic option.
     
    ___________________
     
    So, to this point, looking at the above options, I haven't made any changes to any of the programs from this posting.
     
    Let me know where to go from here......   I hope you like a good challenge.
     
    Thanks a million.



    Message Edited by djscas on 03-19-2007 07:09 PM
  • 1

    1972vet

    3305 Posts

    711

    0

    Posted March 20th, 2007 01:00

    Quote:
    1. My user account is David Sheneman...
    Excellent. One down. Don't know how your account is set up exactly, as I tried to add initials to my own user account and make the findit batch file show ANYTHING with the initials in front of an exectutable file as was the case with your log. Adding the exact number of characters and spacing...I still couldn't duplicate this phenomenon. Those much smarter than I had already suggested this was the case...Regardless, thanks a million. Mystery solved.

    2. Spybot Search and Destroy........ There are no boxes checked in the IE Tweaks section of the Advanced Mode page. All three are unchecked.
    Then, if that's the case, I believe this may be the reason for your issues. The "O6" entry in the hjt log indicates the presence of administrative locking features. If you know with certainty that you did nothing to lock down any administrative features preventing the changing of certain System Settings, then we need to fix that line in the hjt log.

    3. Regarding the following three items:

    (ccEvtMgr)
    ccSetMgr
    CLTNetCnService

    I don't have these three listed exactly as you're showing them from the log file, as such, in the services sections. I do, have those same three line items covered, though as follows:
    Regardless, if you found all three of those in your services listings and all are started and set to run automatically, then all is well there.

    HijackThis doesn't always pick up certain entries, "O9's" and "O23's" for example, with accurate messages regarding their presence (i.e. file missing or no file messages). This is due to what's called a "White List". In this instance however, my guess is that those services are so new from symantec and the white list not having been updated is the reason for the inquiry. Not necessarily these two, ccEvtMgr and ccSetMgr, as I know they have been around quite a while, but the CLTNetCnService which ties them all together may be the culprit. But as mentioned, not to worry since you found those services in the list and verified their settings.

    Now, on to step two:

    Please disable Windows Defender again as it will interfere with the removal of the entry using hjt. Remember to re-enable it again when finished.

    Please run HijackThis again and check the box next to the following entry:
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

    Close all windows now including this browser window...leaving only the HijackThis application window open, then click the Fix Checked button.

    Reboot to properly record the changes made to the disk. Once the system comes back up, try your IE "Delete All" function and try to change your start page. Post back your results.
  • D

    djscas

    47 Posts

    711

    0

    Posted March 20th, 2007 20:00

    Well, I wish I could say that it worked.  It didn't.  Still hangs up on the start page, delete history files (again, all of the other delete options work fine), security changes, advanced tab changes......
     
    I've enclosed a copy of the hijackthis.log run after I deleted the "06" entry.
     
    Logfile of HijackThis v1.99.1
    Scan saved at 4:56:48 PM, on 3/20/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\Program Files\Canon\\CALMAIN.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\CTHELPER.EXE
    C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    C:\WINDOWS\system32\taskswitch.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
    C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Dell Support\DSAgnt.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\PROGRA~1\HEWLET~1\Toolbox\STATUS~1\STATUS~1.EXE
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Hewlett-Packard\Toolbox\jre\bin\javaw.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [FinishOptions] C:\Program Files\Hewlett-Packard\hp LaserJet 2410 2420 2430\Installer\hpbinxst.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
    O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
    O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O8 - Extra context menu item: Open with WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
    O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
    O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {156BF4B7-AE3A-4365-BD88-95A75AF8F09D} (HPSDDX Class) - http://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158883620281
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158883613968
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
    O16 - DPF: {D42ED9FF-DF46-4AD9-A3FE-46BAF896466E} (CountSpies.SpyCounter) - http://www.sunbelt-software.com/dell/CounterSpy.CAB
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15026/CTPID.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C8492193-F47B-4AA0-9C10-7D63244C15D0}: NameServer = 207.255.0.130,207.255.0.131
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
    O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
    O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
    O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
     
     
    Do we somehow re-enter the "06" entry line since the deletion didn't work.  Or was it superfluous anyhow?
     
    Thanks, again.
     
    Will await your next suggestion for this "saga."
  • 1

    1972vet

    3305 Posts

    711

    0

    Posted March 20th, 2007 22:00

    We can continue troubleshooting your issues here but it's not necessary to post any hjt logs for this process (at least, not in this forum). If I need another hjt log from you, I will ask you to post again in the HijackThis forum. Thanks!

    Quote: Still hangs up on the start page, delete history files (again, all of the other delete options work fine), security changes, advanced tab changes......
    What start page are you trying to change to?

    Quote: Do we somehow re-enter the "06" entry line since the deletion didn't work. Or was it superfluous anyhow?
    As I recall, you had said you checked Spybot Search and Destroy and found there were no check marks in the lock out features available there. Considering that the "O6" entries in the hjt logs usually appear because the user is taking advantage of these lock out features, and that you have confirmed you do not use these features, then you would not need nor want to add the "O6" entry back to your Registry.

    Let's try to "Delete All" using a different approach. Make sure all browser windows are closed.

    Click start-->run, then copy and paste the following, into the run box and click "OK":

    RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255

    Immediately after clicking "OK", the run box will close.

    Next, still without opening any browser windows, from the control panel, double click the "Internet Options" icon. Under the "Browsing history" section, click the Settings button. Next, click the View files button. When the Temporary Internet Files window opens, copy all the data that appears and paste it back here on your next reply.

    With your current start page being "MyMSN", a password (msn passport) protected sign in, you should not experience any "Hang" issue while signed out of your passport. This of course would include any messengers that you might have running that ALSO use the SAME msn passport (or other msn pages that use the same passport). You are aware that any messenger is also a browser of sorts...aren't you?

    Let me know if you'd rather have a command that deletes those functions individually rather that deleting "All" (which of course, also deletes all of your cookies). Thanks!
  • D

    djscas

    47 Posts

    711

    0

    Posted March 21st, 2007 00:00

    OK, still have problems..
     
    1.   When I delete my cookies, etc., I have to log back into my.msn.com for my start page and then need to select apply / ok to save it.  It's when I click apply that the program appears to hang.  But when I finally get it closed out through Task Manager and go back into IE that it shows that it did in fact save the URL before hanging up.
     
    2.   When I copied the following script in the "Run" box.............. RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255............. the Run dialogue box closed immediately, but the "deleting browsing history" box opened the same way it does in Internet Options through the Control Panel or through the browser window.  And as it has been doing for some time now, it then hangs / freezes at that dialogue box.  The sliding blocks in the progress bar just continue to slide across the box from left to right without ever completing.  Finally, I must use Task Manager to close the "not responding" action and exit the program.
     
    3.  I could not copy the information you requested from the delete history / settings/ screen.  While I could use the select all (only the left hand column would highlight) and the copy icon, nothing copied.  I tried using both the copy icon and the Cntrl-C key strike; neither one worked for copying the information to the clipboard.  When I would get into this posting, and used the Cntrl-V key nothing happened........  there wasn't any data there to paste.  Neither could I get it to work using the paste icon at the top of this block.
     
    I also tried to copy the list to the notepad and then pasting. ...  Did not work, either.
     
    Do you have any suggestions on how to get the material into this posting for you to review?
     
    4.  I do not use MSN Messenger in any fashion.  And the Messenger services are disabled.
     
    5.  As noted previously, all of the delete options in Internet Options  / Delete History tab work except for the history files itself. Not sure just what you were asking in the last paragraph.  I guess I'd like to be able to delete "all" temp files, including cookies.  That's what I've done in the past just to keep the system cleaned out.  Don't mind having to log in on startup after doing that.... Provided that the system will save the home page parms even though it freezes up when trying to select that initial home page setting.
     
    Thanks
     


     
  • 1

    1972vet

    3305 Posts

    711

    0

    Posted March 21st, 2007 03:00

    What is the web page that you are trying to use as your new start page?
  • D

    djscas

    47 Posts

    599

    0

    Posted March 21st, 2007 16:00

    I use a my.msn.com  as my home page.  When I delete all the history, etc., files the password is deleted and I need to log in again.  When it comes up on the screen I then go to InternetOptions and select "use current page" as the option, click on "apply" and then "ok."  It's after I click on either "apply" or "ok" that the system hangs up.
     
    But it doen't matter what page I try to select as my home page.  I can pick any site I want and then use the Internet Options procedure, as listed above, to make that my default home page.   While it apparently gets the message to apply the page as the home page,  the program freezes/ hangs up with the hour glass cursor and then does nothing to complete the process and return to the Internet Options dialogue box. 
     
    I then have to use the task manager to close out the session and get out of IE.
     
    This is the same common problem that happens with the delete history tab and the others mentioned previously.
     
    Once in awhile (and only once in a great while) will the Internet Options work as they should.  It's then that I get up the false hope that the problem has been resolved.  However, after 1-2 reboots of the computer, or 1-2 exits from, and reentry to, IExplorer, the problem resurfaces and the Internet Options are back acting up.
     
     


    Message Edited by djscas on 03-21-2007 05:45 PM

    Message Edited by djscas on 03-21-2007 05:45 PM

    Message Edited by djscas on 03-21-2007 05:45 PM

Dell Support Resources

Latest Solutions

View More