One particular site...

Question

for a few days now (ever since i re-arranged my living space a bit and had to unhitch and re-hookup my computer again) i've been having trouble getting online. i'll surf some websites just fine, and when i get to others all my browsers windows will just......close. at first i thought it was because i had too many windows open, but decided no, because i will have 4 or 5 windows open all the time and it's never been a problem for me. now, it seems to be whenever i go to this one website it's a picture rating site. and log into my user menu that my window closes. i have run norton anti-virus twice in the last three days and it's come up virus free each time. but when i do ctrl+alt+delete i have two things show up i don't normally see: 'comwiz.exe' and 'winnet.exe'; i tried looking for winnet.exe on a search and came up empty handed, but when i looked for comwiz, i found something at symantec that said it was a virus and it like to shut down computer browsers..... if this is so, why isn't norton's detecting it and deleting it? my definitions are up to date.... i'm really confused here, as you can probably tell. but i'm sick of my computer shutting down on me when i go to this site. and i don't want to stop going, because my friends and i go there all the time. (sorry it was so long... i can clear up anything that needs clearing up!)

YoKenny · Answer

mandarinspyce, Norton is a good anti virus application. The two files you indicate are not viuses but "mallware."

please read these two sites:
http://www.ryanstarrett.com/viruses/aimtalkstocks.html

http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=572

Read the links below to have a safer Internet experience in 2004.
I recommend IE-SPYAD and SpywareBlaster available in these links.

Post a new log here when finished to insure you log is clean.

mandarinspyce · Answer

i went to the first site and deleted whatever files i could find that were listed, so hopefully i'm ok. i guess i won't know though, untill i get going. i just barely signed on so, thanks!

one other question.. i have this program listed under "add/remove programs" called shopathome select agent. do you know what is? because i tried to uninstall it, it sounds like it might be another spyware/mallware kinda thing. anyway, i tried to uninstall it and it said "sahagent.exe is currently shutdown. uninstall will continue after next system reboot." but i've tried uninstalling it several times, then rebooting my computer and i always get the same message. how do i get rid of it?

thanks!

mandarinspyce · Answer

no. my windows are still shutting down when i visit this one particular website. i didn't have this problem a week ago. what gives?

ChrisRLG · Answer

Use these to remove Malware (Spyware and Adware).

1) SpyBot Search and Destroy
After installing SpyBot Search & Destroy, first press Online, and search for, put a check mark at, and install all updates.
Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot remove all the items it marks in red.

2) Get Ad-Aware
After installing Ad-Aware, and before running the program, first press “check for updates now".
Click "Connect" and install all updated components available. Click 'Finish'.
Press "Scan Now", then 'next', and let Ad-Aware scan your drives.
It will find a number of "bad" files and registry keys. Click 'Next' again.
Check all found items, and click 'next' once more.
It will ask you whether you'd like to remove all checked items. Click OK.

Always reboot the computer between each program - both of these may find things that they need to have a reboot of the machine to clear - please reboot and let them finish .

Failing those solving your problems a post of a hijackthis log for the experts to advise.
HijackThis From Here
Download, run, scan, save log, then in notepad copy the FULL log by copy and paste as a reply to this post and an expert with HijackThis Knowldge, will have a go at giving advice. Please note the list of experts names below, very few forum regulars here have had this training.

DO NOT FIX ANYTHING WITH HIJACKTHIS WITHOUT EXPERT ADVICE, most of what it finds you need for normal MS Windows tasks.

Known Spyware HijackThis fighters in DellTalk - If you are, and are not on the list please PM Me.
ChrisRLG (Expert in Training LOL, at Tomcoyotes)
YoKenny (Accredited Expert at TomCoyotes)
baskar1234 (Teaching Assistant at TomCoyotes)
Yellowhammer (Expert in Training at TomCoyotes)
TomCoyote (of http://tomcoyote.org/forums/index.php)

You could also go to one of the more specalist forums where more experts will be able to help.
http://tomcoyote.org/forums/index.php
http://forums.spywareinfo.com/index.php
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi (Home of Spybot S&D)
http://boards.cexx.org/index.php
Do read the sites FAQ before posting, and advise your problem and what steps you have already done to try to cure your problem.

I, and the other hijack experts mentioned above, are in all those sites (and more) with the same login names. You might get one of us at those sites also to anwser your log, but other experts will also be available.

mandarinspyce · Answer

wow. thanks chris. i downloaded those and found i had alot of stuff on my hard drive i didn't know about. it's all gone now. but i'm still having problems with that site. should i just give up... or call dell directly? and i'm still getting background pop-ups that come, and then disappear without me touching them. Message Edited by mandarinspyce on 01-09-2004 11:19 AM

ChrisRLG · Answer

Carry on with the hijackthis instructions. Lots of new stuff is not found by spybotS&D and ad-aware. Post your log as a reply here.

mandarinspyce · Answer

i went to the hijackthis website and i didn't understand a word of it.

what exactly is it, and what does the program do? i'm just confused because you said "do not fix anything with hijackthis without expert advice, most of what it finds you need for normal ms windows tasks". is it dangerous? coz i don't want it screwing up my computer; i just barely got it in august...

-spyce

mandarinspyce · Answer

on second though... nevermind. i think i figured it out. i guess i just needed to go over it a second time. this is my log:   Logfile of HijackThis v1.97.7Scan saved at 10:01:33 AM, on 1/12/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\cisvc.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\System32\hkcmd.exeC:\WINDOWS\BCMSMMSG.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\EarthLink\FastLane\IPClient.exeC:\Program Files\EarthLink\FastLane\IPMon32.exeC:\Program Files\Proxyconn\PxUi.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\Proxyconn\PxClient.exeC:\Program Files\AIM\aim.exeC:\Program Files\EarthLink\FastLane\IPClient.exeC:\WINDOWS\system32\cidaemon.exeC:\WINDOWS\system32\cidaemon.exeC:\Program Files\Free Downloads Accelerator\fdaagent.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Ricky Gray\Desktop\HijackThis.exeC:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.netR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:6198R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = clinic.mcafee.com; bin.mcafee.com; download.mcafee.com; R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.dellnet.com/ R3 - Default URLSearchHook is missing O1 - Hosts: comments (such as these) may be inserted on individual O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file) O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS	waintec.dll O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O2 - BHO: ProxyConn Browser Helper Object - {7D9E713D-0388-4384-BDD8-2A42EB1C4F04} - C:\PROGRA~1\PROXYC~1\PRXCNB~1.DLL O2 - BHO: (no name) - {98DE779A-2364-4293-AB71-2B97C61C4640} - C:\PROGRA~1\FREEDO~1\fdahlp99.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: FDA Bar - {9595C62C-76C6-49A6-9BDA-3253DD7A34FF} - C:\Program Files\Free Downloads Accelerator\fdabar99.dll O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [ccRegVfy] 'C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe' O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [IPInSightLAN 01] 'C:\Program Files\EarthLink\FastLane\IPClient.exe' -l O4 - HKLM\..\Run: [IPInSightMonitor 01] 'C:\Program Files\EarthLink\FastLane\IPMon32.exe' O4 - HKLM\..\Run: [PxClient.exe] 'C:\Program Files\Proxyconn\PxUi.exe'  /Automation O4 - HKLM\..\Run: [POINTER] point32.exe O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKCU\..\Run: [HELPEXP.EXE] C:\Program Files\Alset\HelpExpress\Ricky Gray\Client\HelpExp.exe O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\MSMSGS.EXE' /background O4 - HKCU\..\Run: [E6TaskPanel] 'C:\Program Files\EarthLink TotalAccess\TaskPanl.exe' -winstart O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Download with Free Downloads Accelerator - C:\Program Files\Free Downloads Accelerator\fdaie.htm O9 - Extra button: AIM (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0C49AF42-B6F7-411B-9C2C-D4C75A846EA3}: NameServer = 69.24.8.2 69.24.0.2 O17 - HKLM\System\CS1\Services\Tcpip\..\{0C49AF42-B6F7-411B-9C2C-D4C75A846EA3}: NameServer = 69.24.8.2 69.24.0.2   aye yi yi. what to do? lol/ -spyce Message Edited by mandarinspyce on 01-12-2004 09:07 AM

YoKenny · Answer

mandarinspyce, you have the FavoriteMan hijacker:
http://doxdesk.com/parasite/FavoriteMan.html

A partial removal of FavoriteMan can be done by going to Start then Control Panel then Add/Remove Programs and un-install 'F1' or 'ZZ' and click 'Remove'.

Also un-install HelpExpress

Then Reboot after removal.

First to fix the problem not being able to get to http://www.hotornot.com:

1. make sure 'show all files' is enabled:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339?Open&src=&docid=2002103012571948&nsf=ent-security.nsf&view=docid&dtype=∏=&ver=&osv=&osv_lvl==

2. go to Start then Search and search in all files and folders and delete a file called HOSTS. It could be lowercase but this is the exact name. Do not remove HOSTS.SAM if present.

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder.

Then run HijackThis from this folder and click on the items indicated below if still present and have it "Fixed checked." It will create a backup file of modifications to use if restore is necessary.

R3 - Default URLSearchHook is missing
O1 - Hosts: comments (such as these) may be inserted on individual
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\EarthLink\FastLane\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink\FastLane\IPMon32.exe"
O4 - HKCU\..\Run: [HELPEXP.EXE] C:\Program Files\Alset\HelpExpress\Ricky Gray\Client\HelpExp.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer)

Then Reboot

Read the links below to have a safer Internet experience in 2004.
I recommend IE-SPYAD and SpywareBlaster available in these links.

Post a new log here when finished to insure you log is clean.

mandarinspyce · Answer

i did a search of my add/remove programs and i do not have any files called "f1", "zz" or "help express" to uninstall. does that cause problems? (i hope not!)

also, i did a search for hosts and this was my result:

i got several files called "hosts" but in different locations. i deleted the two called "HOSTS" (with no extensions), but which other one(s) do i delete, if any? and this... LMHOSTS.SAM or whatever it's called, do i delete that too, or is that the same thing as hosts.sam and i should leave it alone? same with hosts.ics, hosts.sbs, hosts.sbs.sig, and the ones with long names... do i delete those or leave them alone? even though i deleted those hosts files, i'm still unable to visit anything at meetme.hotornot.com and my browser closes at random intervals, causing me to lose any unsaved information. and i did do the whole "show all files"...

god, sorry i'm being such a pest. i know alot about computers... just not about fixing them, lol.

thanks you guys for your time though. i do appreciate it!

-spyce

Message Edited by mandarinspyce on 01-13-2004 01:44 PM

YoKenny · Answer

Wonderful.

The only one you need to delete is in C:\WINDOWS\system32\drivers\etc

By the way you may want to edit this file with Notepad and do a search on the site you can not access to see if it is in there. It is probably wrong.

That is the active file. Best to reboot after deleting it.

This HOSTS file is a way to quickly resolve Web names. It is a bit technicall to discuss though.

I only use the HOSTS file to block the MANY ad sites and cookies. But this is another discussion you may want to have.

It is like the IE-SPYAD protection available in the link below.

mandarinspyce · Answer

which one do i want to edit? the one i'm deleting? because i already deleted (oops?) but i checked and there was nothing in there. i mean, i bunch of # signs and jibber-jabber... but that was it.

edit: this is what it said:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

??? what's all that mean? anything important?

Message Edited by mandarinspyce on 01-14-2004 03:35 AM

ChrisRLG · Answer

That file looks like the unaltered MS version, so does not look like it was your problem.

I am sure YoKenny will be arround to help some more. In the mean time if you (or others that are reading) wish to know more about the hosts file and what it does, try this link http://www.accs-net.com/hosts/

mandarinspyce · Answer

hmmm... ok. no problem! thanks!

YoKenny · Answer

mandarinspyce, as Chris indicated that is a good site to learn about the HOSTS file.

Basically the # indicates all that follows is a comment and 127.0.0.1 localhost just indicates your computer.

This is not causing your problem getting to the site you want. I can reach the site fine. Are you still having a problem getting to the site?

Virus & Spyware

One particular site...

Was this post helpful?