security problem

Question

Hi!  I hope someone can help me.  I can't get into my msn account, order anything online or get into my bank account.  Is this a virus?  I have norton and a while back something showed up as an e-mail error and I had to reinstall my norton.  I keep getting 'This page is not available' when I try to get into these accounts.  It also says DNS error.  I have checked my security settings and they are fine. I am ready to toss my computer!!    Thanks, Becky

beckjamd · Answer

Hi Mike, yes the webpage did come up.   Becky

Midnight Star · Answer

Becky, Try entering in your browser's URL: 143.166.83.21 . This will being up a Dell webpage. Did the webpage display ok? Mike.

Midnight Star · Answer

Becky,

It's possible that your ISP's DNS server(s) are down.

But just in case it's something else...

Ok, let's try this as a temporary work around:

First, contact your ISP, and have them give you the IP addresses for their DNS servers. I have bellsouth and they gladly provided theirs for me. You'll need to get at least two.
Next, we're going to enter the DNS server(s) IP addresses manually, so our internet connection doesn't have to try and obtain them automatically. This will sometimes help with problems like this one.

To enter the IP Address Manually:

"Start | Control Panel | Network and Internet Connections | Network Connections"
Right-click on the icon that represents your internet connection.
Select "Properties".
Click on "Internet protocols (TCP/IP)"
Click "Properties".
On the "General" tab, click "Use the following DNS server addresses".
Enter each IP Address, and make sure they are correct.
Click "Ok".
Click "Ok".

Now, reboot your computer and try your browser again.

To reverse that process, just follow the steps down to "Use the following DNS server addresses", but instead, click "Obtain DNS server address automatically".

Mike.

beckjamd · Answer

Hi Mike,   Well, I tried doing what you suggested and it didn't work:smileysad:.  I don't know that much about computers and it gets very frustrating.  Thanks for your help!!   Becky

Midnight Star · Answer

Becky,   I'll send you a Personal Message (PM) that might help.   Mike.

beckjamd · Answer

Mike,   I just wondered if you were going to send the personal message.  I'll wait to hear from you before I have someone come here to fix the problem.  Have a great day!   Thanks, Becky

Midnight Star · Answer

Becky,   I was wondered what had happed? I sent it the same time I posted a reply. I'll send it again. I still have it in my outbox as being 'unread'. Do you know how to check for private messages while on the Dell forums?   Mike.

Midnight Star · Answer

Becky,

Let's see what's running on your system. Maybe adware/spyware is causing the problem:

Download and run HiJackThis version 1.98.2, click "Scan", then "Save log". Copy/paste the text that comes up, and post it back to this thread. Don't try and 'fix' anything, most of what it finds is good.

You can get HiJackThis from this link:

http://www.majorgeeks.com/download3155.html

Mike.

beckjamd · Answer

Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\WinTools\WToolsS.exe C:\WINDOWS\Explorer.EXE C:\Program Files\WindUpdates\WinUpdt.exe C:\WINDOWS\vbtapi.exe C:\WINDOWS\System32\sbxrya.exe C:\Program Files\WindUpdates\WinKA.exe C:\WINDOWS\SOINTGR.EXE C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe C:\PROGRA~1\NORTON~1
avapw32.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Sierra\Planner\PLNRnote.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Common Files\WinTools\WSup.exe C:\Program Files\Intuit\QuickBooks\Components\QBAgent\qbdagent2001.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Becky Matthews\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=40 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr6/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id= R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr6/*http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=40 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file) O2 - BHO: MxTargetObj Class - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - (no file) O2 - BHO: Setup.Setup1 - {2E65A557-173C-4DE9-860B-28FC5CACA542} - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Setup\Setup.dll O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32
vms.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe O4 - HKLM\..\Run: [vbtapi] C:\WINDOWS\vbtapi.exe O4 - HKLM\..\Run: [wgzcwtlrkclwq] C:\WINDOWS\System32\sbxrya.exe O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\SysUpd.exe O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1
avapw32.exe O4 - HKLM\..\Run: [mswspl] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe O4 - HKLM\..\Run: [KRYBIOVC] C:\WINDOWS\KRYBIOVC.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [fgluh] C:\WINDOWS\fgluh.exe O4 - HKLM\..\Run: [DJQWAGNT] C:\WINDOWS\DJQWAGNT.exe O4 - HKLM\..\Run: [CJDJMTZA] C:\WINDOWS\CJDJMTZA.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [atwx] C:\WINDOWS\atwx.exe O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - Global Startup: America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = C:\Sierra\Planner\PLNRnote.exe O4 - Global Startup: Internet Answering Machine.lnk = C:\Documents and Settings\Becky Matthews\Local Settings\Temp\IamSetup.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: QuickBooks 2001 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\qbdagent2001.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=e685f42af16b4ae133fb6395c0ae1826074370b6ef2ab58c7b394a46b7785ed02dcd1d18afd71cf37a3273507e405440345a19b4981e02e4ec71b0834b3328:522a1c137ec85ca995271ab95b94951b O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab O16 - DPF: {6BC013D0-77D9-11D5-AB95-0050DA664D35} (Yodlee Assistant) - https://myaccounts.nationalcity.com/apps/install/psaver/Yodelizer.cab O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) - http://www.callwave.com/include/cab/CWDL_DownLoad.CAB O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://photos.msn.com/r/neutral/controls/MsnPUpld.cab?5,0,1730,0 O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-32.cab O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://sea1fd.sea1.hotmail.msn.com/activex/HMAtchmt.ocx O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F0E11F79-01DD-4B6B-A25B-E282867D829F}: NameServer = 69.87.145.2 69.87.145.3   Here you go Mike, thanks for all your help!!  I had downloaden the wrong one.  I have MSN Mess. but like I said before, I can't get in until this problem is fixed.    Thanks, Becky

Midnight Star · Answer

Becky,

There quite a few baddies in there, but before we get started getting some of that stuff off, could you post back any " Add/Remove programs" entry(s) that your not familar with, like:

WinTools

anyhing with the word ' search' in it.

Bargain-Buddy

Acup

Ikena

Bargain Buddy

Transponder

CashBack
(stuff like that.)

We'll try and remove those problems from there first, before we move on to using HiJackThis. That way, that garbage shouldn't be left all over the place, including your pc's registry.

Mike.

Midnight Star · Answer

Becky,

Good! Ok, let's remove the following:

Win-tools easy installer
Search Assistant
Web Search Tools

I'm working your log right now; while i'm working on your log I need you to do the following if you can:

Go to www.trendmicro.com and click "Free Online Scan". It will take a few minutes to download and install. When it's done, select all available drives, then click "Scan".
Download and install AdAware Se Personal. Run it, then check for any available updates, then "perform a full system scan".
Download and install Spybot S&D. Run it, then check for any available updates, then click "Check for Problems".

All the above programs are provided by their respective developers free of charge, for use.

Mike.

beckjamd · Answer

Ok, this is what I found:

My Password Saver, search assistant, software update manager, spielserver, VB runtime, web search tools, windows xp hotfex (it's on 24 times), win-tools easy installer, and WSEM update.

Those are the ones I'm not sure about.

Becky

Midnight Star · Answer

Becky,

You need to run them again after updating their malware definitions. Make sure your using AdAware SE Personal; version 1.05, and Spybot S&D; version 1.3. Try the HouseCall online virus/ trojan scanner and see what it turns up.

I'm seeing at least 8 possibilities, with even more registry entry(s), more than likely present.

Here's a heads up:

WinUpdt.exe, sbxrya.exe, SysUpd.exe, KRYBIOVC.exe, fgluh.exe, DJQWAGNT.exe, CJDJMTZA.exe, atwx.exe

... among a bunch of others.

But first try those three scans and let's see what they remove. Remember, HiJackThis will remove one registry entry, and possibly the program, but this stuff usually dumps dozens of registry entries per 'problem', let the above program do most of the cleanup work for us.

Mike.

Midnight Star · Answer

Becky,   I've got the solution written up, but before I post it, what is the status on the above scans; HouseCall, AdAware and Spybot?   If you weren't able to get them to run, i'll post the current solution, otherwise, post back a new HiJackThis log, and let's see what's left.   Mike.

beckjamd · Answer

I have Adaware and Spybot Search & Destroy but not the other one.  I haven't scaned them in about a week. Becky

Virus & Spyware

security problem

Was this post helpful?