lost internet connection // compaq presario laptop

[FreewheelinFrank]

Congratulations you did well!

Cookies are not a serious problem: no need to worry about them.

MRU's are nothing to worry about.

Looks like Ad-Aware found one dialer: not something you want on a dial-up connection because it will connect to a premium rate line: that's been deleted.

Doesn't look like VX2 Finder found anything: I think you did the right thing to cancel it.

If you have an internet connection, update Ad-Aware, Spybot, your AV program and the anti-Trojan program and scan again- these things often find more the second time around.

Ten can you post a HijackThis! log please? This will let us see what is running on your computer and check there is no malware left.

http://www.bleepingcomputer.com/tutorials/tutorial42.HTML

[kristin]

thank you! 
You have no idea how happy I am right now.
I updated all the programs I put on here today already, and scanned the computer again. Found some more stuff, mostly the same thing as last time : cookies and MRU's

Looks like Ad-Aware found one dialer: not something you want on a dial-up connection because it will connect to a premium rate line: that's been deleted.

Im using wireless though?

Anyway, I already posted a HJT log at
http://www.techspot.com/vb/menu28.html
would you like me to post it here too?

I figured this is the avast! forums, that Id better not bother people here with a HJT log.

The link you left at the bottom said 404error : Page not found
 
thanks again. for everything.

[DavidR]

Try this link, http://www.bleepingcomputer.com/forums/tutorial42.html.

Since you have already had a prompt response at the TechSpot forums http://www.techspot.com/vb/showthread.php?t=61538, which have indicated two items that need fixed (correctly), I would say stick with them unless you have problems. The above bleeping computers tutorial link may help you with things they may talk about. I would have looked at you log file but as a guest at their forums, I don't have permission to open it.

[kristin]

David I dont mind a second opinion. I havent had any troubles after the removal of the things he said remove.
Everything seems to be doing really well actually.
But if you'd like to take a look, by all means. Hope copy and paste is okay. I dont see a way to attach a file ?
This was done just now, after I fixed those other 2 things.
Logfile of HijackThis v1.99.1
Scan saved at 5:12:34 PM, on 10/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\AOL\1109013133\ee\AOLSoftware.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\TrojanHunter 4.6\THGuard.exe
C:\Program Files\Grisoft\AVG7\avgw.exe
C:\Program Files\Grisoft\AVG7\avgwb.dat
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_1.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1109013133\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_cx460035df\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.6\THGuard.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=laptop
O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Common Files\AOL\AOL Spyware Protection\\aolserv.exe (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: Smckwntsssii - SMC - (no file)
O23 - Service: Software Jukebox v2.0 Service - Unknown owner - C:\Program Files\Common Files\MSJB NA02D Shared\Service\Software Jukebox v2.0 Service File.exe

By the way, I was wondering, we dont use AOL at all, removing it from the computer shouldnt cause problems should it?

[DavidR]

Well firstly I see multiple AVs installed and neither of them are avast ?
Having two (or more) resident scanners installed is not recommended as rather than provide twice the protection it can cause conflicts that could leave you more vulnerable.

Have you uninstalled avast ?
Aside from the multiple AVs there doesn't apear to be any major issues, you should be able to fix the AOHell entries if as you said you don't use it any more. However, you have an AOHell running process:
C:\Program Files\Common Files\AOL\1109013133\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1109013133\ee\AOLSoftware.exe

Since I have never used AOHell I don't know how to get rid of it completely.

[kristin]

multiple?
hmm, well I did uninstall avast the night that everything went wrong. It was causing my computer to lag, because a pop up kept appearing saying the mail support wasnt turned on or something along those lines, multiple popups, all coming at once, saying the same thing, and I couldnt go into my computer > network settings and such because of all the popups, I was more concerned with the loss of the internet. I installed AVG today because I was following the steps in a link FreewheelinFrank gave me and step one was to have a antivirus software installed, I didnt know if I should go back to avast yet, since I didnt know what the problem was to begin with.
I dont know what the other AV could be. I completely uninstalled Norton earlier.
I will eventually go back to avast, I have it on my other computer, Im just scared right now. Even though its uninstalled its still listed in My Programs. Im scared of more problems. I just want to enjoy a computer thats running for a bit.
AOHell is listed in my tray, it runs on start up waiting to be used, but I dont use it and I dont want to, the previous owner must have.
I used to have Aol on my old computer, and Im convinced it messed my IE up, so I wont go back to it. I already tried removing it from add/remove programs, but it seems to be all over my computer.
Thats fine if you dont know how to remove it, Ill look around.
Thanks again.

[DavidR]

Sorry I just saw the McAfee stuff and wasn't sure if it was AV and Firewall.

I didn't know if I should go back to avast yet, since I didnt know what the problem was to begin with.

Well who has been helping you through this, I know one thing for sure you don't get this kind of support with AVG free.

I assume we are still talking about your brothers system, but installing avast on an already compromised system and one that also had Norton on it is a risky business. Getting rid of the remnants of Norton can be as difficult as getting rid of a virus and remnants can have a huge potential for conflict, which can have avast disable elements of itself to avoid this potential, this might have been what you were seeing in avast not working fully.

The NAV add remove programs uninstall often leaves remnants as many posts in the forums attest. A link worth looking at, which is a program removal tool that can remove the remnants of a number of different Norton Programs:
Removing your Norton program using SymNRT
You can also download SymNRT, a Norton uninstall tool that uninstalls all Norton 2004/2005/2006 products and run this off-line.

Sorry I'm coming to your party a bit late and playing catch-up, Spiritsongs asking how you removed Norton is really related to what I have given above as the add remove programs uninstall often proves insufficient and can cause conflict with avast!. You need to go hunting the registry entries, etc. this is what the SymNRT removal tools do.

[Spiritsongs]

   Hi Kristin :

      Concerning using Ad-Aware in the future : the Ad-Aware
      Support Forums recommend UNCHECKING the "Search for
      negligible risk entries" Setting AND CHECKING ( turn the
      red indicator to green ) the "Search for low-risk threats"
      Setting just below it; this is so the no-threat "MRU"s do
      NOT appear in the "Scan Summary". ALL "critical objects"
      found by Ad-Aware should 1st be "quarantined", UNLESS
      they are "tracking cookies" and/or "Alexa", which can be
      directly "Deleted". 48 Tracking cookies in your scan
      results indicate a cookie "problem", best "controlled" by
      using a "cookie manager", such as the GOOD & FREE
     "Cookiewall".
       To learn HOW to better use & understand the program,
      click the "Help" tab in the left column of the GUI. Info on
      "removing" "critical objects" is found in the "Performing
       your 1st scan" topic, which is listed under "Getting
       started".
      Nowadays, it is best to have a program "geared" to
      detecting & quarantining trojans, worms, etc and the
      FREE ver of "SUPERantispyware" from :
      www.superantispyware.com  is VERY GOOD.
     

[FreewheelinFrank]

I actually recommended a stand alone virus scanner because avast! was unstable:

On an unstable system, I would substitute Trend Micro Sysclean at step 10/14. This is a stand alone virus scanner which doesn't need to install.

avast! was unstable because it was installed on an infected system (I guess). If you want to uninstall AVG and install avast!, it should function correctly now.

You can also uninstall Trojan Hunter now.

You could try a registry scan with TuneUp Utilities (free working trial) after uninstalling AVG and before installing avast! again. This should clean up any registry problems causing errors or instability.

http://www.tune-up.com/

You need to download the latest version of Sun Java, as you are running an old version which can be exploited by malware.

Download the latest version here:

http://www.java.com/en/download/index.jsp

Then go to Control Panel>Add/Remove Programs and remove all older versions of Sun Java (This is important!).

[FreewheelinFrank]

TuneUp is also the program I was thinking of which will allow you to easily change the name Windows is registered to:

(Mine is registered to the shop I bought it from, something I never bothered to change.)



Customize & Analyze>TuneUp SystemControl>Administration>System>General

You will need to scroll down to see the administration window on the left.