XP Administrator account - Internet Browsers will not load pages

[Sgt.Sausage]

Hi, I have recently experienced a problem with my internet browsers when using my Administrator account only. Limited access accounts seem to be working. Also on the administrator account other programs which require the internet whilst running, work! For example: MSN Messenger and Games applications with online capabilities.

Now im sure at this point you are thinking it is a winsock problem or maybe even a firewall problem... you may be right but this is what I have tried so far to solve this conundrum:

Almost a week before the problem was at this stage I had the exact same problem, in that my Internet Browsers would not load pages. At this time all i had to do to correct the issue was use command prompt to run the command 'netsh winsock reset catalog'. After rebooting my computer, my internet browsers (Mozilla and IE) were loading pages again.
However the problem came about again later in the week and now with no success I have used the winsock command many times (I cannot stress that enough), but this time to no avail. Failing that I checked that the internet settings on both of my browsers were fine - they were. After that I checked that my firewall, which is part of a suite (Zone Alarm Security Suite) was not doing anything it should not be doing in regards to both browsers and everything was as it should be. Failing that I tried turning my firewall off to see if it was mysteriously blocking internet access to both browsers and it wasnt. Finally as a last resort I deleted the winsock files using WinSock XP Fix and another winsock related program to replace/repair the winsock files. Funnily enough this had no effect on the two browsers either.

The only other computer on my network works perfectly fine.
I am pretty sure I have not installed anything which may have caused this.
I am currently using a limited access account because the browsers are working on that type of account (I figured this out when nothing else would prevail... haha).

Bit more information-
Operating system: Windows XP Professional Service Pack 2
Firewall/Anti-Virus/Spyware Removal: ZoneAlarm Security Suite


Dear lord, what a lot of writing I hope it makes good sense. Thanks in advanced to anyone who has any input.

Regards Sausage

[unionflag]

I would be asking myself "what security software is installed on the problem PC that isn't installed on the PC that's okay?" And whatever it is, uninstall it.

[snowmonkey]

Hey "Sgt.Sausage".....I agree with "unionflag" but I'm sure there is more to it

Zone Alarm are not known to be very friendly with XP default security policy....Personally, I would first remove the Zone Alarm (you can always install it back after you figured out your problem).

Here are couple of things to look for.......go to Control panel and make SURE that your Administrator account is only member of "Administrators"....because I have seen that security software make add administrator as member of "Debug User Group" and that's when problem start to appear.

Second, Create a new test account with Administrative rights and log into it to make sure that problem is not system wide.

Third, uninstall your network card and all it's binding, reboot it for your PC to recognise the NIC and re-initiate all bindings (rather than running Winsock fix command).

Hope this helps.

Cheers

[Sgt.Sausage]

Thankyou both for your guidance. I will try to do this now. Ill post back here if I am experiencing issues.

[Sgt.Sausage]

Originally Posted by snowmonkey

Hey "Sgt.Sausage".....I agree with "unionflag" but I'm sure there is more to it

Zone Alarm are not known to be very friendly with XP default security policy....Personally, I would first remove the Zone Alarm (you can always install it back after you figured out your problem).

Here are couple of things to look for.......go to Control panel and make SURE that your Administrator account is only member of "Administrators"....because I have seen that security software make add administrator as member of "Debug User Group" and that's when problem start to appear.

Second, Create a new test account with Administrative rights and log into it to make sure that problem is not system wide.

Third, uninstall your network card and all it's binding, reboot it for your PC to recognise the NIC and re-initiate all bindings (rather than running Winsock fix command).

Hope this helps.

Cheers

I cannot believe it. I uninstalled ZoneAlarm and the internet browsers are working again haha. I never thought ZoneAlarm would act so eratically. Can anyone now reccomend me a freeware firewall? (apart from ZoneAlarm lol)

Thanks alot guys

[snowmonkey]

For time being use the Windows firewall.....I'll look around for a free one. Keep in mind, another free software could have a side effect like Zone Alarm

Cheers

[Sgt.Sausage]

Ok thanks a bundle. Im using AVG for anti virus now seen as the zone alarm was a suite. I cannot update from the AVG website though at the moment. Strange

[snowmonkey]

Again.....that could be another side effect of Zone Alarm.....best is to uninstall and reinstall AVG.


Cheers

[Sgt.Sausage]

Done that and the software still cannot update. Getting worried now . I opened firefox and it loaded a 'fake' windows scan website and it was trying to get me to download a file so i just terminated the process. Is it possibly a virus?

[snowmonkey]

Originally Posted by Sgt.Sausage

Done that and the software still cannot update. Getting worried now . I opened firefox and it loaded a 'fake' windows scan website and it was trying to get me to download a file so i just terminated the process. Is it possibly a virus?

That's a sign of having spyware on your PC and not having Anti Virus.....don't trust AVG to protect you 100%.

Best thing you could do is to buy a copy of NOD32 Internet Security:

http://www.eset.com/purchase/

That will clean your PC and you will be worry free (by the way, I'm not a sales rep for NOD32 either) ........I used to install McAfee on all computers then I changed it to Symantec and then Kaspersky and..... finally I tried NOD32 and I'm very happy with it .....it's not resource hungry like other antivirus and best of all "IT WORKS".

Cheers

[Sgt.Sausage]

Thanks for your input
Im really not sure that will help though... and also i cannot really afford to be buying software protection although as you said it would benefit my computer.

I have done a free scan using kaspersky online scanner, to my horror i found a trojan downloader: trojan-downloader.win32.delf.ppy

I have also been trying to access many websites which may result in a 'cure' but almost every website relating to the trojan or any websites offering spyware/malware removal are not working. It seems almost ironic.

I have also noticed a big decline in the performance of my computer, in other words it is processing slower than normally.

If anyone can help me in any way possible... bearing in mind I cannot use anti virus software really because it will not update and bearing in mind i cannot pay for any software. I would be very grateful.

Below is a log from 'Hijack this' hopefully somebody may be able to spot something from it:


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H 2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ãâ·Ñ¾«²ÊÊÓƵ³¬Á÷³©ÔÚÏß¹Û¿´ - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: ²¥°ÔµçÊÓ - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} - http://iptv.zgzcw.com/pCastCtl_1.0.0.89_20080808.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Kindest Regards
Sausage

Edit: I have just spotted http://itv.mop.com/ in the list and I have no idea what that is doing there

[Monty007]

Hi, go to my site http://www.doddpc.com download, install and update malwarebytes. Then run a full scan.
Also downlaod superanti-spyware and use this progarm as one of you defences.
AVG free is ok but not the only program that you should use thats why use superanti-spyware as well.

[Sgt.Sausage]

I am sorry but I did have Anti-Spyware and other products in ZoneAlarm Security suite. However i was told in this thread to remove my protection as it may be causing all of these problems - which I did.

I have tried installing the malware removal and the other product but they will not update. It seems to be a trend with the products I have. Most likely the infection on my computer is blocking these programs from updating.

Is there another way? Or is my computer officially doomed?

If worse comes to worse I can format my computer using my windows XP disc but I will need a piece of backup software which will backup what I want all to one medium (Unlike the windows XP one).

Appreciating all the help - thanks!

Kindest regards
Sausage

[Monty007]

Ok boot into safe mode with networking> go to the site I mentioned and run nod32 online scan.

If this wont work the only other way is to remove the hard drive place it in a caddy or another PC and run scans from there.

[Sgt.Sausage]

Alright I have tried what you said. The website for Nod32 online scanner is being blocked as i expected.

Few questions:
If i just disconnect my hard drive from this computer and placed it another will it lose the data on it? Are there any risks? Should i use the malware and spyware software from your site to make these scans?

Thanks for your help.
Sausage