MMPKA

A few weeks ago, I tried ZoneAlarm on my PC. It seemed to work fine at first, but I was forced to uninstall it when programs of mine began acting strangely. A few days later I noticed that File transfers I attempt to make on IRC, AIM, and Trillian never succeed. They sit on my screen as "trying to send file", but the people receiving say it doesn't go anywhere. it may be their network setup, as I can receive files on AIM just fine so far. Direct Connections for image transfers on AIM also work fine. Could anything be interfering with normal operations of my IM clients this way?

Volt-Schwibe

so to be clear, you uninstalled zonealarm, and the problems remain?


did the problems first arrive after adding zonealarm?

you may need to reconfigure some of your network settings to make things go back to normal.

__________________
<signature>

TSF is funded by our Admin's pocket, care to help?
New Members: Subscribe to your thread (Thread Tools) to receive an instant email notification when you get a reply.
Power Tip: Creating a single new thread in the correct section is the best way to assure your thread will receive a reply.
</signature>

MMPKA

The problems arrived a short day after Zone Alarm was installed. They were represented by a general sense of the programs I had being "a little out of whack" and haven't been a problem except for IM and IRC file transfers a week atfer Zone Alarm was uninstalled. While receiving a file on AIM appears to be fine from one out of the 200 people I have in my list, previously I could not send or receive because it would "hang" until the other end of the connection gave up with a timeout or "transfer failure" message. I am not a part of a LAN or wireless network, and my internet connection is done directly from the phone jack to my surge protector and from there to my 56k modem jack on the back of my PC box's case. Also, I run it with XP's own firewall disabled, and always have. As a note, my default connection does not appear in the network connections list since it is not one that can be "shared" between computers. It is invisible reguardless to wither hidden files are shown or not except for instances when I am monitoring the connection as it dials in and can catch the network connections entry before it vanishes again (via an option to display network status in the system tray).

Billy Brethren

How many other firewalls do you run ? How many AVs do you have running ?

This might be useful information.

MMPKA

ZA was the only one I tried. It worked well enough on an old computer I used to use, but on this one it just won't let my programs work right. Course it was in "learning mode", so that's probably half the problem. And I can clarify my post a little more as well. The file transfer "hangs" until either the other side says it timed out, or the user on that end gave up and clicked cancel (in which case mine would not say a word that it failed and sit there on a log). And my internet type is sadly an AOL-based system going by the name of "Wal-Mart Connect". Since it's an AOL type of internet, it's connection is not listed in the Network Connections screen except for when you have the connections screen up as it's connecting and can catch the flicker of the connection entry as it appears.

But back to the question.. Zero firewalls installed or running. My primary Antivirus is AntiVir Personal Edition. It's guard (similar to Norton's Auto-protect Shield) is always enabled and shows in my System Tray. I also have a copy of Norton Antivirus Professional, but I have configured it when I installed it to disable it's auto-protect shield. This way, the two scanners will not conflict with one another. They are both updated quite frequently as well and used about once every 9 days manually.

Billy Brethren

You have good detail in your report. But before spending too much time troubleshooting the "exact" nature of your problem, I would "rule out" other, more common causes of minor malfunctions, i.e. malware.

Download Highjack This and post a log here and let us take a look at it. If it is anything like everyone else's log, more than likely you are going to need to go to the Securities Forum and have it evaluated by an expert. It may be so "infested" that it is not worth the time to look at other possible causes until your HD is disinfected (if necessary).

Don't try to fix the log by yourself; you can really mess up your comp if you don't know what you are doing.

MMPKA

This one may be a little long. As I'm putting in the entire thing. I already have a decent idea of what I'm doing, since I used to troubleshoot a Windows 98 SE computer for about six years before getting into XP. And as for Malware, I make my primary Browser FireFox 1.0, and my Email Client ThunderBird 1.0 (with Hotmail Popper to access my hotmail account). Only times I ever use Internet Exploder is when I need to use Windows Update or to make sure my webcam works on Yahoo (It doesn't like FireFox for some reason or another, but some sites don't like FF at all). That doesn't make it impossible for spyware/malware to get in, but it greatly reduces the chances of the really bad malware coming in.

Log below.


Logfile of HijackThis v1.99.1
Scan saved at 4:24:22 PM, on 2/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\AIM\aim.exe
C:\Program Files\wmconnect\wwm.exe
C:\WINNT\System32\PackethSvc.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\slserv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\MUSHclient\mushclient.exe
C:\WINNT\slrundll.exe
C:\Program Files\Hotmail Popper\hotpop.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.net
O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINNT\system32\HDBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/p.../PCPitStop.CAB
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...e2128cb624e1ee
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3AC81BD-BB02-4841-9F0B-F9D2AE353A3E}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINNT\System32\PackethSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

CTSNKY

Well, not much to do there..........a few suggestions below.

========

I would advise uninstalling Norton AV if you now use AVG. They will compete for resources and cause other system issues.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...21 28cb624e1e


Let's use a program to scan for any trojans that may exist. Download TDS-3. Learn how to use it here. Make sure to update it after you installed it. You can get the manual updates here. When you launch the program, it will scan your memory for running processes. This will take less than 30 seconds. Next go to System Testing on the menu and choose Full System Scan. After that's finished, post the log file by selecting everything on the top pane (select from bottom to top). If any alarms are found, it will be listed in the bottom window. Please copy and paste that here also if it applies.

__________________


GO BIG BLUE!!

MMPKA

11:11:18 [Init] Trojan Defence Suite v3.2.0 (UNLICENSED)
11:11:18 [Init] Started 11-03-05 11:11:18 Eastern Standard Time (UTC: 5), Internet Time @716.18
11:11:18 [Init] Loading TDS-3 Systems ...
11:11:18 [Init] Token successfully adjusted.
11:11:18 [Init] • TDS Privileges : OK. Adjusted TDS-3 token privileges to maximum
11:11:18 [Init] • Plugins : OK. Loaded 13
11:11:18 [Init] • Exec Protection : Not Installed
11:11:18 [Init] WARNING: Your Radius.TD3 database needs to be updated!
11:11:18 [Init] Please download the latest from http://tds.diamondcs.com.au/radius.td3
11:11:18 [Init] Licensed users can use the Update facility from the TDS menu
11:11:18 [Init] Loading Radius Advanced Scanning Systems ... <R3 Engine, DCS Labs>
11:11:26 [Init] • Radius Advanced Specialist Extensions on standby for 13 trojan families
11:11:26 [Init] • Systems Initialised [49214 references - 24509 primaries/12517 traces/12188 variants/other]
11:11:26 [Init] Radius Systems loaded. <Databases updated 11-03-2005>
11:11:26 [Init] TDS-3 Ready. <Markmccloud@169.254.101.152, 127.0.0.1 - United States>
11:11:26 [Tip Of The Day] TDS-3 is made from all-natural ingredients - no artificial preservatives or flavours added!
11:11:26 [TDS] Good morning Markmccloud.
11:12:40 [Memory Scan] Memory scan started, please wait a moment ...
11:12:41 [Memory Scan] Memory scan complete.
11:12:41 [Mutex Memory Scan] Started...
11:12:43 [Mutex Memory Scan] Finished (no trojan mutexes found).
11:12:43 [Trace Scan] Started...
11:13:26 [Trace Scan] Finished.
11:13:27 [TDS-3] This is an EVALUATION demo of TDS-3. Please see the help file for help on registering.
11:13:27 [CRC32] Started - verifying 29 files ...
11:13:28 [CRC32] File doesn't exist: C:\autoexec.bat
11:13:30 [CRC32] Test finished.
11:13:49 [CRC32] Started - verifying 29 files ...
11:13:50 [CRC32] File doesn't exist: C:\autoexec.bat
11:13:53 [CRC32] Test finished.
11:14:56 [Memory Scan] Memory scan started, please wait a moment ...
11:14:56 [Memory Scan] Memory scan complete.
11:14:56 [Mutex Memory Scan] Started...
11:14:58 [Mutex Memory Scan] Finished (no trojan mutexes found).
11:14:58 [Trace Scan] Started...
11:15:40 [Trace Scan] Finished.
11:15:40 [ServiceScan] Scanning for services and drivers ...
11:15:47 [ServiceScan] Scanned 321 services and drivers.
11:15:47 [File Scan] Scanning in C:\ ...
12:35:05 [File Scan] Scanned 71422 files: 5 alarms in 4757.766 seconds (Avg 16.01 files/sec)
12:35:05 [File Scan] Scanning in D:\ ...
12:35:05 [File Scan] Scanned 0 files: 5 alarms in 0 seconds (Avg -1.#IND files/sec)
12:35:05 [Scan] Finished.

Scan Control Dumped @ 14:39:33 11-03-05
Suspicious Filename: Dual extensions
File: c:\downloads\audacity-win-1.2.1.exe

Suspicious Filename: Dual extensions
File: c:\downloads\shareaza_2.0.0.0.exe

Suspicious Filename: Dual extensions
File: c:\downloads\trillian-v0.74i.exe

Suspicious Filename: Dual extensions
File: c:\perl\bin\perl5.8.6.exe

Suspicious Filename: Dual extensions
File: c:\program files\shareaza\downloads\shareaza_2.0.0.0.exe

CTSNKY

Welp, sorry bud, nothing showing up.

Give this a try: Download WinsockFix and unzip it. Then double-click on it to run it.

Otherwise, I guess next thing I'd do is reinstall those apps you have issues using.

Moving you back to XP Forum.

__________________


GO BIG BLUE!!