Will Norton WinDoctor reverse my fixes?

Verlyn · 11-13-2004, 01:55 PM

After I rid my system of spyware, will running Norton SystemWorks utilities recover the deleted programs?

Verlyn

CTSNKY · 11-13-2004, 02:10 PM

Ummmm, no. Are you missing something or just worried about re-infection?

Verlyn · 11-13-2004, 05:59 PM

Yes. I no longer have internet access. The network connection says I'm connected, but nothing gets through. I could see on IE status line that several things were being processed, but it was too fast except one was something like "detecting proxy settings."

I called Road Runner tech support. They were able to detect my modem. Re-booted and started IE. This time I was able to read something about system32.dll on the status line.

I deleted that file, and ran all the detection software again. Ad-Aware found about 70 items which I deleted.

Here's HJT log:
Logfile of HijackThis v1.98.2
Scan saved at 8:51:58 PM, on 11/13/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/S.../bin/cabsa.cab

-- Verlyn

CTSNKY · 11-13-2004, 06:59 PM

Download WinsockFix and unzip it. Then double-click on it to run it.

Verlyn · 11-13-2004, 07:36 PM

I ran it but still can't access the internet. -- Verlyn

**Pancake** · 11-13-2004, 07:46 PM

Internet Explorer is not showing in your start file....im sure it should.Try running a fix for it.
http://www.theeldergeek.com/repair_r...e_and_oe_6.htm

Verlyn · 11-13-2004, 08:13 PM

I loaded Mozilla Firefox and made it my default browser. Would that explain it?
Verlyn

CTSNKY · 11-13-2004, 08:14 PM

Hmmmmmm....maybe. You could try reinstalling IE6, if you so desire, I suppose. Firefox is a fine product as well. Your call.

Verlyn · 11-13-2004, 08:27 PM

I'm still where I started. No internet access. Any suggestions? -- Verlyn

CTSNKY · 11-13-2004, 08:30 PM

So, if no access also with Forefox, then next step is to try these tasks:

1) With your XP CD in the drive, click on Start/Run, type sfc /scannow and click OK (make sure there's a space before the slash).

2) If that doesn't fix it, next thing would be to try an XP Repair installation:

http://support.microsoft.com/default...b;en-us;315341

11-13-2004, 01:55 PM	#1 (permalink)
Verlyn Registered User Join Date: Nov 2004 Location: NC Posts: 13 OS: WinXP	Will Norton WinDoctor reverse my fixes? After I rid my system of spyware, will running Norton SystemWorks utilities recover the deleted programs? Verlyn

11-13-2004, 02:10 PM	#2 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Location: Independence, KY Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	Ummmm, no. Are you missing something or just worried about re-infection? __________________ GO BIG BLUE!!

11-13-2004, 05:59 PM	#3 (permalink)
Verlyn Registered User Join Date: Nov 2004 Location: NC Posts: 13 OS: WinXP	Yes Yes. I no longer have internet access. The network connection says I'm connected, but nothing gets through. I could see on IE status line that several things were being processed, but it was too fast except one was something like "detecting proxy settings." I called Road Runner tech support. They were able to detect my modem. Re-booted and started IE. This time I was able to read something about system32.dll on the status line. I deleted that file, and ran all the detection software again. Ad-Aware found about 70 items which I deleted. Here's HJT log: Logfile of HijackThis v1.98.2 Scan saved at 8:51:58 PM, on 11/13/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\PROGRA~1\NORTON~2\NORTON~1\NPROTECT.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\PROGRA~1\NORTON~2\NORTON~1\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HijackThis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/S.../bin/cabsa.cab -- Verlyn

11-13-2004, 06:59 PM	#4 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Location: Independence, KY Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	Download WinsockFix and unzip it. Then double-click on it to run it. __________________ GO BIG BLUE!!

11-13-2004, 07:36 PM	#5 (permalink)
Verlyn Registered User Join Date: Nov 2004 Location: NC Posts: 13 OS: WinXP	nope I ran it but still can't access the internet. -- Verlyn

11-13-2004, 07:46 PM	#6 (permalink)
Pancake Security Team (ret.) Join Date: Nov 2003 Location: Victoria.Australia Posts: 7,405 OS: XP Pro SP3	Internet Explorer is not showing in your start file....im sure it should.Try running a fix for it. http://www.theeldergeek.com/repair_r...e_and_oe_6.htm

11-13-2004, 08:13 PM	#7 (permalink)
Verlyn Registered User Join Date: Nov 2004 Location: NC Posts: 13 OS: WinXP	Firefox I loaded Mozilla Firefox and made it my default browser. Would that explain it? Verlyn

11-13-2004, 08:14 PM	#8 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Location: Independence, KY Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	Hmmmmmm....maybe. You could try reinstalling IE6, if you so desire, I suppose. Firefox is a fine product as well. Your call. __________________ GO BIG BLUE!!

11-13-2004, 08:27 PM	#9 (permalink)
Verlyn Registered User Join Date: Nov 2004 Location: NC Posts: 13 OS: WinXP	I'm still where I started. No internet access. Any suggestions? -- Verlyn

11-13-2004, 08:30 PM	#10 (permalink)
CTSNKY Knower of all that is MS Join Date: Aug 2004 Location: Independence, KY Posts: 10,755 OS: (multiple machines) 95, 98, 2K & XP Home & Pro	So, if no access also with Forefox, then next step is to try these tasks: 1) With your XP CD in the drive, click on Start/Run, type sfc /scannow and click OK (make sure there's a space before the slash). 2) If that doesn't fix it, next thing would be to try an XP Repair installation: http://support.microsoft.com/default...b;en-us;315341 __________________ GO BIG BLUE!!