Hourglass flashes only in personal email

(Omega) · 05-18-2005, 08:25 PM

I have many email addresses and one primary email address. When I sign into my primary email address the hourglass Icon appears and flashes on and off rapidly like when your computer is about to shutdown, but it does shutdown just continues to flash on and off rapidly. I have checked all my other email accounts and this doesn't happen on them, only on my primary email account. When I use Windows System optimizer to clean the cache and other temporary junk stored and then sign in again to my primary email, the problem is gone, then it happens again after a while! Whats going on?

Logfile of HijackThis v1.99.1
Scan saved at 7:17:54 PM, on 5/18/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ezSP_Px.exe
C:\WINDOWS\LTSMMSG.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\WINDOWS\System32\GEARSec.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Danny Oh\Local Settings\Temporary Internet Files\Content.IE5\PVV7XD4E\HijackThis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: CheckHO Class - {576EB0AD-6980-11D5-A9CD-0001032FEE17} - C:\Program Files\Yahoo!\Common\ycheckh.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1116313804953
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1349A69-BD51-447C-8F0E-8205FFCCD776}: NameServer = 206.13.28.12 206.13.29.12
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

greyknight17 · 05-19-2005, 09:41 AM

OK, how are you accessing your emails (web based or email client)?

I don't see anything wrong in the log here. Did you run an antivirus scan?

You said it does (do you mean doesn't) shutdown? Are those other accounts also for the same email provider as the primary? Does the primary have a lot of emails stored (assuming it's a email client)?

This might be more of a software issue than spyware. So if your antivirus program doesn't find anything, post this in software or internet forum instead. Talking about antivirus programs. You don't seem to have an antivirus program installed. Please download a free one at Grisoft http://free.grisoft.com/freeweb.php. Install it and make sure to check for updates.

(Omega) · 05-19-2005, 01:22 PM

Your right, it was a firewall that was blocking certain cookies and web bugs, so I disabled it and rebooted and the problem was gone. Thanks!

05-18-2005, 08:25 PM	#1 (permalink)
(Omega) Registered User Join Date: Mar 2005 Posts: 92 OS: Windows XP Professional	Hourglass flashes only in personal email I have many email addresses and one primary email address. When I sign into my primary email address the hourglass Icon appears and flashes on and off rapidly like when your computer is about to shutdown, but it does shutdown just continues to flash on and off rapidly. I have checked all my other email accounts and this doesn't happen on them, only on my primary email account. When I use Windows System optimizer to clean the cache and other temporary junk stored and then sign in again to my primary email, the problem is gone, then it happens again after a while! Whats going on? Logfile of HijackThis v1.99.1 Scan saved at 7:17:54 PM, on 5/18/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ezSP_Px.exe C:\WINDOWS\LTSMMSG.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\System32\ZoneLabs\isafe.exe C:\WINDOWS\System32\GEARSec.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Danny Oh\Local Settings\Temporary Internet Files\Content.IE5\PVV7XD4E\HijackThis[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: CheckHO Class - {576EB0AD-6980-11D5-A9CD-0001032FEE17} - C:\Program Files\Yahoo!\Common\ycheckh.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1116313804953 O17 - HKLM\System\CCS\Services\Tcpip\..\{C1349A69-BD51-447C-8F0E-8205FFCCD776}: NameServer = 206.13.28.12 206.13.29.12 O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe Last edited by (Omega); 05-18-2005 at 08:27 PM.

05-19-2005, 09:41 AM	#2 (permalink)
greyknight17 Analyst, Security Team Join Date: Jul 2004 Location: New York Posts: 14,331 OS: Windows 98 & Windows XP Home/Pro My System	OK, how are you accessing your emails (web based or email client)? I don't see anything wrong in the log here. Did you run an antivirus scan? You said it does (do you mean doesn't) shutdown? Are those other accounts also for the same email provider as the primary? Does the primary have a lot of emails stored (assuming it's a email client)? This might be more of a software issue than spyware. So if your antivirus program doesn't find anything, post this in software or internet forum instead. Talking about antivirus programs. You don't seem to have an antivirus program installed. Please download a free one at Grisoft http://free.grisoft.com/freeweb.php. Install it and make sure to check for updates. __________________ Please do NOT PM me. Post whatever questions you may have in the forum and we will take a look at it when we get to it. If you have waited for more than 3 days, you may then and ONLY then PM me for assistance. I will take a look at it. Adaware :: CWShredder :: HijackThis :: Panda ActiveScan :: Spybot S&D Anti-Spyware Tutorial :: Spyware Prevention Tools

05-19-2005, 01:22 PM	#3 (permalink)
(Omega) Registered User Join Date: Mar 2005 Posts: 92 OS: Windows XP Professional	Your right, it was a firewall that was blocking certain cookies and web bugs, so I disabled it and rebooted and the problem was gone. Thanks!