[Ocean_View20]

Hello

When using the internet (AOL 8.0 or Internet Explorer) when I scroll down a page it is very slow and quite blurred.

I have run Hijack This! and this is the results -

Logfile of HijackThis v1.97.7
Scan saved at 9:22:39 AM, on 3/27/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
C:\WINDOWS\System32\gsicon.exe
C:\WINDOWS\System32\dslagent.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\enbiei.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AOL 8.0\aoltray.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\AOL 8.0\waol.exe
C:\Program Files\AOL 8.0\shellmon.exe
C:\Program Files\Microsoft Money\System\urlmap.exe
C:\Documents and Settings\Richard\Local Settings\Temp\Temporary Directory 1 for hijackthis[1].zip\HijackThis.exe

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MoneyStartUp10.0] "C:\Program Files\Microsoft Money\System\Activation.exe"
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [www.hidro.4t.com ] enbiei.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - Global Startup: AOL 8.0 Tray Icon.lnk = C:\Program Files\AOL 8.0\aoltray.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\KODAK\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Money Viewer (HKLM)
O17 - HKLM\System\CCS\Services\Tcpip\..\{1ABF9B0A-F280-49F8-A9D1-76EEFC9B5225}: NameServer = 152.163.0.26 205.188.64.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{914BF510-27DA-4003-8DF1-7C5123C642EC}: NameServer = 195.93.50.134

Thanks for any help you can offer!

 

[sprocket]

from this hijack log entry
O4 - HKLM\..\Run: [www.hidro.4t.com ] enbiei.exe it shows that you are infected by the Win32.Poza.F which is also known as: W32.Blaster.F.Worm (Symantec), W32/Lovsan.worm.gen (McAfee), Worm.Win32.Lovesan (Kaspersky)

look at this article from symantec for more information and click here for the removal instructions

 

[Ocean_View20]

Thanks Sprocket. I have used the link and downloaded The Symantec FixBlast.exe file and I have run it, and it searches through all the files and works fine up until it reaches H:\NortonProtect - it then freezes and a pop-up says 'Programme not responding'

I have tried re-starting my computer and I have follwed all of the advice given on the link (no other programmes running (and I have Diabled Norton) and also disabled system restore as it reccommended.

Any advice?? Thanks.

 

[Ocean_View20]

Okay, it has worked!! I ran the computer in safe mode and it was fine! The result was that the bug was not found - so I guess it must have been deleted . However I am still having the slow internet scrolling - what else could be causing it??! Thanks

 

[sprocket]

you're welcome. I'm glad it works....

as for whether if there are anymore nasties on your hijack this log that is causing the problem, why dun you repost another and let others who have a better knowledge look at the new log?

my knowledge with interpreting it is fairly limited at the moment....

all the best

 

[cybertech]

Run HJT again and put a check against these:

O17 - HKLM\System\CCS\Services\Tcpip\..\{1ABF9B0A-F280-49F8-A9D1-76EEFC9B5225}: NameServer = 152.163.0.26 205.188.64.153
O17 - HKLM\System\CCS\Services\Tcpip\..\{914BF510-27DA-4003-8DF1-7C5123C642EC}: NameServer = 195.93.50.134

Close all browser windows and applications before clicking "fix checked".

Reboot and post another HJT log.