1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

[Resolved] Slow internet explorer

Discussion in 'Web & Email' started by theriffs1, Feb 16, 2003.

Thread Status:
Not open for further replies.
Advertisement
  1. theriffs1

    theriffs1 Thread Starter

    Joined:
    Feb 16, 2003
    Messages:
    75
    The last 2 weeks my internet has become very slow. I have DSL but trying to open up explorer takes 20 seconds just to get to my home page. Moving from page to page has slowed down tremendously as well.
     
  2. Del

    Del

    Joined:
    Aug 31, 2001
    Messages:
    3,452
    Do you delete your temporary Internet Files?
    If not, in Internet Explorer, click on Tools, Internet Options, and click the Delete Files button, put a check in the box for offline content and click ok. then close IE and reopen and see if it works better??
     
  3. theriffs1

    theriffs1 Thread Starter

    Joined:
    Feb 16, 2003
    Messages:
    75
    I deleted the as asked. No change in speed. Any other suggestions?
     
  4. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    We'd like to have a closer look at what's happening on your system.

    Please do this:

    Go to http://www.spywareinfo.com/downloads.php#det , and download 'Hijack This!'.
    Unzip, doubleclick HijackThis.exe, and hit "Scan".

    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log somewhere, and please show us its contents.
     
  5. theriffs1

    theriffs1 Thread Starter

    Joined:
    Feb 16, 2003
    Messages:
    75
    Here you go..

    Logfile of HijackThis v1.91.2
    Scan saved at 2:09:00 PM, on 2/16/2003
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.google.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.dellnet.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.dellnet.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=
    O1 - Hosts: 216.177.73.139 auto.search.msn.com
    O1 - Hosts: 216.177.73.139 search.netscape.com
    O1 - Hosts: 216.177.73.139 ieautosearch
    O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\Toolbar\cnbabe.dll
    O2 - BHO: (no name) - {000004CC-E4FF-4F2C-BC30-DBEF0B983BC9} - C:\WINDOWS\ipinsigt.dll
    O2 - BHO: (no name) - {00000EF1-34E3-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\F1.dll
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4CE} - C:\Program Files\SideStep\SbCIe0261.dll
    O2 - BHO: (no name) - {0A68C5A2-64AE-4415-88A2-6542304A4745} - C:\PROGRA~1\COMMON~1\MSIETS\msiets.dll
    O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet4_50.dll
    O2 - BHO: (no name) - {6085FB5B-C281-4B9C-8E5D-D2792EA30D2F} - C:\WINDOWS\System32\NetPal.dll
    O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
    O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Program Files\MediaLoads Enhanced\ME1.DLL
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar_en_1.1.68-big.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: (no name) - {D6E66235-7AA6-44ED-A06C-6F2033B1D993} - C:\WINDOWS\System32\msiein.dll
    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
    O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [PromulGate] "C:\Program Files\DelFin\PromulGate\PgMonitr.exe"
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup
    O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\Toolbar\winnet.exe
    O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
    O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
    O4 - HKCU\..\Run: [MoneyAgent] ""C:\Program Files\Microsoft Money\System\Money Express.exe""
    O4 - HKCU\..\Run: [FileFreedom_Plugin] C:\Program Files\FileFreedom\wtm.exe
    O4 - HKCU\..\Run: [media_manager] C:\Program Files\ebkrdr\mediaman.exe
    O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
    O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: Ebates - file://c:\Program Files\topMoxie\TEMP\ebates_script.htm
    O8 - Extra context menu item: Power Search - res://C:\PROGRA~1\COMMON~1\MSIETS\msiets.dll//iemenu
    O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page - res://C:\WINDOWS\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: SideStep (HKLM)
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: MoneySide (HKLM)
    O9 - Extra button: Ebates (HKCU)
    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName
    O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht0_x.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/23cc4ed3393b2f144106/netzip/RdxIE6.cab
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37662.7490046296
    O16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - file://D:\Bin\html\files\MotivePreQual.cab
    O18 - Protocol: cn - {9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40} - C:\PROGRA~1\COMMON~2\Toolbar\cnbabe.dll
    O18 - Protocol: relatedlinks - {5AB65DD4-01FB-44D5-9537-3767AB80F790} - C:\PROGRA~1\COMMON~1\MSIETS\msielink.dll
     
  6. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    You have a mind-boggling amount of spyware installed. I'm not surprised your browsing performance has decreased...:rolleyes:

    Do this:

    First go to Control Panel > Add/Remove Programs, and uninstall New.Net (domains)

    Reboot when you're done

    Now run Hijack This, and check ALL of the items in bold. Doublecheck so as to be sure not to miss a single one.
    Next, shut down all Internet Explorer Windows, and have HT fix all checked.

    NOTE: after uninstalling New.Net, a few New(dot)Net entries may not be there any more.

    Now go to Control Panel > Internet (Options) > Temporary Internet Files, and press "delete files".
    Next, go to the Programs tab, and press 'Reset Web Settings'
    In the dialog box, make sure 'Also reset my home page' check box is ticked.

    REBOOT when you're done.


    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch=
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=
    O1 - Hosts: 216.177.73.139 auto.search.msn.com
    O1 - Hosts: 216.177.73.139 search.netscape.com
    O1 - Hosts: 216.177.73.139 ieautosearch

    O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\Toolbar\cnbabe.dll
    O2 - BHO: (no name) - {000004CC-E4FF-4F2C-BC30-DBEF0B983BC9} - C:\WINDOWS\ipinsigt.dll
    O2 - BHO: (no name) - {00000EF1-34E3-4633-87C6-1AA7A44296DA} - C:\WINDOWS\System32\F1.dll
    O2 - BHO: (no name) - {08351226-6472-43BD-8A40-D9221FF1C4CE} - C:\Program Files\SideStep\SbCIe0261.dll
    O2 - BHO: (no name) - {0A68C5A2-64AE-4415-88A2-6542304A4745} - C:\PROGRA~1\COMMON~1\MSIETS\msiets.dll
    O2 - BHO: (no name) - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet4_50.dll
    O2 - BHO: (no name) - {6085FB5B-C281-4B9C-8E5D-D2792EA30D2F} - C:\WINDOWS\System32\NetPal.dll
    O2 - BHO: Natural Language Navigation - {60E78CAC-E9A7-4302-B9EE-8582EDE22FBF} - C:\WINDOWS\System\BHO001.DLL
    O2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Program Files\MediaLoads Enhanced\ME1.DLL
    O2 - BHO: (no name) - {D6E66235-7AA6-44ED-A06C-6F2033B1D993} - C:\WINDOWS\System32\msiein.dll

    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [PromulGate] "C:\Program Files\DelFin\PromulGate\PgMonitr.exe"
    O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup
    O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\Toolbar\winnet.exe
    O4 - HKLM\..\Run: [WinStart001.EXE] C:\WINDOWS\System\WinStart001.EXE -b
    O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
    O4 - HKCU\..\Run: [FileFreedom_Plugin] C:\Program Files\FileFreedom\wtm.exe
    O4 - HKCU\..\Run: [media_manager] C:\Program Files\ebkrdr\mediaman.exe

    O8 - Extra context menu item: Ebates - file://c:\Program Files\topMoxie\TEMP\ebates_script.htm
    O8 - Extra context menu item: Power Search - res://C:\PROGRA~1\COMMON~1\MSIETS\msiets.dll//iemenu

    O9 - Extra button: SideStep (HKLM)

    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName

    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/23cc4ed3393b2f...tzip/RdxIE6.cab

    O18 - Protocol: cn - {9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40} - C:\PROGRA~1\COMMON~2\Toolbar\cnbabe.dll
    O18 - Protocol: relatedlinks - {5AB65DD4-01FB-44D5-9537-3767AB80F790} - C:\PROGRA~1\COMMON~1\MSIETS\msielink.dll


    After rebooting, download Spybot - Search & Destroy

    After installing, press Online, and search for, put a check mark at, and install all updates.

    Next, go to Settings > File Sets, and uncheck 'System Internals' and 'Tracks' .
    These aren't needed for our present purpose, and you can always experiment with them later on.

    Finally, after closing down Internet Explorer, hit 'Check for Problems', and have SpyBot remove all it finds.

    Good luck,
     
  7. theriffs1

    theriffs1 Thread Starter

    Joined:
    Feb 16, 2003
    Messages:
    75
    Tony - I checked all the bolded and deleted. However, now i can not connect to the internet (I am at work now).

    I went to run and typed in command

    In the command menu I typed ipconfig

    my ip address is 0.0.0.0

    I typed ipconfig/renew and received this error message: "An error occured while renewing interface local area connection: The system cannot find the file specified"

    Also, when rebooting i get an immediate error message reading "Norton Antivirus was unable to start email protection".

    Any thoughts?
     
  8. TonyKlein

    TonyKlein Malware Specialist

    Joined:
    Aug 26, 2001
    Messages:
    10,392
    That's strange. Usually Hijack This does a great job of repairing a hijacked LSP stack.

    First try this:

    Launch Hijack This, press Config > Backups.

    Check the following items, and press "Restore":

    O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\Toolbar\cnbabe.dll

    O10 - Hijacked Internet access by New.Net
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName
    O10 - Hijacked Internet access by CommonName

    O18 - Protocol: cn - {9346A6BB-1ED0-4174-AFB4-13CD4EC0AA40} - C:\PROGRA~1\COMMON~2\Toolbar\cnbabe.dll


    Reboot your computer and test your Internet connectivity.
     
  9. theriffs1

    theriffs1 Thread Starter

    Joined:
    Feb 16, 2003
    Messages:
    75
    Tony - I could not find the saved data from yesterdays fix, so I could not pull them up and restore the bolded you asked me to restore.

    I restored my system to what is was like yesterday morning before I 1st tried to fix through hijack.

    I will start all over if you think that is best but wanted to see if there was another way to go about doing it with out the possibility of losing my internet again.

    What do you think?

    Brett
     
  10. Mosaic1

    Mosaic1

    Joined:
    Aug 17, 2001
    Messages:
    7,486
    Tony is most likely sleeping now. So I'll make a suggestion.

    Before you do anything, first make a restore point. Download and install Spybot Search and Destroy . Run it and have it remove your Spyware.

    Here's a link to a page with instructions. The Download link is at the bottom of the page:

    http://tomcoyote.org/SPYBOT/
     
  11. Mosaic1

    Mosaic1

    Joined:
    Aug 17, 2001
    Messages:
    7,486
    I have something to add. Before you run Spybot, go to Control Panel>Add Remove programs. Find the entry for Newdot and uninstall using the uninstaller there. Reboot.

    Use Spybot.
     
  12. theriffs1

    theriffs1 Thread Starter

    Joined:
    Feb 16, 2003
    Messages:
    75
    Mosaic - Thanks for the help. I looked for newdot and did not see it. There was a new.net that I thought I uninstalled before. Is that the file you are talking about?

    Before I got your second request I ran spybot and had 200 checked items. Should I fix them all after the first step is done?

    Brett
     
  13. Mosaic1

    Mosaic1

    Joined:
    Aug 17, 2001
    Messages:
    7,486
    Yes. new.net Use their uninstaller.

    So long as you have a backup you can remove everything Spybot finds. The items in red are Spyware. The others are most recently used lists in the registry, cookies, temporary internet files etc. Have a close look and make your choices on those.

    Make that restore point as added insurance as well.
     
  14. theriffs1

    theriffs1 Thread Starter

    Joined:
    Feb 16, 2003
    Messages:
    75
    Mosaic - I had to run spybot 4 different times, rebooting in between each, but it got rid of all the red items.

    YEA, my internet is back to normal. Moving very quick. Thank you. I have spent 4 hours on the phone with DELL support trying to figure this out. They never mentioned spyware.

    Thank you. Can you answer a few questions?

    How often should I run spybot?

    Did spybot get rid of this spyware or did it just hide it? If not, how can I delete it forever?

    Do you have any other suggestions on protecting my computer from future problems.

    Brett
     
  15. Del

    Del

    Joined:
    Aug 31, 2001
    Messages:
    3,452
    Glad you're fixed up.
    I run spybot a couple times a week, don't take that long.
    Spybot got rid of the items, it didn't hide anything, removed it from your computer and the registery.
    As far as watching your computer, just be careful of what you download and keep running spybot.
    A good antivirus software kept up to date also helps.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/119063

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice