DNS error, hijackthis.log attached, please help!!!

  • Thread starter Thread starter Cylix
  • Start date Start date
C

Cylix

All the computers in my office can view a website for intranet,
But one of it cannot view it normally in IE6,
Most of page show normally but just a few page sometime show "DNS
Error",
after click a number of time, the show will show properly again,
but when click it once again, it show "DNS Error" again. : (

I have tried to clear all the cache in the computer and the behavior
remains unchange.
Anyone can help?
Many Thanks
--------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:37:38, on 5/9/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\WINNT\system32\conime.exe
C:\WINNT\system32\internat.exe
C:\Program Files\eReader\eReader.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1028\nt\MAPISP32.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\TEMP\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1028,收音機[&R] -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
(no file)
O16 - DPF: {1773A6AE-93D3-4CE2-9965-AE29F1E59DB1} (Pcid Class) -
http://www.musicprint.com/shop/mall/fclient.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools
English Online) -
http://www.seagate.com/support/disc/asp/tools/en/bin/npseatools.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program
Files\NavNT\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) -
Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
 
Cylix said:
All the computers in my office can view a website for intranet,
But one of it cannot view it normally in IE6,
Most of page show normally but just a few page sometime show "DNS
Error",
after click a number of time, the show will show properly again,
but when click it once again, it show "DNS Error" again. : (

I have tried to clear all the cache in the computer and the behavior
remains unchange.
Anyone can help?
Many Thanks
--------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:37:38, on 5/9/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\WINNT\system32\conime.exe
C:\WINNT\system32\internat.exe
C:\Program Files\eReader\eReader.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1028\nt\MAPISP32.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\TEMP\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1028,收音機[&R] -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
(no file)
O16 - DPF: {1773A6AE-93D3-4CE2-9965-AE29F1E59DB1} (Pcid Class) -
http://www.musicprint.com/shop/mall/fclient.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools
English Online) -
http://www.seagate.com/support/disc/asp/tools/en/bin/npseatools.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program
Files\NavNT\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) -
Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
Click to expand...

Hi,
You need to uninstall the Google toolbar from your Browser and disable all
non-MS Plug-Ins to that follow these steps:
= Right Click on IE icon on your Desktop and select Properties, then click
on Programs Tab and click on Manage Add-Ons and Disable all there ( you could
leave Norton for secuirty).
Click Ok to confirm your Changes and click on Reset Web Settings while you
are there then close the IE Window.
= Open a RUN Command and type:
ipconfig /flushdns Press OK.
Reboot and see if the problem solved.
I have concern about Internat.exe some say it for Windows for Multi-langual
and some say it is Trojan-Laydra. can you scan on line from here:
http://www.trendmicro.com
http://www.pandasoftware.com

= the Clsid {c95fe080-8f5d-11d2-a20b-00aa003c157a} for Related.html is Alexa
by MS you can delete this for both Clsid and Related.html from the Registry &
Windows Explorer.

Download Lavasoft to delete Alexa and scan for other Malware or Data miner
Cookies on your system.
http://www.lavasoftusa.com

HTH.
Please let us know.
Regards,
nass
 
All of computers have installed the Google toolbar,
I don't think it is the problem ...
Cylix said:
All the computers in my office can view a website for intranet,
But one of it cannot view it normally in IE6,
Most of page show normally but just a few page sometime show "DNS
Error",
after click a number of time, the show will show properly again,
but when click it once again, it show "DNS Error" again. : (

I have tried to clear all the cache in the computer and the behavior
remains unchange.
Anyone can help?
Many Thanks
--------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:37:38, on 5/9/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\WINNT\system32\conime.exe
C:\WINNT\system32\internat.exe
C:\Program Files\eReader\eReader.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1028\nt\MAPISP32.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\TEMP\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1028,收音機[&R] -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
(no file)
O16 - DPF: {1773A6AE-93D3-4CE2-9965-AE29F1E59DB1} (Pcid Class) -
http://www.musicprint.com/shop/mall/fclient.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools
English Online) -
http://www.seagate.com/support/disc/asp/tools/en/bin/npseatools.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program
Files\NavNT\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) -
Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
Click to expand...

Hi,
You need to uninstall the Google toolbar from your Browser and disable all
non-MS Plug-Ins to that follow these steps:
= Right Click on IE icon on your Desktop and select Properties, then click
on Programs Tab and click on Manage Add-Ons and Disable all there ( you could
leave Norton for secuirty).
Click Ok to confirm your Changes and click on Reset Web Settings while you
are there then close the IE Window.
= Open a RUN Command and type:
ipconfig /flushdns Press OK.
Reboot and see if the problem solved.
I have concern about Internat.exe some say it for Windows for Multi-langual
and some say it is Trojan-Laydra. can you scan on line from here:
http://www.trendmicro.com
http://www.pandasoftware.com

= the Clsid {c95fe080-8f5d-11d2-a20b-00aa003c157a} for Related.html is Alexa
by MS you can delete this for both Clsid and Related.html from the Registry &
Windows Explorer.

Download Lavasoft to delete Alexa and scan for other Malware or Data miner
Cookies on your system.
http://www.lavasoftusa.com

HTH.
Please let us know.
Regards,
nass
Click to expand...
 
Besides, I have already check the "Internat.exe", and it is not virus.
nass said:
Cylix said:
All the computers in my office can view a website for intranet,
But one of it cannot view it normally in IE6,
Most of page show normally but just a few page sometime show "DNS
Error",
after click a number of time, the show will show properly again,
but when click it once again, it show "DNS Error" again. : (

I have tried to clear all the cache in the computer and the behavior
remains unchange.
Anyone can help?
Many Thanks
--------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:37:38, on 5/9/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\Explorer.EXE
C:\WINNT\system32\conime.exe
C:\WINNT\system32\internat.exe
C:\Program Files\eReader\eReader.exe
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
C:\Program Files\Common Files\System\MAPI\1028\nt\MAPISP32.EXE
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\TEMP\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O3 - Toolbar: @msdxmLC.dll,-1@1028,收音機[&R] -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -
(no file)
O16 - DPF: {1773A6AE-93D3-4CE2-9965-AE29F1E59DB1} (Pcid Class) -
http://www.musicprint.com/shop/mall/fclient.cab
O16 - DPF: {E36C5562-C4E0-4220-BCB2-1C671E3A5916} (Seagate SeaTools
English Online) -
http://www.seagate.com/support/disc/asp/tools/en/bin/npseatools.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\Program
Files\NavNT\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) -
Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
Click to expand...

Hi,
You need to uninstall the Google toolbar from your Browser and disable all
non-MS Plug-Ins to that follow these steps:
= Right Click on IE icon on your Desktop and select Properties, then click
on Programs Tab and click on Manage Add-Ons and Disable all there ( you could
leave Norton for secuirty).
Click Ok to confirm your Changes and click on Reset Web Settings while you
are there then close the IE Window.
= Open a RUN Command and type:
ipconfig /flushdns Press OK.
Reboot and see if the problem solved.
I have concern about Internat.exe some say it for Windows for Multi-langual
and some say it is Trojan-Laydra. can you scan on line from here:
http://www.trendmicro.com
http://www.pandasoftware.com

= the Clsid {c95fe080-8f5d-11d2-a20b-00aa003c157a} for Related.html is Alexa
by MS you can delete this for both Clsid and Related.html from the Registry &
Windows Explorer.

Download Lavasoft to delete Alexa and scan for other Malware or Data miner
Cookies on your system.
http://www.lavasoftusa.com

HTH.
Please let us know.
Regards,
nass
Click to expand...
 
All the computers in my office can view a website for intranet,
But one of it cannot view it normally in IE6,
Most of page show normally but just a few page sometime show "DNS
Error",
after click a number of time, the show will show properly again,
but when click it once again, it show "DNS Error" again. : (

I have tried to clear all the cache in the computer and the behavior
remains unchange.
Anyone can help?
Many Thanks
--------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1

SNIP

**Post your HijackThis log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

--
Frank Saunders, MS-MVP OE/WM
Reply in newsgroup
http://www.fjsmjs.com
"They who would give up an essential liberty for temporary security, deserve
neither liberty or security"
 
Back
Top