What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Under Attack

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Dear alsocom, it seems that my norton does not want to scan my E-mail even though its on. Norton pops up saying that it cannot scan each and every E-mail that comes in, individually. Do I need to uninstall and reinstall norton antivirus? Also, anytime that I go into safe mode norton antivirus is turned off and disabled. I did copy my hjt and posted it below. I had this problem before and after I downloaded the recommended software you suggested. I also checked out one of the restricted web sites and placed it in my browser to see what kind of processes take place. Works good! Thanks, again. Alpharay.

Logfile of HijackThis v1.98.2
Scan saved at 12:26:18 PM, on 11/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton Personal Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/news?ned=us
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=8116
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Norton Personal Firewall - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpdtlk02.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton Personal Firewall - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HP Software Update] "c:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [EPSON Stylus CX5400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2G1.EXE /P19 "EPSON Stylus CX5400" /O6 "USB001" /M "Stylus CX5400"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\Hewlett-Packard\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Microsoft Office Shortcut Bar (2).lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab27513.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://antu.popcap.com/games/popcaploader_v5.cab
Post #17
Sorry to hear that Norton Internet Security 2005 is still not working properly.

I have the 2004 version so the instructions may be slightly different.
Right click on the NIS icon (looks like a globe) in the task bar and click on Norton Internet Security. At the top of the menu, click on Options tab and select Norton Antivirus from the drop-down menu. On the right side of the new menu under Internet, click on E-mail. Make sure that the following are all checked:

Scan incoming E-mail (recommended)
Scan outgoing E-mail (recommended)
Automatically repair the infected file (recommended)
Enable Worm Blocking (recommended)
Alert when scanning E-mail attachments


In Safe Mode, only needed programs and services are automatically started. You will have to go to Start > All Programs > Norton Internet Security > Norton Anti-Virus > Norton Anti-Virus and manually run a scan.


Can you type exactly what the message is from NIS when it states that it can not scan E-mails individually?
Post #18
I have notrton internet security 2005 and norton antivirus 2003. What happens most of the time when downloading mail from the server, I get the popup that says that it is downloading mail. It remains like that until I click hide or clik x. Sometimes norton will come on the task bar which means that there is a pop up behind the previously stated window. Sometimes it won't show up on the task bar but still have that pop up behind the downloaded mail pop up. Sometimes my alert Email popup comes on and sometimes it doesn't. In order to get my norton back to its original settings I have to do a restart. The exact wording of norton antivirus is, "Norton antivirus was unable to scan your email message for infections." All the recommended fields are somehow turned off and not functional until I restart the computer. It has let emails come through without giving me the alert email scanner. Did a full system scan with no infections found. Alpharay.
Post #19

I have norton internet security 2005 and norton antivirus 2003.


Just trying to understand what you have installed.

Norton Internet Security 2005 should come with both an antivirus program and firewall among other items. Does this mean that you are running both Norton Antivirus 2005 and 2003. When installing NIS 2005 it should have un-installed Norton Antivirus2003.

If both antivirus are indeed on your computer than I would recommend uninstalling both NIS 2005 and Norton Antivirus 2003 by following the instructions supplied by Symantec at this link.

Reinstall only NIS 2005.
Post #20
Correction, I have norton anti virus 2003 that came preinstalled with the operating system and norton firewall 2005 that I bought out of the retail stores. Just now before I came to this site I received 4 emails which norton didn't give me the alert that it was scanning. They all came right in. I have all recommended boxes checked in my anti virus. alpharay.
Post #21
I have cleaned out my temp folder in Doc. and Settings/owner/local settings/temp. I did this before my last post. It was suggested by symantic before uninstalling norton antivirus. I had one file that would not delete because it said it was in use by a program or another user. perflib_perfdata_ad8. I went into safe mode and deleted all the files within the temp files of the Administrator, all users, and owner. I went back into normal mode and the file had changed to something like pf8, which I then was able to delete. I was helping a friend of mine who has windows xp and her norton was giving her an error saying that she needed to uninstall and then reinstall her norton anti virus. (I found out later that it was service pack 2 that caused the problem I believe.) When I uninstalled it for her I could not reinstall it from symantic. I wrote symantic a couple of times and never have I gotten anykind of response from them. She told me that I was never to touch her computer again. A little trouble in the beginning and she throws in the towel. When my service contract is up with symantic I'm looking elsewhere. Since norton antivirus 2003 came with my computer how do I reload it. Does it reload from the suggested site that you gave me? I found that site after my friend gave up on me. I left the paper copy with her to do her own computer studies. Since I cleaned out those folders, I haven't had norton pop up saying it could not scan my emails. On the other hand it is not alerting me that it is scanning my emails either. I also have not had any w32beagle emails come in for three or four days now. Just the regular viagra, cialis and rolex emails. Would you like another HJT log. Alpharay. ps. I did not uninstall my norton antivirus.
Post #22
It appears that these type of emails disable norton scanning; your application is preapproved, cialis and rolex. I've had other emails come in but the scanning alert doesn't pop up. Also when I go to norton it says email scanning is on. Alpharay.
Post #23
Sorry about the delay in getting back to you. I was checking with an expert to see what they suggested.

It was suggested to completely uninstall Norton AntiVirus with Add/Remove Programs then run the uninstaller tool available here.

Save the tool to your desktop. Double click to run it. Select the version of Norton Antivirus you have, OK, then Yes to continue. Reboot when finished.

If you have the install disk, reinstall Norton AntiVirus and update it.

If you do not have the install disk, you can download AVG 7.0. This is a highly recommended free antivirus program. Be certain to check for updates also.
Post #24
Everything looks good and is operating great. I uninstalled norton antivirus and installed AVG. My junk Email traffic has gone down considerably and I haven't had any W32Beagles come in. I've learned quite a bit about this experience and I am very greatful and very appreciative of your time and energy that you have taken to help me in this matter. Since my finances are close to the red line presently I intend to donate in the near future to show my appreciation to this forum. Thats my word! Alpharay.
Post #26
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.


To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI