Jump to content


Photo

Added firewall and trouble started


  • This topic is locked This topic is locked
17 replies to this topic

#1 nybombers7

nybombers7

    Member

  • Full Member
  • Pip
  • 11 posts

Posted 12 July 2004 - 04:06 PM

I added a firewall to my system and now I can't get online. Nothing works, web, e-mail, etc... A friend said I may have been hijacked and the firewall is interfearing with something causing my computer not to recognize my ethernet connection. I read the FAQ page and ran Spybot till it turned up no problems. Here is my log file, any help would be greatly appreciated!!

Logfile of HijackThis v1.97.7
Scan saved at 12:55:19 PM, on 7/11/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISSERV.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISUM.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\SYMPROXYSVC.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\IAMAPP.EXE
C:\PROGRAM FILES\AIM95\AIM.EXE
C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\ATRACK.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IntelliPointSetup] d:\mouse\Setup.exe /skiptoieinstall
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE
O4 - HKLM\..\Run: [iamapp] c:\Program Files\Norton Personal Firewall\IAMAPP.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [nisserv] c:\Program Files\Norton Personal Firewall\NISSERV.EXE
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {86F622BC-EF88-458C-9E74-E2574B6875A5} (ChrtCtl Class) - http://fdl.msn.com/p...02/investor.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {2FF18E20-DE11-11D1-8161-00A0C90DD90C} (MSNBC News Menu Control 3.01) - http://www.msnbc.com...load/nm1228.cab
O16 - DPF: {94349FB6-37A0-4385-BADA-1B48DE3CA833} (ChrtCtl Class) - http://fdl.msn.com/p....5/investor.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com...ex/qtplugin.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://198.31.155.13...sCamControl.ocx
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...37864.490150463
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150...ip/RdxIE601.cab
O16 - DPF: Yahoo! Pool 2 - http://download.game...ts/y/potc_x.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.micr...922/wmv9VCM.CAB
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com..._1/axofupld.cab
O16 - DPF: {BF5E26B7-7087-4C2D-B0BA-0098F7CBED6B} (LiveX(5.4.0.0) Control) - http://empire.netcom...ects/Live54.cab
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - https://support.dell.../SysProfLCD.CAB
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} (Create & Print ActiveX Plug-in) - http://www.imgag.com...stall/AxCtp.cab

#2 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 12 July 2004 - 04:23 PM

when you disable the firewall, is everything back to normal?

#3 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 12 July 2004 - 04:59 PM

Maybe, your firewall or computer is set to block scripts, ActiveX controls, Java applets, referral information, or advertisements.
To find possible solutions or to re-configure, you can go to

www.symantec.com/techsupp/npf
and search for internet connection trouble shooting options.

#4 nybombers7

nybombers7

    Member

  • Full Member
  • Pip
  • 11 posts

Posted 12 July 2004 - 06:20 PM

Yes when I disable the firewall everything is ok. I checked all the settings and everything seems to look the same as on my other computer, which has no problems. Anything in log file look like a possible cause?

#5 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 12 July 2004 - 06:57 PM

I'm still checking your log file.
Nothing strange yet.
Meanwhile, do you have Norton 2003 or 2004?

#6 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 12 July 2004 - 07:00 PM

Also, Did you get any kind of error message or alert
from Norton or Symantec when you tried to access the internet?

#7 nybombers7

nybombers7

    Member

  • Full Member
  • Pip
  • 11 posts

Posted 12 July 2004 - 08:52 PM

I am using norton 2003, and nope, didn't get any error message from Norton or Symantec. I even tried lowering the security settings, but still had the same problems.

Thanks for the help

#8 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 12 July 2004 - 09:06 PM

Norton Internet Security, and Norton Personal Firewall 2003/2004 have a setting that can block access to the Internet. This setting is controlled by a toggle button on the main Norton Internet Security or Norton Personal Firewall window. Did you click on "Allow traffic"?

#9 nybombers7

nybombers7

    Member

  • Full Member
  • Pip
  • 11 posts

Posted 13 July 2004 - 03:39 PM

yes it is set to allow traffic

#10 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 13 July 2004 - 03:48 PM

O.k. Unfortunately, I'm headed to work so I'll be a while getting back to
you. Meanwhile, did you go to the symantec site?
Go to MSN (Or Google--whatever) and search for
Norton 2003 firewall support. There is a section dedicated to
"internet connection" trouble-shooting. There are several different
solutions to the type of prob. you're having. Maybe something
will work. I'll check on this post when I get home, and if you still
haven't found a solution, I'll help you work on it.
http://www.symantec.com/sabu/nis/npf (Support section)

#11 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 13 July 2004 - 03:51 PM

o.k. one more quick option...Is privacy control on?
If so
Open Norton Internet Security.
Click Privacy Control on the Norton Internet Security System Status screen.
Click Turn Off in the right-hand column.
Exit Norton Internet Security.
Connect to the Internet.
Any results?

#12 nybombers7

nybombers7

    Member

  • Full Member
  • Pip
  • 11 posts

Posted 14 July 2004 - 04:09 PM

I gave it a shot, Privacy control is off, and all the other settings are on low and still I can't seem to get online if the firewall is enabled.

#13 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 15 July 2004 - 08:55 PM

I may have a solution for you. But, I need to
know if your Norton firewall icon appears in the system tray
when it is enabled.

#14 nybombers7

nybombers7

    Member

  • Full Member
  • Pip
  • 11 posts

Posted 16 July 2004 - 08:09 AM

Yes the Norton firweall icon does apear in the syste tray when enabled

#15 terryb

terryb

    Member

  • Full Member
  • Pip
  • 51 posts

Posted 16 July 2004 - 07:51 PM

I contacted Symantec via email and they gave several links to their support site and offered this advice. Please read all of it; it is long, but if you go down the check list one item at a time, I'm sure you'll eventually come to the reason your firewall is acting up. Note, especially near the end of the article where it discusses viruses, other program compatability, ICS, etc. If all else fails, completerly remove/uninstall your program and re-install it. This is all according to the Symantec/Norton company. I will copy it here for you.
*******************************************************

If there is no Norton Firewall/Symantec icon in the system tray, then one or more of your Symantec product files may have been damaged. You should try to reinstall your Norton product.

If you do have an enabled and active icon, then read further:
If you can access the Internet after turning off Security then a setting in Norton Internet Security or Norton Personal Firewall may be blocking your connection to the Internet.

Here are possible options to double check:

A rule in Norton Internet Security or Norton Personal Firewall is blocking Internet access


You may have created a rule in Norton Internet Security or Norton Personal Firewall that stops access to the Internet. Going back to the original, default firewall rules may solve the problem. (One of the non-default rules may be blocking Internet access.)

After you restore the default rules, create new firewall rules for the programs that are on your computer. The easiest way to create rules for your programs is to run an Application Scan or Program Scan.

Norton Internet Security or Norton Personal Firewall is configured to block all Internet traffic

Norton Internet Security, Norton Internet Security Professional, and Norton Personal Firewall 2003/2004 have a setting that can block access to the Internet. This setting is controlled by a toggle button on the main Norton Internet Security or Norton Personal Firewall window.

This toggle button lets you switch from one choice to another with one click. You see only one choice at a time. The text on the button always shows you what you will change to if you click the button.

Clicking "Allow Traffic" will allow Internet traffic. (You will see this choice only when Internet traffic is currently being blocked.)
Clicking "Block Traffic" will stop Internet traffic. (You will see this choice only when Internet traffic is currently being allowed.)

Privacy Control is blocking Internet access

If you can get to the Internet when you disable Privacy Control, then information that has been added to it is blocking Internet access. The type of information that might have been added includes:
Your Internet Service Provider (ISP) logon name
Your ISP password,
Your email password
Your ISP phone number

In this situation, you need to remove some information from Privacy Control.

To remove information from Privacy Control
Open Norton Internet Security.
Double-click Privacy Control on the Norton Internet Security System Status screen.
Click Private Information.
Select the entry to remove.
Click Remove.
Click Yes.
Repeat steps 4 - 6 for each entry that includes information that may be blocking access to the Internet.
Click OK twice.
Exit Norton Internet Security.


Ad Blocking is blocking Internet access


To find out if information in Ad Blocking is blocking the computer from accessing the Internet do the following
Open Norton Internet Security.
Click Ad Blocking on the Norton Internet Security System Status screen.
Click Turn Off in the right-hand column.
Exit Norton Internet Security.
Connect to the Internet.

If you still cannot access the Internet, Ad Blocking is not blocking access. Follow the steps above, and in step 3, click Turn On. Continue with the next section.

If you can connect to the Internet when you disable Ad Blocking, then your problems are related to a nonstandard Internet connection. In this situation you must leave Ad Blocking disabled in order to connect to the Internet because your Internet connection is incompatible with it.

Using the Child or Restricted account as your startup account is blocking Internet access

Using the Child or Restricted account as your startup account is blocking Internet access
If this problem happens immediately after installing Norton Internet Security or Norton Personal Firewall you may have configured Norton Internet Security or Norton Personal Firewall to use a Child account as your startup account. Typically, a Child or Restricted account may not have Internet access. To resolve the problem, change the startup account to the Supervisor account. For instructions, consult your Norton Internet Security or Norton Personal Firewall user manual, or see the appropriate document:

How to configure Parental Controls and user accounts for Norton Internet Security
How to configure Productivity Control and user accounts for Norton Internet Security Professional

Being logged on to Norton Internet Security with a Child or Teenager account blocks Web sites
Depending on your account, Norton Internet Security limits your access to the Internet. If you are logged in with a Child or Teenager account, that account is restricted, and many Web sites are denied to your based on their content. To solve this problem you must log on as the Administrator or with an account with Supervisor access, then make changes to the restricted account. Follow the steps in the document Cannot access the Internet unless logged in as Supervisor.



If you still cannot access the Internet, Norton Internet Security or Norton Personal Firewall settings are not blocking your connection to the Internet. If you have not yet turned Security back on in Norton Internet Security or Norton Personal Firewall, turn it on click Turn On in the right column. And, check the following trouble shooting options:

Low system resources:

Low system resources can prevent programs from accessing the Internet. For how to increase the computer's system resources, read the document Basic guide to optimizing system resources.

Virus infection

Virus infection
Viruses can corrupt files and keep a computer from connecting with the Internet. Run your antivirus program to make sure that your computer is not infected:

If you already detected and removed a virus from the computer, rerun your antivirus program to ensure that the computer is not reinfected. Then reinstall any programs that are no longer functioning.
If the computer is infected, remove the infection, and then reinstall any programs that no longer function correctly.
If the computer is not infected, look at the other possible solutions listed in this document.

If you do not have an antivirus program, you can use the Symantec free online virus scanner to check for and remove viruses.
To use the Symantec online virus scanner
Go to Symantec Security Check online virus scanner.
Click "Start" under Virus Detection.

--------------------------------------------------------------------------------
Note: If you cannot run the online virus scan, then it is possible that your computer has been infected by a virus or worm that attacks antivirus programs, such as the W32.Klez.gen@mm worm.Download and run the W32.Klez.gen@mm removal utility, and then scan the computer again for viruses.
--------------------------------------------------------------------------------


If the online scanner detects a virus, worm, or Trojan, search for the name of the threat on the Symantec Security Response Virus Encyclopedia Web site, and then follow the associated instructions to remove the infection.
If the online scanner does not detect a virus, worm or Trojan, continue with the next section.


Conflict with another program

Conflict with a statistics or advertising program
Some programs include other programs that display advertisements or track statistics. In some cases, when one of these programs is on the computer with Norton Internet Security or Norton Personal Firewall, the combination can prevent Internet access. Removing the statistics or advertising program resolves the problem.
Conflict with another program that loads when you start the computer
When Norton Internet Security or Norton Personal Firewall conflicts with another program that loads when you start the computer, Norton Internet Security or Norton Personal Firewall can fail to load properly, resulting in a lack of Internet access. To prevent the conflict, configure Norton Internet Security or Norton Personal Firewall to load later in the startup process. For Norton Internet Security or Norton Personal Firewall 2003 or 2004 do the following:
Open Norton Internet Security or Norton Personal Firewall.
Click Options > Norton Internet Security or Norton Personal Firewall.
On the General Tab, under Start Norton Internet Security or Norton Personal Firewall, select Manual.
Click OK.
Restart the computer.
On the System Tray in the lower right-hand corner of your screen, click the globe with an X on it.
Click Enable.
Connect to the Internet.
If you can now access the Internet, then there is a program that is loading at startup that is conflicting with Norton Internet Security or Norton Personal Firewall. For information about how to solve this problem, read the document How to change when Norton Internet Security or Norton Personal Firewall loads during Windows startup.
If you still cannot access the Internet, repeat the steps above and in step 3 change the setting to back to "At system startup", and not "Manual".
Conflict with adware programs
Some adware programs can interfere with the normal functioning of a computer and prevent access to the Internet. To determine whether this is the cause of the problem on your computer, disable the adware and test your Internet connection.

For instance, if you install Hotbar (HBinst.exe), you may find that you can install Norton Internet Security without problems, but Norton Internet Security is disabled after you restart the computer and the computer no longer has access to the Internet. If you have Hotbar, uninstall Hotbar to determine whether it is related to the problem.

For more information about what adware is and your options for handling it, read the document Adware protection and Norton Internet Security or Personal Firewall.
Using a Virtual Private Network (VPN)
Norton Internet Security is not compatible with many VPN software programs. In addition, some VPNs restrict Internet access to selected sites. For more information regarding VPN software and Norton Internet Security or Norton Personal Firewall, see the document Virtual Private Networks and Norton Internet Security or Norton Personal Firewall.

Using Intel AnyPoint
Norton Internet Security is not compatible with Intel's AnyPoint Wireless networking product. For more information read the document Cannot connect across an Intel AnyPoint network with Norton Internet Security or Norton Personal Firewall enabled.

Using Internet Connection Sharing (ICS)
Microsoft's Internet Connection Sharing is supported by Norton Internet Security or Norton Personal Firewall. See the document Internet Connection Sharing on Windows 2000/XP.

Using another firewall program
Because the main functions of firewall programs are the same or similar to each other, having more than one firewall program installed on your computer can cause conflicts that prevent one or both programs from functioning correctly. To ensure that Norton Internet Security or Norton Personal Firewall function properly, uninstall all other firewall programs from the computer. Commonly sold firewall programs include Freedom, Black Ice, Zone Alarm, and others.

For example, if you have a copy of Freedom that was included with your Hewlett-Packard computer, Freedom can interfere with the proper functioning of Norton Internet Security or Norton Personal Firewall even if you did not activate the Freedom program. To resolve the problem, uninstall the Freedom program.


Using a non-default setting in Windows XP

This problem can be caused in Windows XP by a setting in Internet Explorer. To resolve the problem, change the setting to enable the computer to use HTTP 1.1 connections through a proxy connection.
To enable HTTP 1.1
Open Internet Explorer > Tools > Internet Options > Advanced Tab.
Check "Use HTTP 1.1 through proxy connections."
Click Apply > OK.

If Norton Internet Security logs are showing a large number of "no match" hits, or if Norton Internet Security gives error messages when you try to clear the logs, you may have a Norton Internet Security installation that has become corrupted. In this situation, follow the steps in the document for your version of Norton Internet Security or Norton Personal Firewall.

P.S. There is a free online support scan (automated support assistant)
that will scan your system's Norton product and analyze the problem.
It is available here: http://www.symantec.com/techsupp

Edited by terryb, 16 July 2004 - 07:54 PM.


#16 CEOn10ec

CEOn10ec

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 16 July 2004 - 09:31 PM

:thumbsup: Way to go, TerryB...
You definitely covered it!

#17 becca7597

becca7597

    Member

  • Full Member
  • Pip
  • 5 posts

Posted 17 July 2004 - 05:19 AM

I had a very similar problem with my Norton product.
I would suggest that you remove all traces of it and
reinstall it.
Becca

#18 nybombers7

nybombers7

    Member

  • Full Member
  • Pip
  • 11 posts

Posted 17 July 2004 - 11:18 AM

Well thank you very much Terry B that got it!! I finally got it to work with the firewall on!!

Thanks for all your help, you're a lifesaver!!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button