Solved Can browse internet only in safe mode

September 3, 2014 at 10:28:45
Specs: Windows 7
Hi,

I am connected to the internet in regular mode and can ping sites but can not connect to them through IE or firefox. I am able to surf the web through safe mode. I have removed all antivirus and spybot programs to see if the problem would be solved but still the problem persists. Below is the Hijackthis log.

Logfile of Trend Micro HijackThis v2.0.5
Scan saved at 1:22:14 PM, on 9/3/2014
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16660)

FIREFOX: 31.0 (x86 en-US)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
C:\Windows\system32\DllHost.exe
C:\Users\Pramiti\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USREL/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?L...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?L...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (file missing)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.0.0.136\IPSBHO.DLL (file missing)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MIF5BA~1\Office12\GR469A~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.0.0.136\coIEPlg.dll (file missing)
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/get...
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MIF5BA~1\Office12\GRA32A~1.DLL
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe

--
End of file - 5102 bytes


See More: Can browse internet only in safe mode

Report •


✔ Best Answer
September 6, 2014 at 20:26:16
Thanks everyone for your help. I got some advice to try a norton AV removal tool and my problem is solved now.


#1
September 3, 2014 at 11:37:13
Nothing too obvious but HTJ is a bit old hat these days. It might not be a virus problem but best to have a quick further check.

Download, Install Update and Run MalwareBytes (free) from green icon top right here:
http://filehippo.com/download_malwa...
If it finds anything please copy/paste the log on here.

Next download and "Save" ADWCleaner file from blue icon top right here:
http://www.bleepingcomputer.com/dow...
Double click the saved file and just run the Scan. Please paste that log on here too.

Always pop back and let us know the outcome - thanks


Report •

#2
September 3, 2014 at 12:01:42
Hi Derek, Thanks for your reply I will run those programs and post the logs.

Just to add a bit more info the laptop has not been used that much, there were many antivirus and spy bot ad block programs that were put on the system. Even though I have uninstalled all of them there must be something left over that is blocking the connection in IE and firefox.

I tried to factory reset but that option is not on the machine and I do not have the disks.

Thanks


Report •

#3
September 3, 2014 at 12:08:00
In truth at this stage we don't really know what it is but "antivirus and spybot ad block programs" are not the most usual culprits. The two programs I mentioned are good (although not the "be all and end all" for cleaning a computer of nasties). However they should give an indication about whether to go further in that direction or to change tack completely. It could turn out to be a network issue.

Always pop back and let us know the outcome - thanks

message edited by Derek


Report •

Related Solutions

#4
September 3, 2014 at 14:05:48
Best way to troubleshoot this is using MSCONFIG. Type msconfig in the run line and it will come up. Go to Startup and uncheck all programs. Then boot normally. If good add one item back at a time with a reboot. When you don't get internet you know the last enabled program is the problem.

Answers are only as good as the information you provide.
How to properly post a question:
Sorry no tech support via PM's


Report •

#5
September 3, 2014 at 18:46:08
I did not uncheck and then reboot each item from the msconfig startup but I compared the startup from regular boot to the safemode boot and both have the same items checked for startup.

The scan from MalwareBytes found 0 problems and the log from ADWCleaner is below.
# AdwCleaner v3.309 - Report created 03/09/2014 at 21:38:36
# Updated 02/09/2014 by Xplode
# Operating System : Windows 7 Starter Service Pack 1 (32 bits)
# Username : Pri - PR-PC
# Running from : C:\Users\Pr\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Mozilla Firefox v31.0 (x86 en-US)

[ File : C:\Users\Pr\AppData\Roaming\Mozilla\Firefox\Profiles\ujw900ge.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [935 octets] - [03/09/2014 21:38:36]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [994 octets] ##########


Report •

#6
September 3, 2014 at 19:09:45
Yes ADWCleaner did find some things that could affect browsing. Please Run the "Clean" now and copy/paste the new log on here. Also check to see if you still have the same issue and let us know.

If the new log is clean but it does not help I think it best that we pursue more general possibilities, starting with the suggestion already given in #4 by "wanderer".

Always pop back and let us know the outcome - thanks


Report •

#7
September 4, 2014 at 09:17:58
I have cleaned the registry and the log is below.

I also unchecked all items except the synaptics pointing device driver and restarted the computer and I still have the same problem. What should I do now?

# AdwCleaner v3.309 - Report created 04/09/2014 at 10:40:47
# Updated 02/09/2014 by Xplode
# Operating System : Windows 7 Starter Service Pack 1 (32 bits)
# Username : Pr - PR-PC
# Running from : C:\Users\Pr\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Scheduled Tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Mozilla Firefox v31.0 (x86 en-US)

[ File : C:\Users\Pr\AppData\Roaming\Mozilla\Firefox\Profiles\ujw900ge.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1073 octets] - [03/09/2014 21:38:36]
AdwCleaner[R1].txt - [1134 octets] - [04/09/2014 10:36:53]
AdwCleaner[S0].txt - [1062 octets] - [04/09/2014 10:40:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1122 octets] ##########


Report •

#8
September 4, 2014 at 11:21:16
ADW seems to have done it's stuff and I think you might as well re-check the MSCONFIG items.

The symptoms reported in the first two lines of the original post are unusual. Do you know when this browsing issue happened because I'm wondering if it is worth resorting to System Restore, which should keep all your own stuff?

Always pop back and let us know the outcome - thanks


Report •

#9
September 4, 2014 at 11:37:12
The browsing issue happened after I installed spybot search and destroy, first it would not allow webpages to open in Firefox saying it has been blocked by spybot, but IE would work now it has completely stopped working all together.

There aren't any files on the laptop that I need to keep since I have hardly used the laptop.
The system restore only has restore points most likely since these issues have happened to restoring back to one of those points may not help. There is no factory reset on the machine.
The issue happened 6 or 7 months ago, but this laptop is a back up laptop so I never fixed the issue until now.


Report •

#10
September 4, 2014 at 11:45:56
It's a long shot but try the Reset Options in each browser:

IE > Tools > Internet Options > Advanced tab > Reset button.

Firefox > Help > Troubleshooting information > Reset Firefox button (near top right of page).

Always pop back and let us know the outcome - thanks

message edited by Derek


Report •

#11
September 4, 2014 at 13:10:28
Spybot S&D edits the hosts file which disallows browsers and software from accessing the Internet if the address they wish to access is listed in it.

It is unusual though that it would prevent access to the whole internet. Google.com shouldn't be listed in the hosts file and should still be accessable. Google.com wouldn't be regarded as Spybot as "unsafe".

If advice given at response #8 didn't work it would be adviseable to reset the hosts file after Spybot S&D has been removed:

http://support.microsoft.com/kb/972034 (doesn't work with Windows 8)

Also after you have reset the hosts file back default clear the DNS cache:

http://docs.cpanel.net/twiki/bin/vi...

Let us know if this returns some browsing functionality to your computer.


Report •

#12
September 4, 2014 at 13:32:28
Another way to just "temporarily" disable the hosts file to prove the point is to go to it and rename it to xhosts.

It's in "C:\Windows\System32\drivers\etc". Best reboot before trying although it shouldn't be necessary.

It would be surprising if spybot blocked the whole net in hosts because it can only make a list and it's hard to imagine it "that" full. However, life is full of surprises, and something else might have got at it.

Always pop back and let us know the outcome - thanks


Report •

#13
September 4, 2014 at 13:42:16
I removed Spybot a long time ago because while it was once a leader in malware security measures it become quite buggy and bogged down the system.

If it somehow edited the hosts file and removed the hash # from 127.0.0.1 that would create immense problems, but the symptoms would be systematic across all software.

I think it was a good suggestion to reset the browsers, but it should be done after editing the hosts file which will have been most definitely edited by Spybot S&D.

message edited by btk1w1


Report •

#14
September 4, 2014 at 13:47:27
Yeah Spybot is old hat and that "tea-timer" facility screwed up everything - most folk turned it off.

EDIT:
SpywareBlaster is equally old but just as effective as it ever was.

Always pop back and let us know the outcome - thanks

message edited by Derek


Report •

#15
September 4, 2014 at 17:42:33
Used the links above to change the host file and cleared the dns cache, and still the problem persists.

Also reset each browser.

Any other suggestions?


Report •

#16
September 4, 2014 at 18:24:16
Clutching at straws. Try IE and Firefox without Add-ons:

Internet Explorer.
Type iexplore -extoff in the Run box and hit Enter key.
EDIT: Note the single space after iexplore.

Firefox.
Go to Help > Restart with Add-ons disabled > Restart button > Start in Safe Mode button.

Not hopeful because Reset should have looked after this.

What exactly happens when you try to go to a website from the browsers?

Always pop back and let us know the outcome - thanks

message edited by Derek


Report •

#17
September 6, 2014 at 20:26:16
✔ Best Answer
Thanks everyone for your help. I got some advice to try a norton AV removal tool and my problem is solved now.

Report •

#18
September 7, 2014 at 07:34:26
Interesting outcome. Good to hear you are now sorted and thanks for letting us know.

Always pop back and let us know the outcome - thanks


Report •


Ask Question