Can't open web basesd e-mail

I found "dlhelper" on my computer blocked with Norton Internet sercurity and deleted, now I can read yahoo e-mails I can log in but when I try to go to mail i get blank page doesn't time out or load.
also when i check programs in Norton I find 2 explorers 1 is microsoft internet explorer, the other microsoft windows explorer.
any suggestions?
Thank you

 

Not sure where you're hanging up. At the login to mailbox stage, view inbox stage or view mail stage. Are you experiencing problems with anything/anywhere else? IE Explorer and Windows Explorer would both be normal running processes.

 

I can log into yahoo, go to home page see e-mail subjects from home page, but when I try to either click on the inbox link or the email tab at top of browser I go to blank page. I have checked and read e-mails with no problems from 2 other computers.
Thanks
shammie

 

Hmmm.....first try clearing TIF's, cookies (and if necessary later, history). Open a command window (start>run and type command for Win 98, cmd for XP)and type ipconfig /flushdns, enter. If using Sun Java, open it in the control panel to the cache tab and clear.
Does it help to click refresh after the page stalls?
Next step would be to download and install Spybot(might need to refresh a couple of times) and Ad-aware. Links in my signature. Open and immediately update. Configure Ad-aware for and run a full scan. Select all it finds and fix. Select everything Spybot finds marked in red an fix.
Let us know if it helps, what they find (alot...a little). Are you able to sign into Yahoo messenger? Can you access mail from there?

 

deleted tifs, cookies. ran command ipconfig/flushdns (opened dos window gave me additional commands-- /all display detailed info, /batch write to file, /renew_all renew all adapters, /release_all, /release n, /renew n.

adware found "alexa "
spybot found "dso exploit "

I uninstall yahoo messenger long ago.

I still have not been able to get to e-mail page.
Thanks for help
shammie

 

Run a full scan with both RAV and Housecall. Let us know if anything found. Also might want to post a HijackThis log. Download available from the CWShredder link in my signature. Place it in a permanent folder(I create a new folder in C:\ named HJT). Open and hit scan, then save log. Once it is saved it will open in notepad. Select all from the edit button, copy and paste the results here. Don't fix anything with it yet! As with running BOTH Spybot and Ad-aware, these things may reveal something others have not.

 

ran both rav and house calls they found nothing. Below is a hijackthis log:

Logfile of HijackThis v1.97.7
Scan saved at 10:30:28 PM, on 5/29/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\OFFICE51\SOINTGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ESOFT\EBOARD\EBOARD.EXE
C:\PROGRAM FILES\NETZIP CLASSIC\NZFPROP.EXE
C:\PROGRAM FILES\2WIRE\HOMEPORTAL\2PORTALMON.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\MY DOCUMENTS\MY MUSIC\DOWNLOADS\HIJACKTHIS.ZIP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/customize/sbcydsl/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com
F1 - win.ini: run=hpfsched
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SBWatchDog.EXE] C:\WINDOWS\SYSTEM\SBUtils\SBWatchDog.EXE /l
O4 - HKLM\..\Run: [eMachine eBoard] C:\PROGRA~1\ESOFT\EBOARD\eBoard.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] c:\program files\norton internet security\norton antivirus\navapw32.exe /LOADQUIET
O4 - HKLM\..\Run: [NetZIPFolders] C:\Program Files\Netzip Classic\nzfprop.exe /startup
O4 - HKLM\..\Run: [2wSysTray] C:\PROGRAM FILES\2WIRE\HOMEPORTAL\2PORTALMON.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe "
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [URLLSTCK.exe] c:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SO5 Integrator Pass One] C:\OFFICE51\SOINTGR.EXE
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks "
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe "
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe "
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccProxy] c:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDSRVC.EXE
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O9 - Extra button: Yahoo! Login (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Login (HKLM)
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Netnews (HKCU)
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O16 - DPF: {351CF0CE-B05A-11D2-ABD9-00104B685417} (PWImageControl Class) - http://64.209.175.152/code/PWActiveXImgCtl.CAB
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {6BB594E2-6E4D-4CC9-98B0-931C323F9165} (DepHlp Control) - http://www.worldwinner.com/games/shared/dephlp.cab
O16 - DPF: {853C1A83-1639-11D0-8BBF-0080C7A01083} (Web Browser Pop-up Window Control) - http://activex.microsoft.com/activex/controls/iptdweb/webpopup.ocx
O16 - DPF: {9184D21C-9835-42C5-A883-EA8BE7FC048D} (Downloader Class) - http://www.shopintuit.com/Executables/IE/IDA.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -
O16 - DPF: {1A4DA620-6217-11CF-BE62-0080C72EDD2D} (MarqueeCtl Object) - http://activex.microsoft.com/controls/iexplorer/x86/marquee.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37867.3896412037
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clients/y/nt1_x.cab
O16 - DPF: {9CF28A69-7659-4C51-BFD5-9ADE19E19EC3} (RegConfig Class) - http://download.yahoo.com/dl/installs/bkm/prod/yregcfg.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) - http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/sbcy/yinst.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
O16 - DPF: Yahoo! NFL GameChannel StatTracker - http://aud1.sports.sc5.yahoo.com/java/y/nflgcst1010_x.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/13d5bd607560c54e3c23/netzip/RdxIE601.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?312
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} (DoomCln Object) - http://www.microsoft.com/security/controls/DoomCln.CAB
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/threatinfo/virusinfo/webscan.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

 

Check one more thing. IE options>TIF settings button>view objects. Delete any damaged or not installed. I see one in your log associated with Yahoo mail that may be causing problems. Sorry, I'm getting very sleepy and won't do a complete analysis of the log tonight. A quick glance thru it, nothing jumped out at me. Someone else may see something and advise though. Otherwise I'll check it thoroughly in the morn. Again, sorry. Need toothpicks for the eyelids.

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -

 

Please explain ?
dllhelper.exe, dlheper.exe ,dllhelper.dll dlhelper.dll
which one ?


Im dont think this will address your Yahoo mail problem
Daves adea probaly will (great spot Dave by the way )

Start Hijackthis and place a check next to these items
Close all browser windows and shut down all other programs(even Folders)
that show in the taskbar. Then Hit fix selected
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [SBWatchDog.EXE] C:\WINDOWS\SYSTEM\SBUtils\SBWatchDog.EXE /l
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/13d5bd607560c5...ip/RdxIE601.cab

These arent marked as bad in spywareblasters database, but I see them being fixed often, its safe to do so.
O16 - DPF: {351CF0CE-B05A-11D2-ABD9-00104B685417} (PWImageControl Class) - http://64.209.175.152/code/PWActiveXImgCtl.CAB
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.143/code/PWActiveXImgCtl.CAB
===========
More information on SBWatchDog

 

thanks for all your help.

it was dlhelper.exe. I did find that Yahoomailtoclass was damaged, i deleteted and reinstalled from disk. I have used hijack to fix items form Lonny's post. I have been able to view e-mail ~2 times out of ten sometimes gets to mail home page but i can't view individual mails, other times can view but freezes at deleting, ect. Still working with no problems on other computers.

 

Hi shammie

That is an ActiveX control, placed there by Yahoo Mail, not 'the disk'. You could delete ALL of those objects without any negative effects. They will be reinstalled when needed. If you have your security settings set in such a way, you will be prompted to allow it. Once allowed, it is stored and allows use without prompting at anytime in the future. It is basically and executable, an .exe, that allows a program/application to run, install files, transfer data, etc.,etc. That is one of the reasons that they show up in a log. They are often placed without your knowledge and used from then on by undesireables. IMO, too many objects could be a bad thing. When an application that uses them needs to run, the more objects to search through to find the one it needs, the longer it could take for it to run. Hope this helps.

Check out this page for more info on dlhelper.exe If you have any questions, don't hesitate to ask.

 

thanks again for all your help. I have one more question under running task I found Sointgr.exe doesn't say where it came from. is it ok? if not how can i get rid of?
shammie

 

I have just scanned the details of this post but I have found this when viewing webmail on BTYahoo! I can view it witout any problems on my main PC but when I try to view it on my laptop which is connected via my router the same thing happened - front page but could not see my inbox.

I have Sygate on both computers and noticed a block in the traffic log when I was trying to view my webmail - I had to create an advanced rule in Sygate on my LT to allow the access via the router. It seems to be only webmail this happens to as I can surf otherwise. I just keep my router rule in place and can see my webmail when using my LT now

It is strange but if you are using the same connection/firewall check your traffic log when this happens again. I could run without Sygate as my router is the solid firewall but I use Sygate to control the outgoing traffic!

 

would it help to delete all objects? also i ran pest controll it found 3 problems
euniversedirectory, virtumonde, cws.googlems.3. Won't let me delete or quarantine with trailware. any advice?
Shammie

 

It certainly won't hurt, and it's worth trying. Delete cookies too. You will have to login here again, if you had it set to remember you. BTW, IE Options>privacy>advanced, check override auto, accept first, block third and always allow session. OK out.

Open Spybot. Click settings and settings again. Scroll down to scan priority and check highest. Click mode at the top left and select advanced. Check for updates and run a scan. Fix all it finds. Again, open Ad-aware, check for updates. Make sure it is set for custom and configured for full scan. Run and delete all it finds. Download CWShredder from my signature. Open it, close all other windows and click fix.

Reboot.

Paste the following command into the IE address bar and hit enter.

javascript:navigator.userAgent

Copy and paste the resulting window here. Let me know if any of this helps.

 

you are the greatest . The culprit must be Macromedia Flashplayer 7. After deleting all and rebooting I checked e-mails with no problem, then when I logged out a box came up and said flashplay 7 was required for the page i was viewing (yahoo dsl log on page) when i hit yes i could no longer check e-mail, after deleting e-mail works fine!!

When i run spybot it catches "DSO Exploit" every time I fix it but comes back should this be of concern?

"javascript:navigator.userAgent" lead to "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; AT&T WNS5.0; YComp 5.0.0.0) "

THANK YOU I really appreciate all you have done.
Shammie

After going back there must also be some sort of cookie problem, when I log in i can check e-mails, go back to home page, check sub e-mail, no problems, but when i close browser and re-open e-mail no longer loads. any thoughts?

 

WOOHOOO! Glad it worked! Now, click immunize and then above the window ,immunize again, in Spybot. Then, you see the link to SpywareBlaster? Follow it and install. Then install IESpyads. Those three things will block most known baddies from ever getting on your PC. You will still pick up some cookies, and stuff like that from time to time, but not much. Update them from time to time and you'll stay protected. BTW, the results of the javascript:navigator.userAgent are perfect. Looks to me like you're good to go! Happy surfing!!

 

After going back there must also be some sort of cookie problem, when I log in i can check e-mails, go back to home page, check sub e-mail, no problems, but when i close browser and re-open e-mail no longer loads. any thoughts?

 

Try narrowing it down. Delete objects, if any, and try again. Then cookies, then both. Bit unsure now. I'll think on it.

 

no objects to delete. I have tried just deleting files, then history, then files and history, nothing works until i delete cookies, just cookies by itself solves problem of course i have to log in again. the only cookie in the windows\cookies file is default@yahoo[1].txt