Connected to internet,but progs and ie won't

[cypher2004]

Hi all,i have a connection problem.I can see that i am connected to the internet by the two little screens in the taskbar,but no programs i have will connect,or will internet explorer,it was all working fine till about a week ago,then i noticed all my progs disconnect and my browser wouldn't work,just said page cannot be displayed all the time.I don't remember if i deleted anything just before this all happened,as far as i am aware i was just surfing,if anyone could help me it would be very much appreciated

thanx

 

[RealBlackStuff]

To be on the safe side, go here and follow the instructions, you might have been hijacked
How to remove Begin2Search / Coolwebsearch
When in doubt, show us your HJT-log as an attachment (with a .txt extension please)

 

[cypher2004]

what do u mean hijacked??

 

[poertner_1274]

You could have been taken over by a virus or trojan. It's not a huge deal, happens quite often, just needs to be taken care of

 

[olefarte]

Peortner beat me to it. Mods you can delete this post.

 

[cypher2004]

i have had a look at the link that realblackstuff posted,and have the progs recommended,and am now just running them on my home pc,in case you were wondering how i am chating when i say nothing connects,its my home pc that has trouble,and i am on my laptop now.I can't d/l the latest updates on my home pc cus nothing will connect.
I wll post what the results were when all is done,thanx for the advice guys,much appreciated

 

[cypher2004]

ran everything on pc last night,and it made no difference,still progs or ie will connect,i have a log form hijackthis is there somewhere i can post it cus i have no idea what i should be looking for??

 

[RealBlackStuff]

Click on Post Reply, then click on Go Advanced under the text-box.
Type your message in, further down under the textbox you will find a box for attachments. Click on Browse, go to your hijackthis.txt file, click OK then click Upload.
Now click submit message.

 

[cypher2004]

Thanx for explaing that,right i should have added my hijackthis log file,also i have noticed when my pc boots up,and i open my task manager the cpu monitor at the bottom always reads about 85-100% and the thing that is using up most of it is something called"drwtsn32.exe"now i have looked on my laptop and checked in task manager,and that doesn't show up??do i need this,when i click end process my cpu usage goes down to 0-15%,this has me wondering??

 

[RealBlackStuff]

Do a FULL scan with an updated Antivirus program.

Then reboot in Safe Mode and run HJT standalone and let it fix:

C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\system32\resetservice.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...b/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/...b/*http://uk.docs.yahoo.com/info/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sp/*http://uk.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/su/*http://uk.search.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 218.145.25.84:8080
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\System32\IETie.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O23 - Service: Reset 5 - Unknown - C:\WINDOWS\system32\srvany.exe

When done, delete:
C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\system32\resetservice.exe
C:\WINDOWS\System32\IETie.dll

For the drwtsn32.exe problem, see here
http://216.239.59.104/search?q=cach...9+disable+drwtsn32.exe&hl=en&client=firefox-a
look at the second post by Gaim Mastr

 

[cypher2004]

Hey thanx for taking a look at that for me,my anti virus is up to date as far as i know,norton 2005,i can't update it on my pc as it doesn't connect,well it does but nothing will connect to the net,so what can i do??

 

[RealBlackStuff]

Run the HJT bit first.
After that and a reboot into normal you should (hopefully) be able to connect again.
Post another HJT.txt if needed

 

[cypher2004]

thanx realblackstuff,i will get onto it now,and post result(fingers crossed)

 

[cypher2004]

well back again,realblackstuff,i done as you said in ur post,and nothing has changed i deleted all that you said after running HJT in safe mode,the only thing being that i couldn't see

C:\WINDOWS\system32\srvany.exe in HJT when i ran it,but as far as i know the rest was there

when i went into C:\WINDOWS\System32 i managed to delete

C:\WINDOWS\system32\srvany.exe
C:\WINDOWS\system32\resetservice.exe

but i couldn't see C:\WINDOWS\System32\IETie.dll
also my anti virus couldn't connect to update either,so i am running a scan now just to see what happens i have posted my HJT log which i done after i had deleted everything and rebooted

thanx for looking.

 

[RealBlackStuff]

Question: Is the Firewall in Norton/Symantec activated? If so, it could clash with the other firewall you have from Sygate. And Windows XP has also a firewall. Advise please which ones are active, resp. shut down.

Reboot in Safe mode and let HJT fix:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 218.145.25.84:8080
O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = ?
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB04A6B-862E-48A6-8EE2-77A084244F23}: NameServer = 194.74.65.68 194.72.9.34

That Getright might be a dead link in your Startup folder.

PS: if you post again, make it a hijackthis.txt file please, not a ZIP-file.