I'm having som serious problems....

Since yesterday I haven't been able to connect to msn messenger... It just reports the error 81000306 -  "we could not sign you in to msn messenger, check your internet connection." (translated from swedish messenger, so it's not exactly what it says in english I guess..)

The error started to occour yesterday as I said. But the weird is that we have 3 computers here at home connected to internet through a local area network. And all of them have the same error.. so trying to reinstall messenger and fumble around with different network settings at this computer seems meaningless..

And the error not only affects msn messenger. I can't connect to neither windows update, hotmail, webmessenger or any similar service from microsoft...

I'm using the latest msn messenger and the latest msn plus on win xp sp2 home edition. I have Norton Internet Security installed but have tried to have it shut down and also watching it's logg-files to open up everywhere it blocks. But it has worked before with NIS, so I don't feel like uninstall it.

Any suggestions? could it be like a virus or something? I had some problems with some progam called navexcel yesterday.. some sort of spyware. But it's removed now with the help of ad-aware..
Please help if you know how to.. or could refer to a site which can give me more information..

//Micke

See if this solves the problem:

1. Clear your IE cache and cookies -- open Internet Explorer, click the Tools menu, then Internet Options, then click the Delete Files button, and when that's complete click the Delete Cookies button.

2. Check your IE Security settings -- open Internet Explorer, click the Tools menu, then Internet Options, then Advanced tab, scroll to the Security section, and verify that "Check for server certificate revocation" is unchecked. Also verify that 'Use SSL 2.0' and Use SSL 3.0' is checked, then click OK

3. Start > run > type: regsvr32 softpub.dll <enter>

More possible solutions can be found here, first two posts

allready done that... I've read alot in other threads about the problem ****370 which looks similar.. But all of them seems like it's only one computer affected.. if it would have been in only this computer it would make more sense.. But when the entire network is affected things get harder..

Check the settings on the router or computer that lets you connect to the internet, see if there is something that's blocking these urls or ip's

maybe if someone is good at routers you can tell me where it may be located? And is it really possible for an spyware or virus to get inside the router to change settings?

this does not have to be a problem with a router necessarily. it is odd that windows update and other microsoft related internet connections are blocked.

i doubt that it is the problem.



try the following.
if you are using a proxy server, make sure that the proxy server is set to allow anonymous connections to the internet. and enable the Use HTTP 1.1 through Proxy Connections setting

1. Start Internet Explorer.
2. On the Tools menu, click Internet Options.
3. Click the Advanced tab, and then select the Use HTTP 1.1 through proxy connections check box.
4. Click OK.

IF THIS does not help than try this:

in C:\WINDOWS\system32\drivers\etc\ folder you should check if the host file name are correct.

start Notepad, drag-and-drop operation the hosts file (or Hosts.sam file) into the open notepad document

if there is a host (or Hosts.sam) file on your system that has an entry for the "Windows Update" site, delete the entry. see if this helps.

don't use a proxy.... I just have a plain connection from my computer, to a adsl modem router and then to the phone line... but checked use http 1.1 through proxy anyway.. still didn't work.
So i looked up the host file.. only localhost existed.. this is getting really annoying.. And the fact that I read on different forums about people having this problem several weeks don't make me feel better..

thanks for the help anyway btw =)

Navexel:
Description:
NavExcel is a search hijacker implemented as an IE Browser Helper Object. Address bar searches, attempts to connect to unknown servers, and all 404 page-not-found errors (even those whose sites provide custom error pages) are redirected to webservicehost.com.

Also known as:
NavHelper.

Distribution:
Known to be bundled with CD-burning application burn4free, and screensavers from mvr.us.

What it does:
Security issues:
Yes. NavExcel can download and execute arbitrary code from its controlling server www.navexcel.com (as an update feature).

Stability problems:
None known.

Removal:
Go to Add/Remove Programs in the Control Panel, choose the 'NavHelper' and click 'Remove'. Restart the computer

Spybot S&D also removes it.

hmm.. I don't know what to say... continued my search for a solution to the problem and my browser landed at this adress: http://www.annoyances.org/exec/show/article04-107
when I followed the instructions and my computer had completed the reboot I couldn't believe my eyes.. msn, windows update and all the former blocked sites was again availible... one little registry entry could cause so much harm here... must check the other computers in the network for spyware now I guess..

thanks anyway for trying to help me.. let's hope this will help some others maybe having the same problem


//Micke

quote:

---

Originally posted by Kingen999
hmm.. I don't know what to say... continued my search for a solution to the problem and my browser landed at this adress: http://www.annoyances.org/exec/show/article04-107
when I followed the instructions and my computer had completed the reboot I couldn't believe my eyes.. msn, windows update and all the former blocked sites was again availible... one little registry entry could cause so much harm here... must check the other computers in the network for spyware now I guess..

thanks anyway for trying to help me.. let's hope this will help some others maybe having the same problem


//Micke

---

I have no idea what evil thing caused this.. but when I've enjoyed my triumph enough I'll check the other computers in the house for spyware.. if I locate that navexcel or what it's name was then we know.. Or maybe another thing spybot found in
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
called "DSO Exploit".

Otherwise I can't remember any specific thing I did yesterday which could cause the missing (maybe not was there before but it sure helped) registry entry...


Edit: Yup, found the same dso exploit at another computer... and did the MTU-thing at a third and just as here, it worked instantly after reboot...

quote:

---

Originally posted by Kingen999
I have no idea what evil thing caused this.. but when I've enjoyed my triumph enough I'll check the other computers in the house for spyware.. if I locate that navexcel or what it's name was then we know.. Or maybe another thing spybot found in
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3
called "DSO Exploit".

Otherwise I can't remember any specific thing I did yesterday which could cause the missing (maybe not was there before but it sure helped) registry entry...


Edit: Yup, found the same dso exploit at another computer... and did the MTU-thing at a third and just as here, it worked instantly after reboot...

---

no, at least I didn't find it... So the chance is big that it was the dso exploit which caused it.. But can't be sure... And when I google for it I can't find any connection between dso exploit and msn messenger/win update, hotmail or that registry entry..


//Micke

u should download SPYBOT SEARCH & DESTROY .. its good at finding DOS Exploits

There's a lil freeware tool outthere that i've been using for quite some time now. It protects against these kinda exploits.

It's called DSOstop2:
More (detailed) info and download here

sounds good...

I got a mess at msn from a friend who remote controlled another computer at his work from home.. he was like "please help, I'm freaking out.. I can't connect to msn at home and I can't find any solution to the problem".. So I refered to the page with the solution.. And 10 minutes later he was online from home =)

So then I'm not alone in having this problem as I though.....

I don't know if this tool has been tested on networks (i don't have a network either), but from what's on the site it should be clear what it does. The site doesn't mention the specific key you had to alter to get your network going again.


DSOSTOP2 adjusts the following registry keys:


HKEY_CURRENT_USER,
"Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"

1001 and 1004


HKEY_LOCAL_MACHINE
"Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"

1001 and 1004

and optionally:

HKEY_CURRENT_USER,
"Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"

1001 and 1004

HKEY_LOCAL_MACHINE
"Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"

1001 and 1004

When protection is applied, the values of 1001 and 1004 are set to DWORD (unsigned long integer) 3. When protection is removed, these key values are reset to their default values of DWORD 0 per Microsoft default settings for the "Local Machine zone" (run automatically) and to DWORD 1 for the "Internet Zone" (PROMPT) ...

I know now there probably is no real connection between any spyware or virus and this error.. Today at school several of my friends who have the same isp as I told me that they had the same problem in the weekend.. And the ISP (which is local for this city and surrounding villages only) did an announcement of "difficulties to connect to msn on parts of the net" at their website yesterday...


//Micke

quote:

---

Originally posted by Kingen999
I know now there probably is no real connection between any spyware or virus and this error.. Today at school several of my friends who have the same isp as I told me that they had the same problem in the weekend.. And the ISP (which is local for this city and surrounding villages only) did an announcement of "difficulties to connect to msn on parts of the net" at their website yesterday...


//Micke

---