True Vector is part of ZoneAlarm. Could she have had two firewalls running? That would explain part of the problem.

Hmm I'll have to check on that... but even if she did she hasn't changed anything since we were able to connect. First she would disabled the PCGATE thing and then we would connect, and then after awhile she would get a message saying that the computer needs to reboot itself and it would start a countdown during which we were able to remain in contact. Then her computer would reboot. Today she just wasn't able to even connect to the internet at all and that's when she was getting the true vector message. Anyways, thanx for ur post. I'm aware this could be annoying as I can't provide very detailed info.

Ahh... the dreaded "countdown" sounds like the Blaster worm. There are so many threads here on that subject, it's hard to pick one for starters, so I will paraphrase myself from an earlier post:

That's probably the MS Blaster worm in action. It used the useless open service RPC on XP to install itself and do its dirty deeds. You will have to take several steps to fix it.

1. Go to Symantec and download-and-run the latest version of FixBlast, a free stand-alone tool to remove this worm.

2. Go to the Gibson Research website. Download-and-run the program Shoot the Messenger. There are other tools there, also.

Note: both these tools will fit on one floppy, so you can download them at a friend's house or computer store.

3. Make sure that all her XP patches are up-to-date.

4. Come back here and do a search on "Blaster" for more details.

5. She will likely also have to delete her System Restore files, as those have probably also been infected.

hmmm, thx for the heads-up! I got a question, well I got 2 questions:
I did a search for blaster on this board but I didn't know which post to look in so I'll just ask it here: Can my computer get infected with this worm by using messenger with her if my computer is all up to date? and #2: What are some good alternatives to messenger for videoconferencing? thx again I'll get her to look into it.

To give enough time to work with the MSBlaster bit, disable the RPC notify

To disable RPC Notification for your computer, follow the steps below:

1. Click the Start button, and then click Run.

2. In the Open box, type:

Services.msc

3. Click the OK button.
The Services window appears.

4. Scroll down the list of services and double-click the first Remote Procedure entry.
The Remote Procedure Call (RPC) Properties window appears.

5. Click the Recovery tab.

6. For each of the failure dropdowns, click to select Take No Action.

7. Click the OK button to apply the changes.

8. Exit the Services window by clicking the red X in the upper right corner of the window.



NOTE:

· This step does not remove the virus nor patch the system.

· The RPC Service Notification can be re-enabled after the recommended patches are installed to test for this vulnerability.

Ok, she hasn't been able to fix her computer yet, but my computer is all up to date so the last time we were using messenger I got her to start the application sharing feature so I could see her desktop. The app share thing took forever to start working and we were never able to connect. THEN all of a sudden a bunch of IE boxes with "This page cannot be displayed" kept poppin up and I mean they kept poppin up all over the screen and I couldn't stop them. Yikes. So I disconnected and tried to reconnect my internet but I couldn't. It told me my connection was working but I kept getting a "This page cannot be displayed" and if I started Messenger it told me that I couldn't connect because of a firewall. I only use the Win xp firewall at the moment. Anyways 10 minutes later my service seems to be working fine but all those windows popping up has left me a little worried. If my computer is up to date then can I get viruses by connecting to an infected computer over MSMessenger? I did a virus scan and it didn't find anything, except for a 158MB file from a game which I'm assuming is an error. Any help would be appreciated. 2 other things: When this happened I noticed a process called rsvp.exe running that I've never seen before. Also there is a process called dvpapi.exe running and I don't know where I got that virus scanner from. Thx.

OK! We found some viruses on her computer: msblast.exe. dllhost.exe were deleted and there are w32/lovsn worm and w32 nachi worm virus. But we forgot to turn off the system restore first and so I get her to go to turn it off but when she clicks on system in the control panel it opens for a second and then closes so she can't access system restore! What do you think is causing that?

do it in Safe mode !

o ya....