Posts by digitalocksmith

Not enough info!

You havent given us your motherboard specs!

You havent told us how you congfigured the new RAM editions (ie did you take out the old modules when you added the 512's or do you run them in combination / What DIMM slots do they fill etc etc)

"2 sticks of Centon 512MB DDR RAM" is not enough technical info for the new modules in trying to establish compatibility.....

Run this freeware program and give us more tech info on the above requests:
http://www.majorgeeks.com/EVEREST_Free_Edition_d4181.html

Regards

No IP addy allocated for Local area connection3? DHCP is not enabled.

Are you supposed to be recieving your IP addy dynamically or statically?

From the control panel:
Open "network Connections"
Right click on your local area connection3 and select "properties"
Scroll down and highlight "Internet Protocol TCP/IP"
Click on Properties
Is "obtain IP address automatically" checked, or is "use the following ip address" checked?

Can you also Open device manager and expand 'Network Adaptors'.
Hit the 'Print Screen' key on your keyboard.
Open Windows 'Paint' / click the 'Edit' tab on the top menu display and select 'paste'.

On the 'file' tab select 'Save As' and save the image to your desktop.

Open your browser, get on a free uploading site and upload the image.....
http://www.imageshack.us/

Copy and paste the 'hotlink for forums1' URL code into your post so i can have a look.

You say you have tried Winsockfix so that covers that area.

Also say you have run ipconfig/release.....what showed up?
Did it show the usual IP assigned to the ethernet.
Is the ethernet DHCP'd and when you run ipconfig/release with the ethernet cable unplugged does it behave proper on unplug? (ie. IP goes to 0.0.0.0.)

Have you also tried deleting the Local Area Connection and renewing the network connection....

Please also run through these TCP/IP stack repair options for XP with SP2.

Open a cmmd prompt with admin priv's again

Reset WINSOCK entries to installation defaults by running: netsh winsock reset catalog

Reset TCP/IP stack to installation defaults: netsh int ip reset reset.log

Reboot the machine.

Your logfile is clean and there's nothing untoward in there that should be stopping us.

Just an old remenant of the AVG8 uninstall that you can have HJT take out if you like

O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

This isnt affecting the current concerns though.

Dang this.....We must be missing something easy.
AVG7.5pro also has its own firewall built in, are you sure you have disabled it and ZA before attempting connection?

Personally, i would ditch AVG and use Avast Free edition available here:
http://www.majorgeeks.com/Avast_Home_Edition_d1968.html

I guess were not that concerned about an AV just yet as we cant even access the internet to get infected....lol

I think youve tried everything that comes to mind at the moment.....I gotta go to bed but ill think some more on this.

Try uninstalling AVG and ZA without installing anything else, Run CCleaner after the uninstalls and then attempt connection again.
http://www.majorgeeks.com/CCleaner_With_Yahoo_Toolbar_d5125.html
Dont install the crappy Yahoo toolbar though (unless you want it)

I assume your bypassing all routers etc and connecting the cat5e directly to your pute from modem(ie using the same physical setup connection that works on another system)

You can send a new log if you like and as long as your logged in as Admin, nothing else should matter.

I just saw something in your logs that i missed before.....your running AVG8 which is famous for its firewall blocking internet access.

Disable all AVG services (including firewall) from running in the background and see if this helps.

With Administrative rights go to C:\windows\, right click the system32 folder, select properties and clear the 'read only' chech box.
Click apply, then Ok!

By selecting the main System32 folder and making it read/write, Windows resets those folders back to their initial read/write status.

Then go through these steps again to try and initiate the SL service again:

Open a command prompt and run as administrator

Type: net start slsvc

If you do not have access to the Start button:

Click the option 'Access computer with reduced functionality' and a Browser should open, type: %windir%\system32 into the address field.

Find the file cmd.exe

Right Click on the cmd.exe and select Run as Administrator

Type: net start slsvc

You could also create a support request at http://go.microsoft.com/fwlink/?linkid=52029 for more assistance starting the Software Licensing Service......thats if you like dealing with tech support guys which is sorta like removing wisdom teeth with no anesthetic.

Regards

Please run HijackThis again and click "Scan".

Place checks next to the following entries in the code below and close all browser and other windows except for HijackThis, and click "Fix Checked".

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Brenna Jones\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O15 - Trusted IP range: http://195.95.*.*
O15 - Trusted IP range: http://195.225.*.*
O15 - Trusted IP range: http://216.236.239.193
O15 - Trusted IP range: http://216.236.239.195
O15 - Trusted IP range: http://216.236.239.193
O15 - Trusted IP range: http://216.236.239.195
O15 - Trusted IP range: http://216.236.239.193
O15 - Trusted IP range: http://216.236.239.195
O15 - Trusted IP range: http://216.236.239.193
O15 - Trusted IP range: http://216.236.239.195
O15 - Trusted IP range: http://216.236.239.193
O15 - Trusted IP range: http://216.236.239.195

On completion close HJT and reboot!

Looks as though the pre-existing Malware variants have added some IP ranges to your trusted pages. (Unless you put them there yourself?)

When it says that " Local Area Connection" speed is 10 mbps, this is refering to your network adaptor and has nothing to do with your internet speed contracted with your ISP.

Can you access the WAN (Internet) now?

If this doesnt work them im all out of ideas!

So you can check whether the Software Licensing service is running and start it if it’s not already running, and ensure the service is always started up in future, try the following:

Click Start and type Services or services.msc in the search box and then click on Services under Programs section of the search results on top pane.

If User Account Control ask your permission to continue, click Continue. If UAC asks for administrator’s password, enter a valid password.

Scroll down the list to the service Software Licensing and double-click it.
In the properties window of the Software Licensing service, set Startup type to Automatic.

Click Start to start the service. If the status is already running, click the Stop button and confirm with Yes to stop the service. Restart the service by clicking the Start button.

Click OK to exit from Software Licensing’s Properties window and close the Services window.

Go to www.microsoft.com/genuine and click the Validate Windows button to re-validate Windows. If you have problem with system updates, re-initiate system update.

The Software Licensing service can also be started with command prompt on high privilege elevation mode with the following command:

net start slsvc.exe

Good Luck!

Lets have a look and see if there's anything lurking in your registry that shouldn't be!

Download a copy of HiJackThis and save it to a folder on your desktop.

Do a scan and save a logfile.

Post your logfile here......Download HJT latest version here:

http://www.geekpolice.net/freeware-downloads-f14/hijackthis-202-download-t1449.htm?highlight=hijackthis

Regards

Here's what I got when I ran genuine validation:

This copy of Windows did not pass genuine validation.

Either an unauthorized change was made to your Windows license or a software program installed on this computer is not currently compatible with Windows Vista.

Your problems derive from one of these issues.....If you haven't installed any new software lately that may have contributed to the issue, then your best bet is to contact Microsoft and run through a phone validation procedure with them.

If your copy of windows is still deemed non-genuine by MS, you probably need to have an urgent talk with the supplier of your system and find out why this is so. It could just be an issues with the suppliers Vista Retail licensing conditions affecting their ability to issue genuine keys.

Good Luck

I cant see any evidence of Malware infections in your logs??

Did you buy your Thinkpad T61 secondhand?

Either way there is no guarantee that the OS is genuine.

The server at MS sees your windows vista version as non genuine and has put your OS into what Microsoft term as 'Reduced functionality mode' This is why the control panel and various other functions are not available.

Nothing you can really do here except to validate your version of windows with a genuine key.

Regards

The BIOS is a setup program for your PC and is technically firmware encompassed upon the motherboard chipset.
To alter this firmware, we need to 'flash' the chip with the new setup program data.

What do you mean exactly?

Do you just want to configure the BIOS setup program, or construct your own program for the CMOS chip?

Regards

yeah.....quite an expensive exercise for no result!

P.S Guess it can only be soft related or bad sectors on the HDD

Test and repair them with freeware apps from here: http://3d2f.com/tags/hard/disk/bad/sector/test/

Good Luck with it dude.

Thats because the OS boot files are destroyed.

Use a PS2 keyboard and mouse to enter the bios on boot and configure it to boot from your DVD/CD drive and then use your install disc to boot from and reinstall windows.

You can try the repair console or a repair install if you like.....Go for a clean install if you have no important data on the HDD that you need to save.

Regards

If your not getting any error beep codes on start up, then the system is reaching and passing POST.

Im guessing the keyboard and mouse are wireless or USB?

If possible try using a PS2 interface and see if that will give you function to enter the bios.
Then boot from your install disc if able.

Overwriting unallocated drive space with the /w switch can be frought with danger if your unsure of exactly what your doing.

Remember that Cipher does not lock down the drive so its possible that you may have destroyed your windows install old chap!

Can you enter the bios on boot or even get to windows in safe mode?

CPU's either work or they dont....unless its heat related, its unlikely that they fail causing random shuts then allow start up later on.

I was going to suggest its possibly software related with either a corrupt OS, a buggy app install or Malware infection.

Have you tried a format and clean install of the OS?

But you sort of threw me with this

it does it right after leaving or within bios.

mmmm.....ok!

If bumping seems to be an issue i would probably double check that the CPU is seated correctly and the heatsink is secure.

This area can be very sensitive especially after a good thorough cleaning of built up dust etc around the socket.

If necessary, remove the heatsink and CPU from the socket, re-apply thermal paste and reseat correctly.

Double check that all RAM modules and expansion cards and power/data cables to all devices are seated correctly whilst you have the towers side cover off!

Regards

Its possible, but less likely in the event that you have already swapped it out......what makes you think its a hardware issue?

99.9% of random reboots are related to buggy software installs or Malware!

Another possibility is CPU overheating from a number of reasons, mainly being a huge dust build up around the heatsink and fan.

Take a look here and try some of the suggestions: http://ask-leo.com/why_does_my_computer_randomly_reboot_without_warning.html

Most likely a registry corruption by what you are saying but i would need to see the BSOD error code to tell what it is exactly.

If you are trying to install the OS then you need to set your bios boot order to boot from the Install CD......you are still getting a BSOD because your system is still trying to boot from your hard drives old windows install.

You could try a repair install if you have important data you would like to save however i would back this data up to disc/logical partition and clean install the OS if it were me.

To perform a repair install see: http://geekpolice.net/pc-tutorials-guides-and-faqs-f13/how-to-perform-a-windows-xp-repair-install-t540.htm?highlight=clean+install+xp

To perform a clean install (ie Wipe the hard drive clean of all data) see here: http://geekpolice.net/pc-tutorials-guides-and-faqs-f13/how-to-perform-a-clean-install-of-windows-xp-t539.htm?highlight=clean+install+xp

Good Luck

Yeah.....I dont think its possibly an issue with your ISP restricting access to the modem (although we all know how crazy they are becoming these days), its got to be an issue with the router and its command to forward that request (port) to a specific IP on the LAN (that of the host).

Are you positive that you have configured the router to forward the correct port to the local machine for these remote requests????
I think the port used by Remote Desktop is 3389 (I think its the same as terminal services).

Regards

Dont ask me how this matters or why, but i resolved a similar issue with remote desktop by making sure i created administrator user accounts on each PC and logged in with a password on boot.....bingo! it worked for me.

I was accessing my other systems from within my own LAN however so i guess you may need to have your hardware firewall turned off within the router to see if connection can be established this way even though you have it configured to forwarded the port.

The laptops NIC does not see the wireless network?

Have you made sure network 'broadcasting' is enabled within the routers settings?

Once you can see the WLAN and successfully ping the router from the laptop, it should be simply a matter of joining the LAN through entering the correct encryption key (providing you dont have MAC addy filtering also enabled)

No problem.....This is probably what i would do:

On the computer you wish to restrict WAN access for, open a command prompt (start>run>command for XP) and type in ipconfig/all and hit enter.

Note down the IP addresses of both the computer your on, and the also the routers IP addy over the LAN (should be 192.168.1.1 or similar).
Im also assuming the router is a wireless gateway (modem inbuilt)

Next open up your web browser (IE or firefox) and type the routers IP address into the address bar of the browser and hit enter.
You should now be staring at the routers interface log on screen asking you for a username and password.
login username: root
login password: OP3N

Once inside, you can configure the router to restrict IP addresses on the LAN to gain internet access.
I dont have any direct experience with your make of router and the interface setup will be different to my SMC, but you should find all you need to perform these functions with this PDF file manual for your iConnect Access 624 right here:

www.opennw.com/_pdf/624_38.x.x_Tech_Ref.pdf

Regards

The back up of files from your primary drive C are also infected.... The only thing i can think of is that this is causing infections within your clean install of windows on the C drive after a format.

What files are they exactly?
Music, video, photos, software??

You need to investigate this isssue

Hi i have a major problem, it started yesterday completely randomly.

what have you done dude??? Can you think back to when it began... Installed any new software or added any new hardware devices before the issue occurred? Downed any new files that you shouldnt have?

When things happen at random there is usually a reason why this is so.

I guess AOL is your email service. Hum; I would rethink this and move
my email account to the ISP.

AOL won the hearts of the Internet with free distribution of client software.
There current advertising is very persuasive. Personally, I would never subscribe
to AOL, when there are many good ISPs with much better service and far less
invasive client software. I highly recomment Earthlink. I ran a dial-up subscription
for years with them and only because I couldn't get DSL at my location, the
cable provider finally made digital cable a reality for me. When I disconnected
from Earthlink, I told them it was only because I could not he hispeed access.

More to your point.

AOL installs several processes:

* AOLSP Scheduler
AOLDial
AOLHostManager

the latter is a startup program which hooks your connections to the Internet.

You might like to see the the impact others are having from AOL.

MS KB Q165474 but it's dated Dec-5-2003 and relates downlevel software (IE < V5.01 and AOL 4.0)
but it does identify the usage of a PROXY

Try getting rid of AOL software completely and see if it resolves this.

AOL's browser likes being in control of connections.

Regards

You have a couple of options here:

The most obvious would be to configure the router to block Internet access for specific LAN IP's, whilst still allowing resource sharing over the LAN.

Another way if the router wont allow the above scenerio, would be to misconfigure TCP/IP settings on the computer you wish to restrict WAN access to with an incorrect gateway IP. Then computer's can't get to the Internet but can still access their local network. Just make sure the users don't have admin rights to change it back.

Regards

They are freely available if you know how to use google scru!

In fact, you can even make your own.

http://www.jspayne.com/download/democpl.exe

The malware is hiding itself when it sees the HJT executable.

You have not renamed the executable as required.

Refer again to post 4 please, rename the executable then send us a new log.

IMHO, McAfee is akin to Norton/Symantec in that its software is 'system hijacking' once installed and has its own inbuilt 'survival code' making it extremely difficult for users to disable, and even uninstall when they no longer want it......I have long been critical of these software developers for this and other reasons.
This is what would be contributing to the 'administrator privelage' messages as even though you are logged as admin, you need to run the files directly as admin to perform any changes!

In other words, once their software is installed on your system, they want you to keep it there and continue paying the necessary licence fees associated with it!

Obviously, the choice in software protection you chose to utilize is entirely your decision, but you will never find any of their products on my system when there are far better available, even as freeware!

This is simply my opinion, and as my wife keeps telling me, im not always right! hehe.

Anyway's, obviously you know that these services will need to be re-enabled for your firewall to operate correctly again. (Ensure that they are checked in both the msconfig startup and services tabs, if listed, and try returning the startup service to 'normal mode' in the general tab.
Dont worry too much about the fact that MsConfig lists them as unknown as this is fairly common amongst a lot of applications.

I have had a look at your log file …

Log file looks good, nice work Mike!

I see multiple infections gibbygoo!

Print out or copy this page to Notepad since you will CAN NOT have any of browsers open while you are fixing this and try to follow it as closely as possible taking it STEP by STEP.

Update your AVG Antivirus program,

Download Spybot Search and Destroy install it and UPDATE the program (Don’t run it yet).

http://www.safer-networking.org/en/mirrors/index.html

Download VundoFix.exe to your desktop. Ignore the AntiVirus warnings and download it anyway because you need to run it.... Wait on installation and running.

http://www.atribune.org/ccount/click.php?id=4

Download CleanUp and install it. Wait on installation and running.

http://www.stevengould.org/downloads/cleanup/CleanUp452.exe

Download following program CWSHREDDER. Wait on installation and running
http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe

Download About:Buster and save it to your desktop. When it has finished downloading, unzip the folder to your desktop as well. You should now be left with an aboutbuster folder on your desktop.Wait on installation and running.

http://www.malwarebytes.org/AboutBuster.zip

I would also recommentd that you download CCleaner. It is a great little program that I use every time I close my browser to get rid of temporary files. I usually just run the cleaner part every time I'm done with the browser.During the install there will be check marks for checking for updates which you should do.....Dont install the toolbars unless you want them so you can uncheck these boxes.
It is a very safe program and it is …

Lets see if any registry corruption within the OS may be inhibiting browser usage.

Download a copy of HijackThis and save it to your desktop in a folder.
Do a scan and save the HijackThis logfile. Do not remove anything.
Post your log file here. Link to HijackThis:

http://www.majorgeeks.com/Trend_Micro_HijackThis_d5554.html

Have you got enough space on the FreeAgent external to hook it up to the Gateway desktop (via USB) and copy the data you need of its internal drive?

Once this is done, then you could reconnect the FreeAgent to the lappy and copy the required data to its HDD or removable disc (DVD), thus enabling you to delete it from the external and freeing up your valuable space?

Its a bit of mucking around, but it will work.

You might also be better off just installing a new optical drive in the desktop (they are cheap these days) and ghosting an image or copying the data of the drive to disc/s rather than going through the extra hassle and expense of making an internal drive an external USB interface with enclosure simply for the purpose of retreiving data?

Your log looks clean so you should disable chkdsk from scanning c:/ at windows bootup.

Since your running XP, to do this open the command prompt (start/run and type command)

When the command prompt window opens type the command: chkntfs /x c:

Hit enter and reboot your computer

Download a copy of HijackThis and save it to your desktop in a folder.
Do a scan and save the HijackThis logfile. Do not remove anything.
Post your log file here. Link to HijackThis:

http://www.majorgeeks.com/Trend_Micro_HijackThis_d5554.html

Spyware programs usually encode dll's on your cpu.

mmmm.....lol!

I think you mean the registry!

did you see them in Task manager?

If so, did you kill them?.....if your having a problem just continue on and complete instructions ending with posting a new log and we will take it from there!

Other wise i will lose the state of your system order

Please run HiJackThis.exe again and click "Scan".
Place checks next to the following entries i have included in the code below and close all browser and other windows except for HijackThis, and click "Fix Checked".

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch

On completion, run HJT again and do a new scan, saving the log and posting it here again.

Does IE respond now?

Word of advice: Never keep important data on a flash drive only without backing it up somewhere else....these things are notoriously unreliable and can fail at anytime.
They should only be used for data transfer from one host to another!

Sounds like yours has bitten the dust.
If it wont work on other systems then we can safely rule out any issues with your USB connection i'd say.

Sorry dude, but i guess you have learnt a lesson with this.

Regards

OK good!

Now send me a HJT file so i can see whats still running.

Download a copy of HijackThis and save it to your desktop in a folder.
Do a scan and save the HijackThis logfile. Do not remove anything.
Post your log file here. Link to HijackThis:

http://www.majorgeeks.com/Trend_Micro_HijackThis_d5554.html

Good to see you using a software firewall but i cant see an Antivirus running on your system.
Do you have one installed?

Please run HiJackThis.exe file, do a scan, Place checks next to the below entries in the code and close all browser and other windows except for HijackThis, and click "Fix Checked".

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8B580E40-6B46-44C8-9E80-A5AD6E1D1035} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

After completion do another scan (new) and send my the log!

Glad DNS helped!

It should be plastered on the side of your case!

If you still have the OS installed, use this software to reveal it stored in your registry:

http://www.majorgeeks.com/Magical_Jelly_Bean_Keyfinder_d2612.html

Besides a couple of 'unknown' applications that i dont recognize as nasty and a few 'unkown' processes which seems ok to me, i cant see anything in your logs?

Do you know what these are?

C:\Program Files\RAM Def\ramdef.exe
C:\Windows\system32\qpijvqti.exe
C:\Users\Dave\Desktop\f-bot.exe

That executable in system32 worries me a bit but ive never seen it before? (might do some more research on that one unless crunchie can fill me in on it)

These items below are autoloading programs from the registry that i do not recognize as malicious(thats not to say they arent) Something to do with windows update in vista......
O4 - HKLM\..\Run: [Microsoft Windows Update] qpijvqti.exe

O4 - HKLM\..\RunServices: [Microsoft Windows Update] qpijvqti.exe

O4 - HKCU\..\Run: [Microsoft Windows Update] qpijvqti.exe

Apart from this your log looks fine!

If you like, try renaming the HiJackThis.exe to digitalfix.exe....rescan with it and post a new log.

Regards

thekashyap is right.....also remember that when buying RAM for your existing mobo, correct compatibility is also of upmost importance!

Some mobo's are very fussy about what manufacturing brands they will accept (let alone technical specs)

Good Luck

We are missing something here!

You need to be more specific and let me know each stage that your able to go through with the install procedure and then point out EXACTLY where it fails so i can get a better idea starting right from the beginning where you should be asked “Press any key to boot from CD..” press a key to do so.......

Download a copy of HijackThis and save it to your desktop in a folder.
Do a scan and save the HijackThis logfile. Do not remove anything.
Post your log file here. Link to HijackThis:

http://www.majorgeeks.com/Trend_Micro_HijackThis_d5554.html

Myself or another member will take a look at whats running on your system!