Posts by DaveSW

You appear to have a lot of nasties in there. I'm talking worms and stuff, not just a browser hijack.
So probably the best place to start is to go to http://www.trendmicro.com/download/dcs.asp and download sysclean, and this page http://www.trendmicro.com/download/pattern.asp for the latest pattern file.
Unzip the pattern file into the same folder as sysclean, then run sysclean. It will take a while but hopefully will remove some of those worms. Make sure it's in a user area with administrator priviledges.

no problem ;)

wait for casperjack to confirm this but I think it's
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
Don't know whether that's related to your problem though

he's using a text area, a type of input box, which is a form element.
You can use a td cell, a div, a p, or whatever in the same way.

tbody is for grouping td tags.

The TBODY element defines a group of data rows in a table.

so in a data table, your column headings would be in a thead tag, the main body of the td cells in a tbody, and the footer info in a tfoot tag. Or something like that anyway.

lol I think it works better in Firefox than in IE!

Can you move hjt to a permenant folder please (i.e. one not in a temp directory). Otherwise any backups may be wiped out.
Then reboot and post a new log, making sure all other windows are closed.

Incidentally are you running all your scans from an administrator account?

Can you update to the latest version of HijackThis, reboot and post a new log please? current version is 1.98.2

You can either use the update feature in Hijackthis or re-download from http://www.spychecker.com/program/hijackthis.html

go here: http://www.chami.com/html-kit/services/favicon/
choose your image, upload it and follow the instructions.
you may also want to visit www.favicon.com

any screws loose?

But if you ever use the 'recent documents' things then you probably don't want to clear them...
;)

did this link have anything to do with this question?
http://www.blackviper.com/AskBV/XP25.htm

When you say 'a certain program' does that mean you can't tell us what it is?

I've just emailed you for your addy.
Tell me, what exactly have you done to get your log that short?

Well it is primarily intended for detecting browser hijacks, but the log it provides gives us a list of all the running processes and also all the autostart entries, so there's usually a good chance of spotting processes (including viruses) etc that shouldn't be there.

can you post a hijackthis log? see link in my sig.
That will tell us what processes are running, which hopefully will be a better way to identify the virus. Assuming ofcourse that it is a virus!

Download hijackthis to a permenant directory, run it & click scan. When it's complete click 'save log' (the scan button changes into it) then post the contents of the file it creates in here. Hopefully an expert will then be able to help.

lol no problem ;)

it validates in xhtml 1.0 strict.

Also http://www.htmlhelp.com/reference/html40/tables/tbody.html
It refers to needing 'one or more' tbody elements in a table.

So I guess you can.

edit: see also http://www.w3.org/TR/html4/struct/tables.html#h-11.2.3 - which also refers to one or more

tiny --> tim

I think:
<thead> is all the column headings, i.e. the first row of most tables
<tbody> is the data under those headings

so technically if you need two tbodies then you must have changed column headings, which technically is another table.

Or wasn't that what you had in mind?

If you use a png for clipart or logos you can get file sizes smaller than gif with a custom palette. e.g. for a logo with a small number of colors reduce the number of colors and choose custom palette. Then you have smaller file sizes, plus better color representation.
I think there's a 30day free trial of psp on www.jasc.com

Personally I use css not tables for layout, but similar principles apply.
Because you can't say how big a persons screen will be, there is no one no. of pixels that can be defined as the screen width. Hence if you set the width of the side columns in pixels you can allow the center column to expand without altering the width of the others.
Does that help you at all? if not then you might want to show us the page you're working on - upload or zip.

Could you just use a simple javascript one? http://www.alistapart.com/articles/imagegallery/

Using PSP then you'd use the 'smart' resize rather than the pixel resize. I don't know what the equivalent is in Photoshop.
You might also want to try using a png file as it would be smaller.

Is that your entire log after a reboot? Not in safe mode? logged on as admin? it's gone to the other extreme now of being incredibly short... ;)

That log is a real mess... I don't know whether it's related to your problem, but you're still going to need to get it cleaned up. So I guess we might as well see if we can make Crunchie or some other knowledgable person's job easier.

1) Uninstall Kazaa. It installs tons of 'extra' utilities with it.
2) Download and run some of the utilities in the 'helping yourself' thread at the top of this forum. Particularly Adaware, Spybot search and destroy, stinger & trend micro's online scan. Also check if your virus definitions are up to date.
3) Reboot and post a new log.

no problem! I think you get it, but just to clarify:

URL(graphic.gif) - uses file graphic.gif located in the same folder as the page.
URL(folder1/graphic.gif) - uses the same file but this time the image is located in a subfolder called folder1
URL(http://www.website.com/images/graphic.gif) - uses the same image but absolutely referenced from the ficticious site, website.com.

I think you realised that afterwards, but anyway. ;)

Download Sysclean from:
http://www.trendmicro.com/download/dcs.asp
and the latest pattern file from:
http://www.trendmicro.com/download/pattern.asp

Unzip them into the same directory and run them. This will take a while. You have a number of worms which it should remove.

After that there are some other mostly minor problems, so post a new log when it's done.

if you put the code in my last post into the head section of your page then it will put the image in the top left as a background. you will then just need to make sure your table lands in the right place on top.

I seem to remember having your dilemma myself a few years ago, so maybe this workaround will help. It depends how familiar you are with the code etc.

for the table cells that you want a background on, use an inline css style:

<td style="background: url(graphic.gif);">

you may want to add additional controls such as

<td style="background: url(graphic.gif) repeat-y;">

- This will tile the image down the cell. change y to x for the horizontal equivalent.

if you think of anything else you might want to do with it, just ask. Ultimately your best solution is to use css for your layout instead of tables, but hey, you've got to start somewhere!

I'd use the css and no slicing. Actually that's a lie. I'd use css tiling and a 1px gif, backed up by a secondary div with a background for the header. But in your case, try the first option:

<style type="text/css"><!--
body { background: url(graphics/image.gif) 0 0 no-repeat; }
--></style>

Or if you want an insight into what I was talking about with slicing, then check out www.tollgatesecurity.co.uk/main.php

well by fiddling around with services I managed to screw up a computer, wheras I've never had any problems after using msconfig. That's why I use msconfig anyway...

:lol:

Download a copy of firefox from www.mozilla.org and see if you can access them using that.

Check out the manual instructions on this link and see if the files and processes exist.
http://www.spywareguide.com/product_show.php?id=640

Also note that spybot detects some things that adaware doesn't, so they are in fact complimentary programs.

You may also wish to post a HiJackThis log (see link in my sig) for an expert to analyse. Please note it is a snapshot of your system, hence most of the entries will be legit, so don't use it to fix anything unless instructed to do so by an expert.

Looks like these 5: check the boxes next to them, select fix checked, then reboot and post a new log. You may want to wait for someone else to confirm this before you do it.

F0 - system.ini: Shell=
O9 - Extra button: Short Message - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_linjian123_9220 (file missing)
O9 - Extra button: Instant Messenger - {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} - http://cn.rd.yahoo.com/home/messeng...nger.yahoo.com/ (file missing)
O16 - DPF: {30000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com...N14006/thin.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} - http://download.websearch.com/Dnl/T_50038/QDow_AS2.cab

np - you won't regret learning css

You appear to have a worm, and a number of other nasties that will require a genius to sort out. Hopefully Crunchie will be along soon... lol
In the meantime try using housecall to fix that worm: http://housecall.trendmicro.com/
You may also wish to scan with Panda http://www.pandasoftware.com/activescan/

cool :cool:
Congrats

you either need frames or overflow:auto on the css property of a div

you need to use the css height or line-height properties. If you're familiar with the source you can use
<h1 style="line-height: 1em; height: 1em;">Heading 1 or other element</h1>

200x200 pixels? Can you just set the canvas size?

sounds like a virus to me - it should be dxsetup.
Can you post a hijackthis log? see link hopefully now in my sig.
Download to a permenant folder, run it, choose scan, save log, and paste the contents of the file in here. Do not fix anything yet as most of it is legitimate - it's a snapshot of your running processes.

I'd suggest you post a hijackthis log.
http://www.spychecker.com/program/hijackthis.html
Download, save it to a permenant folder like C:\hijackthis, then run it by double clicking the icon. Click scan in the bottom left. When complete the scan button will change to a 'save log' button. Click it, save the log somewhere you'll be able to find it, then paste the contents of the file in here.
NOTE: Do NOT fix anything yet. This is a snapshot of your system, so most of it will be legitimate.

Well firstly check your proxy settings are correct in the log. The reason I asked the qestion was because if you weren't using one that could have been the source of your problems.
After that, there don't seem to be the usual IE homepage entries in your log. Which is strange. And I have no idea why. Do you use IE regularly?

DaveSW
This is an application that I believe came with a satellite ISP that I did not completely get rid of after discontinuing their service. The actual despcription is Webcast Proxy server.

Thanks for your interest.

I see. there is a trojan of the same filename, but that usually resides in the system32 folder, so I thought this had to be legit.

You could try going to add/remove programs and see if there's any strange entries there, but as crunchie says, it should be under the 04 section if it's loading it.

np. let us know how you get on.

Do you know what C:\PROGRA~1\DIRECWAY\bin\dpcproxy.exe is?

Firefox is available from: http://www.mozilla.org/products/firefox/

However, if someone breaks in through your front door, you don't just stop using it and use the back door. Similarly, I strongly reccomend getting the problem fixed properly in accordance with dlh's instructions (those currently there and those that will follow).

/* Form elements */
input.first, textarea.first, select.first {
border : 1px solid Black;
background-color : #CCCCCC;
color : #0E1930;
font-size : 12px;
font-family : Verdana, Geneva, Arial, Helvetica, sans-serif;
font-weight : bold;
height: 2em; /* replace 2em with your chosen value, in px or whatever */
}

Can you post a new log please?

Try this link:
http://javascript.internet.com/navigation/load-two-frames.html

See how you get on with it. It's fairly simple, but let me know if we can help at all.