Posts by DaveSW

Can you describe your symptoms again, or is it still the same?

If you run trendmicro it should pick up the following in your log:
http://uk.trendmicro-europe.com/enterprise/security_info/ve_detail.php?id=65950&VName=WORM_SDBOT.AAR&VSect=T
http://uk.trendmicro-europe.com/enterprise/security_info/ve_detail.php?VName=WORM_RBOT.TX
http://it.trendmicro-europe.com/enterprise/security_info/ve_detail.php?Vname=WORM_WOOTBOT.CA

Edit: If you prefer to download trendmicro, download sysclean from
http://www.trendmicro.com/download/dcs.asp
and the latest pattern file from
http://www.trendmicro.com/download/pattern.asp

Instead of linking to the page with the information on it, you need to link to a new frameset page. Your frameset page will be the same as your index page, with the menu of your choice in the left, and the content in the right. You then have to set the target to be _top.
Other than that just use a javascript from google to update two frames with one click.

uk gallon is 4.54 liters.
US Gallon is 3.785 liters.

In the UK we now have a sort of half-metric system - we pay for fuel in liters, but work in MPG. we do miles not kilometers. Yes we're crazy.

So have you made any changes since your last hjt log? If so, post a new one, otherwise you'll have to wait for crunchie or someone to confirm.

Cheers Crunchie.
Since it doesn't appear to be anything running on your computer, maybe there's a fault in one of your drivers - try updating at Windows Update, check for new drivers for your modem etc.

Also your drive label should show up somewhere in properties.

For your other problems... you could try accessing the site with Mozilla Firefox or something www.mozilla.org
Can you try resetting your security settings in tools -> options -> security?

well I can't actually locate theh pages you are referring to, but have you remembered to address it with target="_top"? otherwise it will attempt to open your new frameset in the current frame.

no idea but I'd suggest you run stinger to make sure you didn't have it on your system when you updated...
http://vil.nai.com/vil/stinger/

luckily my car does 43mpg (that's a uk gallon....)
I probably shouldn't ask what yours does..

hmm sorry about that. Actually I was hoping for an expert like Crunchie to look at the Hijackthis log.
Did you make that log as admin?
The other things you might try are the trendmicro online virus scan:
http://housecall.trendmicro.com/
and Panda
http://www.pandasoftware.com/activescan/

But I've a funny feeling that whatever is causing your problems may not allow you to go there either.

is that per gallon?
if so $2.04 is £1.11
1 US Gallon = 3.785 liters
£1.11 / 3.785 = 0.29326
So you pay £0.29 per liter

Cheapest price in my area of uk is £0.815

So just be grateful!! :evil:

lol I looked at it and thought there had to be a UK equivalent! Turns out I'm using the cheapest one anyway...

ah well. In that case perhaps you could make some new ones for microsoft...

Can you post the latest log please?

uk: http://www.aapetrolbusters.com/

I like it, but could you improve the icon quality?

personally I wouldn't use frames, I'd just integrate them into one page, but...

You either need to create a new frameset page with links to your color-co-ordinated menu and content, and then link to that instead of the content page, or use a javascript event to update both frames. Note that users with javascript disabled will then find your site totally inaccessible.

Do you use a proxy server?

real.com is the real media player. The only thing that looks odd to me now is the ????????? in the 04 washindex entries. Usualy it displays the user name.

I think Crunchie means that only that one of the 016 entries needs to go. So the 04 entry needs to go.

With the restore point, I would normally turn off system restore to remove the virus. However this will leave you without a system restore point, so you can probably turn it off and then turn it back on again, and create a new system restore point on your hopefully clean pc.

2 in a row! I'm on roll here! lol
Cheers for that Crunchie.

Crunchie, this is my guess. How close am I?
Joal, please wait for Crunchie or another expert to confirm this before proceeding.

This entry: O4 - HKLM\..\Run: [VVSN] C:\PROGRAM FILES\VVSN\VVSN.EXE
appears to be malware.
http://www.liutilities.com/products/wintaskspro/processlibrary/VVSN/
Check the box next to it, reboot in safe mode by pressing f8 during booting, and delete the folder VVSN in your program files.

Crunchie, this is my guess. How close am I?
Complete Novice, please wait for Crunchie or some other knowledgable person to repsond here before following these instructions.
Check the following:
O4 - HKLM\..\Run: [winupdt] RUNDLL32.EXE c:\windows\atmupdate.dll,_mainRD

O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - http://toolbar.isearch.com/general/drm.cab

if you're not a gamer then take these off too:
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://http.gamezone.tukati.com/tuk...0.20/tukati.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab

or dial up a conection on AOL, open Internet Explorer or another browser and try downloading from that.

There's quite a few things in there, so I suggest you try a few of the downloads listed here: http://www.daniweb.com/techtalkforums/thread5690.html

In particular, Adaware, Spybot, CWShredder & trend micro house call. The other tools could also be useful, but it depends whether you're on broadband as to whether you'll want to download them.

Then post a new HJT log. Oh and btw, there is a newer version of HJT, so if you could update that too that would be gr8 :)

If neither of those works (wait for a senior member of the forums to confirm this post BEFORE you follow these instructions)
Check the box next to this: O4 - HKLM\..\RunServices: [Media service] msn64.exe
Then reboot in safe mode, search for msn64.exe and delete it.

Have you updated your antivirus? You should probably try an online scan with
http://housecall.trendmicro.com/
and
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Also please could you move Hijackthis to a permenant directory so that it can make backups. (Currently it's in a temp folder).
Cheers
Dave

This is my guess. Wait for Crunchie or someone knowledgable to confirm it/tell me what I've missed before proceeding. (I'm currently practising till one day I'll be as knowledgable as them. Unlikely but there we go!)

alt+ctrl+del and kill C:\Program Files\eMusic\eMusicClient.exe (the process).

Then fix the following:

F3 - REG:win.ini: load=????????????????????????
O2 - BHO: F1 Organizer Class - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\system32\ATPART~1.DLL
O2 - BHO: InstaFinder - {4E7BD74F-2B8D-469E-DCF7-F96DA086B434} - C:\WINDOWS\DOWNLO~1\instafin.dll
O2 - BHO: Search404 Class - {53C330D6-A4AB-419B-B45D-FD4411C1FEF4} - C:\Program Files\404Search\404Search.dll
O4 - HKLM\..\Run: [eMusicClient Systray] C:\Program Files\eMusic\eMusicClient.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: Run Time.exe
O9 - Extra button: 50 FREE MP3s! - {686C970F-1D7D-4469-85D1-4B35763B56CC} - http://www.emusic.com/?fref=149031 (file missing)

Then boot in safe mode by presssing the f8 key during startup, and delete:
C:\WINDOWS\system32\ATPART~1.DLL
C:\WINDOWS\DOWNLO~1\instafin.dll
C:\Program Files\404Search\404Search.dll

Before doing this open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
[REVERSE THIS PROCESS AFTER YOUR CLEAN!!]

Limewire: well... if we're talking tact and diplomacy, then on the basis that it seems not to have done any damage so far you could leave it. On the other hand, it's like leaving your kitchen window open at night. Just because no-one's broken in that way yet doesn't mean no-one will in the future... So personally I wouldn't have it on my pc. If he really likes it though, tact and diplomacy might just say forget about it. You know your brother, I don't. ;)

I'll quote this from another forum I found:

why remove limewire ?
read this about a limewire user :

A lot of freeware are bad for your computer security, particularly those peer-to-peer programs like KaZaA, LimeWire, and Morpheus. These programs often install additional unwanted components such as "SpyWare". These components often remain in place even after the Peer-to-Peer program has been removed.

This happened to be because I was a music glutton. I downloaded LimeWire 4.07 and installed on my Windows XP. At first, this app seems to be quite promising fro what I wanted as a free music getter as it allows you to search for multiple files at the same time, music and programs. The sin caught up with me faster than light. I noticed that once I logged on to my DSL connection, my computer would keep sending and receiving several megabytes of packets. Making my system virtually slower than a 28.8 connection. I got quite paranoid because I …

hmm a couple of things concern me but hopefully a true expert will be along soon.

Do you use Sun Star Office? because this file C:\WINDOWS\SOINTGR.EXE is supposed to be in the sun staroffice folder, so it could possibly be a virus, but DON'T delete it yet just in case!

Also the limewire entry is p2p software that is a potential security risk - do you use it?

And after that I'm not sure about the nameserver entries - hopefully someone knowledgable will be able to help you out here.

Your problems could be due to a virus/malware of some kind that isn't detected by anything you have. Do you keep them all up to date? If yes then maybe the problem is a driver fault, if not then you need to.

In any case, if you download hijackthis, ( http://www.spychecker.com/program/hijackthis.html ) it will take a snapshot of your running processes and what's going on in your pc.
Unzip it to it's own folder on a permenant directory - e.g. your my documents folder, run hijackthis, click 'scan', then 'save log' when it's done, then paste the contents of the file it creates in here. Hopefully one of our experts will then be able to tell us if you have a virus.

Please DON'T fix anything yet - the log is a complete snapshot of your system, so most things will be legitimate.

Do you have any firewalls that could be blocking internet access?

download hijackthis http://www.spychecker.com/program/hijackthis.html
unzip it to it's own permenant folder somewhere you'll be able to find it.
run it, press 'scan', then 'save log' and paste it in here.
We will then know if you have a virus.

Don't fix anything with it unless told to do so by a more knowledgable person because almost all of the entries will be legitimate...

you might also want to go to the add/remove programs thing in the control panel and see if it's there.

no probs. once you know how to find things like that then you're away.

np :)

in that case check out the google results - you should be able to find something close to what you want.
http://www.google.com/search?q=free+php+counter

do you have a server side langiage available on your server? like php?
if so: http://www.promosi-web.com/script/guestbook/
or just google it: php guestbook script.

Do you have a server side language like php or asp available on your server?

http://webdevfaqs.com/javascript.php#popup

The base code is

<a href="http://www.webdevfaqs.com" onclick="window.open(this.href,'child','width=600,height=400,scrollbars=1'); return false;">Open popup</a>

and all the parameters you can change are listed on the link above.

uh... the point is Alc is looking to get spyware so he can analyse the effectiveness of different programs etc...
I'm sure Alc doesn't need any help with his Hijackthis log...

lol that's Norton for you...

You use a html editor.
Personally I use html-kit from www.chami.com, but if you want a wysiwyg interface (if you can't be bothered or just don't have time to learn html) then you can use Dreamweaver, Frontpage etc.
I'd reccomend you learn html from www.w3schools.com.

No problem... which solution did you opt for?

w3schools.com are pretty good.

Personally I'd say there's too many graphics - slow loading.

try editing your form tag to look like:
<form onsubmit="this.onsubmit = new Function('return false');">

or for the one that changes:
http://www.rgagnon.com/jsdetails/js-0110.html

or alternatively:
http://www.eggheadcafe.com/PrintSearchContent.asp?LINKID=98

you need to get a boot disk, that will enable you to boot to a DOS prompt.
Other than that your manufacturers diagnostic tools will often be a boot disk by themselves.

any funny noises from it?
have you tried the diagnostics tools from the manufacturer?

run hijackthis, click scan, save log, and then paste it in here.

http://www.spychecker.com/program/hijackthis.html

It sounds more like a hard drive failure though.

ok some links anyway:

Directory: http://www.webcom.com/html/icons.shtml

Other links:
http://www.iconbazaar.com/
http://www.iconarchive.com/
http://www.iconfactory.com/
http://www.webdeveloper.com/animations/