Posts by dlh6213 - Page 34

It's a tower (http://www.daniweb.com/techtalkforums/thread18368.html) :)

Hi, since you mentioned you just got this laptop, I thought you might be interested in reading this:
http://www.daniweb.com/techtalkforums/thread16365.html

Now, to fix your problems. First, go to Add/Remove Programs in your Control Panel and remove (if found):
Admilli Service (or anything "Admilli)

Scan with HJT and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R3 - Default URLSearchHook is missing
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Admilli Service] C:\Program Files\Admilli Service\AdmilliServ.exe
O4 - HKLM\..\Run: [ckwjal] c:\windows\system32\ckwjal.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/C.../bridge-c11.cab

Close all windows other then HJT before hitting the fix button

Reboot into Safe Mode and delete the highlighted file or folder (if found):
C:\Program Files\Admilli Service
C:\WINDOWS\System32\ckwjal.exe
C:\WINDOWS\systb.dll
C:\WINDOWS\web\related.htm

Reboot normally

It looks like you're running …

MSI, ASUS, Intel, and ABIT are all good motherboards; my personal preference is ASUS.

First of all, it's best if you keep SP2 (I'm assuming this is the upgrade you are talking about) and try to resolve whatever problems you are having. Look through this thread and see if there are any solutions you can try:

http://www.daniweb.com/techtalkforums/thread10031.html

If there are other specific questions/problems, let us know and perhaps we can help.

If you decide you really do wish to uninstall SP2, reboot into Safe Mode, go to Add/Remove Programs in your Control Panel, and remove it.

O2 - BHO: Search Toolbar BHO Object - {2CF0B992-5EEB-4143-99C0-5297EF71F443} - C:\WINNT\system32\stlbdist.DLL --
http://startup.iamnotageek.com/srch-rundll32exe%20stlbdist.DLL,%20DllRunMain.html -- Have HJT fix this

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=66.20.12.225:80 --
http://ws.arin.net/cgi-bin/whois.pl -- If Bell South is not your ISP, have HJT fix this

The ones you mentioned that have "no name" or "file missing" can be fixed with HJT

All the O16's can be fixed as well, if they are legit, they will come back next time you visit the site.

Scan with hijackthis, check the noted entries, close all windows other than hijackthis, and hit the Fix button.

Does your power supply have enough oomph for your video card?

How much RAM does your system have?

You should go to Windows Update to get the Critical Updates for your system. Hold off on SP2, however, at least until your system gets cleaned up.

You will need to clean out all your temporary folders, but before we give you instructions on doing this, you need to move hijackthis to a permanent folder, you now have it in a temp folder and will lose it if you clean them out now.

If you're not sure how to put it into a new folder, go here for a self-extracting version that will put it in the Programs Folder:
http://www.merijn.org/files/hijackthis_sfx.exe

After you get hijackthis in a permanent folder, close all browser windows, scan with hijackthis, and post a new log please.

Close all browser windows, scan with HJT, and post a new log please.

Instead of just adjusting the Settings, you should 'Customize' your ActiveX settings.

The easiest way to get to your ActiveX settings is to Open Internet Explorer, click on the Tools tab, click on Internet Options, click on the Security tab, and then click on the Custom Level button. You will see several options for different settings, go down the list and make the appropriate changes, for example:

This is how I have my ActiveX settings; you can use this as a guide to set your own (If you Enable all the options, you are leaving your system open to unwanted intrusions.):
Download signed ActiveX controls -- Prompt
Download unsigned ActiveX controls -- Disable
Initialize and script ActiveX controls not marked as safe -- Disable
Run ActiveX controls and plug-ins -- Enable
Script ActiveX controls marked safe for scripting -- Enable

The more of these you have Disabled, the safer your system is, but there will be sites that you can't access. Prompting is the next best thing, but constantly clicking OK can be tedious and you usually don't know whether it should be allowed or not. The described combination works best for me, but not be best for you -- it is just shown as a reference.

Hope this helps!

First, you need to remove Newdotnet, either from Add/Remove programs in your Control Panel, or go here and scroll down to the uninstall tool:
http://www.newdotnet.com/#remove

Second, go here to get hijackthis:
http://www.merijn.org/files/hijackthis_sfx.exe

Next, close all browser windows, scan with hijackthis, save the log, copy and paste it here in this thread.

Hi Carol, I hate to say this, but hijackthis is still in a temp folder -- but, since there doesn't appear to be anything bad in your log anyway, we can get that straightend out later.

Can you answer the question DMR asked earlier about wmedia.exe:
"At exactly what point do you get the error about the missing wmedia.exe file?"

Also, did the link I gave to Norton help with that error message?

lotion ---> hand

another message pop up on my screen:

automatic LiveUpdate error:
LU1861:
liveipdate has detected problem with the task scheduling service on your computer, this problem may prevent auto live update from running. (what should i do, my computer just fall of a part)

Information on this from Norton:
http://service1.symantec.com/SUPPORT/sharedtech.nsf/7e7f15291a25d938882567e50048a048/18e2977c4ea399d388256ecb0063f0da?OpenDocument&src=bar_sch_nam

By the way, you still have hijackthis in your temp folder.

ice--> chills

chills ---> spine

Hey, here's some help so if you do need to reinstall it (hopefully) won't be such a nightmare!

http://www.daniweb.com/techtalkforums/thread6632.html

...you should go to the Windows Update page on Microsoft's site and download the most current critical fixes for your system...

I was just going to recommend that! :) Have you done this yet?

Also, have you run CWShredder 2 yet?

After you've done those two things, scan with HJT and post a new log please.

Oh, by the way, what version of Xoftspy do you have? Versions prior to 4.0 give false positives in order to get you to buy it.

Close all browser windows, scan with HJT, and post a new log please.

HJT should be able to fix your BHO; remember to close all windows other then HJT before hitting the Fix button.

This link has complete instructions for manually deleting ShopAtHome (SAH):
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076082

Before you follow those instructions, do these two things:

If you plan to edit the Registry, you should make a backup before making any changes. At the top of the Registry window, click on the Registry menu, click Export Registry File. In the Export range panel, click All, then save your registry as Backup.

Download LSPfix from here:
http://computercops.biz/zx/phoenix22/LSPFix.zip (in case you lose you internet connection)

Hmmm, you shouldn't have anything related to Freshbar then, so I don't know why it's showing up in your scans; what are you scaning with and where does it say it's located?

Do a search for msi.dll and give us all the locations found, there should be at least one, but there may be more.

(Link to original thread: http://www.daniweb.com/techtalkforums/thread18068.html)

I know you don't really want to reinstall, so do this so we can see exactly what you have -- get Hijackthis from here:

http://www.merijn.org/files/hijackthis_sfx.exe

Close all browser windows, scan with hijackthis and save the log. Copy and paste the log here in this thread.

Did you try the release & renew suggested by Alex?

See if this helps:
http://support.microsoft.com/?kbid=101096&sd=RMVP

Is your CD dirty or scratched?

Lose your calculator or sound recorder after getting SP2? Check this thread:

http://www.daniweb.com/techtalkforums/thread18160.html

snmpapi.dll is a system file (http://www.liutilities.com/products/wintaskspro/dlllibrary/snmpapi/)

Go here:

http://forums.skads.org/index.php?showtopic=80

Get the file that is attached in post #3 (remv3.zip)

Unzip the remv3.zip files to a permanent folder and run it in SAFE MODE ONLY.

Then, after rebooting, post the results from c:\log.txt.

Virus creators often make files that resemble legit ones in order to make them harder to detect. Sprestrt.exe is legit; quote from Microsoft: Sprestrt.exe, which runs at the start of GUI mode, determines if GUI mode ran previously and failed. If so, Undo_Guimode.txt is used to bring files back to the state appropriate for the beginning of GUI mode.

sprestrst.exe and rdspclips.exe are pests.

Here's some info about prefetch:
http://techrepublic.com.com/5100-6270_11-5165773.html?tag=e064

Caperjack, I think Natasha was referring to the links in your signature (though I could be wrong about that)

DMR, I agree with you about the Windows ME! :)

Tasha, a trip to Window Update may help, it will at least get you the Critical Updates for IE to help prevent unwanted intrusions. You could also try reinstalling Word. And, if you haven't done so already, backup all your important files! Then if your drive does fail, at least you won't lose the stuff you want to keep.

You can also get updates for software, that may help too. Here is a link to the US page, but you will probably need a different one:
http://office.microsoft.com/en-us/officeupdate/default.aspx

O4 - HKCU\..\Run: [BPK] C:\PROGRAM FILES\PERFECT KEYLOGGER LITE\BPK.EXE
NO.....I downloaded that for my personal use. Any other suggestions?

I have a question, why do you have a keylogger?

Unzip the remv3.zip files to a permanent folder and run it in SAFE MODE ONLY.

Then, after rebooting , post the results from c:\log.txt.

The only thing I see in your log that you may wish to consider has to do with CTHELPER.EXE -- quote from sysinfo:

CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative’s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it.

Oh by the way can any of you recommend any antivirus software.

Here are some discussions on antivirus programs here at DaniWeb:

http://www.daniweb.com/techtalkforums/thread17349-nod32.html

http://www.daniweb.com/techtalkforums/thread12883-nod32.html

http://www.daniweb.com/techtalkforums/thread3330-nod32.html

Hey Turnip, you may want to have your parents read this as it's kind of related:

http://www.daniweb.com/techtalkforums/thread16365.html

You can find Hijackthis tutorials at these sites (and more if you do a google search):

http://hometown.aol.co.uk/jrmc137/hjttutorial/tutorial.htm
http://hjt.wizardsofwebsites.com/
http://www.bleepingcomputer.com/forums/index.php?showtutorial=42
http://www.spywareinfo.com/~merijn/htlogtutorial.html

By the way, I don't see anything bad in that log either, but since XP is where you are having problems, that is where you need to scan with HJT.

Hey Michael, to help keep your system clean, get SpywareBlaster and SpywareGaurd; links to both can be found in this thread (along with other helpful advice and tools):

http://www.daniweb.com/techtalkforums/thread5690.html

Go here:

http://forums.skads.org/index.php?showtopic=80

Get the file that is attached in post #3

Then get Hijackthis (as Caperjack suggested) from here:

http://www.merijn.org/files/hijackthis_sfx.exe

Close all browser windows, scan with hijackthis, save the log, then copy and past it here.

Go to Add/Remove Programs in your Control Panel and remove (if found):

MYWEBSEARCH
GSP

Scan with hijackthis and have it fix the following entries:

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - Startup: GSP Menu.lnk = C:\Program Files\GSP\GSPMENU.EXE
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb04385GB_ZNxmk27868GB
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.8.cab

Make sure all windows other than HJT are closed before you hit the Fix button.

Reboot into Safe Mode

Go to these folders and delete the highlighted folder:

C:\PROGRAM FILES\MYWEBSEARCH
C:\Program Files\GSP

Reboot normally

Did you set up the 'freeserve' stuff yourself, or is that something you need to get rid of?

Close all browser windows, scan with hjt, and post a new log please.

HeHe ,in the post above there is link to a what to do thread ,and in that thread is a link that said , Some further useful sites, courtesy of caperjack and the caperjack is a hyper link that goes to the below link
http://www.daniweb.com/techtalkforums/member.php?find=lastposter&t=6917

Hmmmm... who do you suppose did that? :eek:

As long as you continue to use file sharing programs, such as imesh, you are likely to encounter these problems.

Scan with HJT and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O1 - Hosts: 66.159.20.52 www1.ndhosting.com
O1 - Hosts: 66.159.20.52 www3.ndhosting.com
O1 - Hosts: 66.159.20.52 www2.ndhosting.com
O1 - Hosts: 66.159.20.52 www.ndhosting.com
O1 - Hosts: 66.159.20.52 www.kinghost.com
O1 - Hosts: 66.159.20.52 kinghost.com
O1 - Hosts: 66.159.20.52 www1.kinghost.com
O1 - Hosts: 66.159.20.52 www2.kinghost.com
O1 - Hosts: 66.159.20.52 www3.kinghost.com
O1 - Hosts: 66.159.20.52 www4.kinghost.com
O1 - Hosts: 66.159.20.52 www5.kinghost.com
O1 - Hosts: 66.159.20.52 www6.kinghost.com
O1 - Hosts: 66.159.20.52 www7.kinghost.com
O1 - Hosts: 66.159.20.52 www8.kinghost.com
O1 - Hosts: 66.159.20.52 www9.kinghost.com
O1 - Hosts: 66.159.20.52 www10.kinghost.com
O1 - Hosts: 66.159.20.52 smutserver.com
O1 - Hosts: 66.159.20.52 www30.smutserver.com
O1 - Hosts: 66.159.20.52 www31.smutserver.com

Hi Jini,

First of all, you didn't need to use 'Wipe It" as you could have formatted from your XP CD. And I'm afraid to say, your best option at this point is probably to start over, but have a look at these first:

How this probably happened -- http://www.daniweb.com/techtalkforums/thread16365.html
(When you get your Windows Udates, get SP2, this may help with that -- http://www.winsupersite.com/showcase/windowsxp_sp2_slipstream.asp)

How to reinstall XP -- http://www.daniweb.com/techtalkforums/thread6632.html

Next, that "updatepatch.info" is bogus. After you reinstall, you should disable Messenger Service:

Click Start, Settings, Control Panel, Administrative Tools, Services; Scroll down and highlight Messenger, right-click the highlighted line and choose Properties. Click the STOP button. Then, in the Startup Type, select Disable or Manual; Click OK.

This probably isn't what you wanted to hear, but I hope it helps.
(If you think you might like to try to clean this mess up rather then reinstall, start a new thread in the Virus forum with a link to this thread and we'll try to help you.)

Boy did I ever change my looks ,I click on this link [ Some further useful sites, courtesy of caperjack ]in the reference page post in you above post .No No No it aint me Babe !!

Huh? :?: I don't get it :confused:

My eyes go funny looking at all those entries :eek:. Goodonya dlh6213 for taking this one :D.

My eyes were glazing over as well. I hope you realize I wasn't planning on going this alone :)

Also, from that same thread, get SpywareBlaster and SpywareGuard; keep them updated and they will prevent a lot of these problems.

Try winsockfix from here:

http://www.digitalminds.net/index.pl/downloads

If it still doesn't work, go to Start, Run, type in cmd, and click OK.

Type in ipconfig/release and then ipconfig/renew

Try your connection again; if it still doesn't work, go back to cmd, type in ipconfig/all and post the information that comes up.

You may want to have a look at post #5 in this thread as well:

http://www.daniweb.com/techtalkforums/thread17684-winsockfix.html

It sounds like some kind of virus-related problem to me. Go to this thread:

http://www.daniweb.com/techtalkforums/thread5690.html

Get Spybot and Ad-Adware; do the online virus scan as well.

After you run those, if you still have a problem, get hijackthis from here:

http://www.merijn.org/files/hijackthis_sfx.exe

Close all browser windows, scan with hijackthis, save the log, then copy and paste it in a new thread in the Virus forum along with the problem and steps you've already tried.

In the meantime, try disconnecting your modem (unplug it) when you don't actually need internet access.

I'm pretty sure this is part of a virus, so I've moved your thread to the appropriate forum (for now anyway).

What I suspect happened is that an antivirus program deleted this, but left the program that is trying to run it; or when you emptied a temp folder it could have been deleted (which is a good thing if this is virus related).

Get Hijackthis from here:

http://www.merijn.org/files/hijackthis_sfx.exe

Close all browser windows, scan with hijackthis, save the log, and copy & paste it here.

Hopefully we can figure out what the problem is.

Go to this thread:

http://www.daniweb.com/techtalkforums/thread5690.html

1.) Download and install, Ad-Aware SE. In addition to the default settings, check these and make any necessary adjustments:

A.) Close ALL windows except Ad-Aware SE

B.) Click on the ‘world’ icon (at the top right of the Ad-Aware SE window) to let Ad-Aware SE update.

C.) Once the update is finished, click on the ‘Gear’ icon (second from the left at the top of the window) to access the Preferences/Settings window.

a.) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

b.) Under Definitions:
*Prompt to udate outdated definitions - set the number of days

B.) Click on the ‘Scanning’ button on the left and select in green:

a.) Under Driver, Folders & Files:
*Scan Within Archives

b.) Under Select drives & folders to scan:
*choose all hard drives

c.) Under Memory & Registry, all green:
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file

C.) Click on the ‘Advanced’ button on the left and select in green:

a.) Under Shell Integration:
*Move deleted files to recycle bin

b.) Under Logfile Detail Level, all green:
*include addtional object information
*DESELECT - include negligible …

Can't run DOS programs with SP2? Try this:

http://support.microsoft.com/?kbid=324767

(Thanks to JC7 for finding this one :) )

To get your log cleaned up a bit, go to this thread:

http://www.daniweb.com/techtalkforums/thread5690.html

(I realize you mentioned some of these, but make sure you have the latest versions and settings as described)

1.) Download and install, Ad-Aware SE. In addition to the default settings, check these and make any necessary adjustments:

A.) Close ALL windows except Ad-Aware SE

B.) Click on the ‘world’ icon (at the top right of the Ad-Aware SE window) to let Ad-Aware SE update.

C.) Once the update is finished, click on the ‘Gear’ icon (second from the left at the top of the window) to access the Preferences/Settings window.

a.) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

b.) Under Definitions:
*Prompt to udate outdated definitions - set the number of days

B.) Click on the ‘Scanning’ button on the left and select in green:

a.) Under Driver, Folders & Files:
*Scan Within Archives

b.) Under Select drives & folders to scan:
*choose all hard drives

c.) Under Memory & Registry, all green:
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file

C.) Click on the ‘Advanced’ button on the left and select in green:

a.) …

Hey Joe, you should go to Windows Update and get the Critical Updates for your system to help prevent these types of problems.

Follow the suggestions in this thread:
http://www.daniweb.com/techtalkforums/thread17065.html

And then get hijackthis from here:
http://www.merijn.org/files/hijackthis_sfx.exe

Close all browser windows, scan with hijackthis, save the log, and then copy and paste it into a new thread in the Virus forum along with a description of you're problem. (Don't post the log in this thread)

Drumstick, you've already asked similar questions here:
http://www.daniweb.com/techtalkforums/thread17065.html

Did you forget already? :confused:

This is most likely a virus problem so has been moved to the appropriate forum.

Get Hijackthis from here:
http://www.merijn.org/files/hijackthis_sfx.exe

Close all browser windows, scan with hijackthis, save the log, copy and past the results here.