Posts by dlh6213

This happened to me once with an eMachine; I called tech support and they gave me the number right over the phone, perhaps Packard Bell can do the same thing.

NOW I write all numbers right on the CD's with a permanent marker as soon as I get them!

You could have gotten the number from your registry before you reformatted, but it's too late for that now. The only things I know of that you can do now are either find your code or get it from Packard Bell (or buy another one).

I have a new computer with a 120g hard drive and a 20g hard drive as a slave. I also have 1 gig of memory.

My question is this:

In setting up partitions for my computer, is it ok to have just one partition or should I make several?

For example, a friend of mine suggested the following:

20gig drive c (windows)
5 gig drive d (swap)
the remainder of this drive drive e (files)

Slave drive drive F (Backup)

I do nothing fancy on this computer as far as gaming or any type of designing. All I am interested in is just an easy way to setup and maintain my system

Any and all suggestions from the experts would be greatly appreciated.

Thanks in advance.

Personally, I would do as your friend suggested, or something similar. The smaller drives will allow faster defrags, searchs, antivirus scans, etc. Also, if one drive gets corrupted, most of what you have on the other drives shouldn't be effected.

I don't really think you need to dedicate 5GB to swap files, just dedicate a small portion of each drive and use some RAM as caperjack suggested.

Just something else to take into consideration :)

Without the Product Key, it does you no good. Can't you get it from the person you got it from? It also has to be unistalled from the other computer before you can put it on a different one.

Posting a log from hijackthis will help us to make sure your system really is clean other than the dialer you mentioned.

Specific instructions for removing that dialer can be found here:
http://www.antivirusworld.com/articles/dyfuca.php

I'm running out of ideas here, but can you post the log from Ad-Aware that you said had quarantined 13 objects?

I think this is what you're looking for:
http://www.microsoft.com/windowsxp/using/setup/learnmore/classicview/ctrlpanel.mspx
With pictures:
http://www.worldstart.com/tips/tips.php/412

I've been using the 'Classic view' for so long, I had forgotten there was another view :)

If you get an error message when trying to create a scheduled task, check this:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;884573

See if this helps:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;884573

Butchcombs, I merged your threads, please post all replies within this thread.

Is Ameritech your ISP?

If it is, I don't see any problems in your log; are you still having trouble? Did you check Black Viper's site for recommendations?

The INF folder is a legit Windows folder (for drivers and backups I think).

You can use Firefox for most of your web browsing, but you need to keep IE, mainly because it is the only way to get your Windows Updates.

Did CWShredder find anything?

Go to Add/Remove Programs in your Control Panel and remove:
Incredimail

Scan with HJT and have it fix the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.popupsearches.com/sidesearch.html
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll
O4 - HKLM\..\Run: [djatal] c:\windows\system32\djatal.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm

Close all windows other than HJT before hitting the Fix button

Reboot into Safe Mode

Go to
C:\windows\system32 and delete djatal.exe
C:\WINDOWS and delete BTGrab.dll
C:\Program Files and delete the IncrediMail folder

Reboot normally

Close all browser windows, scan with HJT, and post a new log please. Is OfferOptimizer gone yet? Any other problems remaining?

This sounds rather confusing to me, but I'll give it a shot. You only need one sound card; I don't know if the old one was bad or not, but since you already have a new one, you should remove the old one and install the new one. When you start the computer, it should try to find some drivers for it but may not. Put in the CD that came with the new sound card and install the drivers from there.

If this doesn't answer your question, can you please try to clarify it?

Microsoft has aquired Giant, so what MS is offering is basically Giant's tools.
http://www.computerworld.com/securitytopics/security/story/0,10801,98341,00.html?from=story_kc

First of all, let me tell you I don't really know a lot about this, but I don't think it's a problem with your computer. It sounds like a problem with the website. If you can, you may want to contact them and let them know about the problem you're having.

See if this helps any:
http://www.sixdifferentways.com/archives/007675.html

Try this:

Close IE and go to Start, Run. Type the following commands, one after the other, and hit 'Enter' after each one:

regsvr32 shdocvw.dll
regsvr32 urlmon.dll
regsvr32 comcat.dll
regsvr32 actxprxy.dll
regsvr32 Shell32.dll
regsvr32 Oleaut32.dll
regsvr32 Mshtml.dll
regsvr32 jscript.dll

Each time you hit Enter, you should see a short message stating the command was successful.

After all have been entered, reboot and see if you still have the problem.

See if this helps at all:
http://aumha.org/win4/a/kernel32.htm

Thanks for sharing your fix, Mozza :). I guess the lesson here is that if System Restore doesn't work, try "Last known good configuration" to see if will fix the problem.

:lol: Hi the problem is all salted out it had something to do with my IP address. I type ipconfig commend line to check my IP address, it was showing IP as being 227 when it is meant to start with an 81. Since use shareaza I have being get a lot o virus and spyware, probable had change my settings so I reinstalled windows the in installed SP2 from CD I got from Microsoft and my internet is working fine now. :evil: But what really pi???? me off is I spent hour on the phone to MS for them to tell me it’s a problem with my IP address

Just like to thank everybody who replayed :cool:

Thanks for sharing your fix :)

Using any P2P programs are likely to lead to problems; a good reason to stay away from them!

Since we can't help with Kazaa, and Bigbear hasn't posted since the thread was started, I'm going to close it.

I came up with a couple of suggestions. If your OS is XP or ME, try using System Restore to a point before you started having problems.

This is a link to an IE Fix that may help:
http://windowsxp.mvps.org/IEFIX.htm

Well, I don't know if this will help, but it's something to read and consider:
http://www.answersthatwork.com/Tasklist_pages/tasklist_i.htm
(To find the related info, click go to the toolbar at the top of IE and click on Edit, and then Find on this page; type in incredimail, and hit Find next)

I personally had Incredimail for one day and started having problems, but it may have been a coincidence.

It could be the firewall settings, or there is a patch for an issue similar to this. Read through this thread to see if there's anything helpful:
http://www.daniweb.com/techtalkforums/thread10031.html

You can find a link to hijackthis, along with other helpful advice and tools, in this thread:
http://www.daniweb.com/techtalkforums/thread5690.html

Please post your hijackthis log in the Virus forum (not in this thread), and include the problem you're having.

Thanks for sharing the fix, Dan :)

Caperjack, your link to "How To Setup Spybot SD and Ad-Aware" doesn't work (not for me anyway).

Did you backup the registry before you used the cleaner? If so, you can restore it from that. If you didn't, here's how to do it (for future reference):

Go to Start, Run, and type in regedit; click OK and the Registry Editor will open.

Before you edit the registry, you should make a backup. At the top of the Registry window, click on the Registry menu, click Export Registry File. In the Export range panel, click All, then save your registry as Backup.

Make the changes you want, then exit the Registry Editor. Or, if you're just making a backup, Exit without making any changes.

My system has been getting slower and slower and i thought if i sent in my Hjt log and got rid of all the bad stuff it mite help it out... but it didnt. Was gona see if i was to post a list of my processes from the task manager if you guys could help me end the processes i dont need.. plz let me kno if thats ok
thnx

Crunchie has already asked you not to double post, you have this same thread going in the Windows NT/2000/XP/2003 forum (http://www.daniweb.com/techtalkforums/thread16785.html). The link given there by Laser should be helpful. If you need anymore assistance, please ask in that thread.

Unfortunately, yes I'm still being redirected as before. The site I'm trying to reach is aafees.com, but I am redirected to ownbox.com\treasure\shop.html where I get a Windows Internet Explorer window that I've won Virtual Reality Casino with a "go" or "cancel" choice. When I cancel, I get redirected to http://usseek.com/search/internet/gifts. Aafees.com is the only site where I get a redirect. I can access any of my other sites without a problem. So Internet Explorer seems unaffected. I also have Mozilla Firefox and the same thing occurs also.

Does tha help any?

Why do you want to go to 'aafees.com'? It's not a problem with your computer, I get directed to the same place you do when I try it. Of course, I closed it with Task Manager rather then click anything in the box.

What didn't work, the links or the fix?

Open Windows Explorer, Folder Options, Tools, View, and select "show hidden files and folders," and uncheck "Hide protected operating system files".

For every user account listed under C:\Documents and Settings, delete the entire contents of these folders:
Local Settings\Temp
Cookies
History
Local Settings\Temporary Internet Files\Content.IE5

Delete the entire content of
C:\Windows\Temp folder
C:\Temp folder

Do a search for *.tmp and delete everything found

Empty your Recycle Bin

Go to Add/Remove Programs in your Control Panel and remove (if found):
Admilli Service
Internet Optimizer
BullsEye Network

Scan with HJT and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...lion&pf=desktop
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\system32\msbe.dll
O4 - HKLM\..\Run: [Admilli Service] C:\Program Files\Admilli Service\AdmilliServ.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Tsl] C:\PROGRA~1\COMMON~1\tsa\tsl.exe
O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\bundle.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program …

You need to go to Windows Update and get the Critical Updates for your system. Hold off on SP2, however, at least until your system gets cleaned up.

As long as you use P2P programs (like Shareaza) you are likely to encounter problems.

Is 'Admanager Controller' a program you installed? I can't find any info on it.

Remove Newdotnet, either from Add/Remove programs in your Control Panel, or by going to:
http://www.newdotnet.com/#remove
And scroll down to the uninstall tool.

Scan with HJT and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
O4 - HKLM\..\Run: [abu] abu.exe

Fix these if you did not put them in your Trusted Zone:
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.124.130 (HKLM)
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/D...bridge-c336.cab
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/so...tiveXPlugin.cab

Close all windows other than HJT before you hit the Fix button.

Do a search for Savebait.exe, and ACTIVE TEST POKE.exe
when you find them, right-click on each, go …

SpyKiller and Spyware Begone probably aren't helping you much; before you get any anti-spyware programs, you should check them out at this site first:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

More info here:
http://startup.iamnotageek.com/srch-Spykiller.exe.html
http://startup.iamnotageek.com/srch-freescan.exe.html
http://www.hardavenue.com/startup/freescan.exe.php

1. Update your Ad-Aware 6 to Ad-Aware SE (http://www.lavasoftusa.com/software/adaware/), keeping the default options. However, some of the settings will need to be changed before your first scan

2. Close ALL windows except Ad-Aware SE

3. Click on the ‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the Preferences/Settings window

A.) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

Under Definitions:
*Prompt to udate outdated definitions - set the number of days

B.) Click on the ‘Scanning’ button on the left and select in green :

Under Driver, Folders & Files:
*Scan Within Archives

Under Select drives & folders to scan -
*choose all hard drives

Under Memory & Registry: all green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file

can enyone tell me how to get rid of a malware admilliserv?

Follow the suggestions in this thread:

http://www.daniweb.com/techtalkforums/thread5690.html

Then post a hijackthis log in the Virus forum and we will help you get it (and anything else you may have) removed.

Before anything else, go here and select a site to download about:buster from:
http://www.majorgeeks.com/download4289.html

That should cleanup some of this. After you run it, close all browser windows, scan with HJT again, and post a new log. Don't reboot or turn off your computer after your next scan until you get a response from us (some of these files may have a tendancy to morph when rebooted).

I think we all hate OfferOptimizer! :mad:

As long as you use P2P programs (like LimeWire), you will continue to have problems; all P2P sharing programs are susceptible to various forms of malware.

Check this site for imapp and decide for yourself if you should keep Incredimail:

http://www.answersthatwork.com/Tasklist_pages/tasklist_i.htm

I personally had Incredimail for one day and started having problems, but it may have been a coincidence. If you decide to remove it, let us know so we can assist.

Go to this thread:

http://www.daniweb.com/techtalkforums/thread5690.html and follow all the suggestions (free online scans, CWShredder, SpywareBlaster, etc)

Go to Add/Remove Programs in your Control Panel and remove (if found):

ISTsvc

Reboot into Safe Mode

Go to

C:\Program Files and delete the ISTsvc folder

Reboot normally

Before you fix anything with hijackthis, it needs to be in it's own permanent folder (like c:\hjt\hijackthis.exe). When it's in a Temp folder, as you have it now, it may be accidentally deleted (along with it's backups).

After you put HJT in it's own folder, close all browser windows, scan again, and post a new log please.

Follow all of the instructions in this thread (Spybot, free online scans, SpywareBlaster, etc.):

http://www.daniweb.com/techtalkforums/thread5690.html

Then scan with hijackthis (version 1.99), and post a log here.

If you try that link to winsockfix and it doesn't work, here's another one:
http://www.digitalminds.net/index.pl/downloads

Hey steosaur, dvs666 is right, I tried them and got the same message.

Dvs666, try these:

For winsock -- http://www.digitalminds.net/index.pl/downloads

For Ad-Aware SE -- http://www.download.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

You may find more helpful tools and advice here:

http://www.daniweb.com/techtalkforums/thread5690.html

Cannot get into Windows, so cannot retrieve the product I.D. Only thing left is a reformat of th H.D. After formatting, must I load drivers for motherboard,cd
rom etc or will these be on a win 2000 disc that I hope to install.

Win 2000 should have most device drivers, though I'm not sure about motherboard drivers. You should check this site before you format:
http://www.microsoft.com/windows2000/server/howtobuy/upgrading/compat/default.asp

I don't see anything bad in your log, other than the lack of "R" entries (http://www.bleepingcomputer.com/forums/index.php?showtutorial=42#RDiag).

Did you try the winsock fix previously suggested?

Even if you did this, it wouldn't work because XP has to activated, and can only be activated on one computer (unless you purchase a license for multiple PC's).

Besides that, it's against forum rules to assist with pirated software
(http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_faq#faq_rules)

Sorry to hear about your father :(

I did all that you suggested with the following exceptions:
Weatherbug: I use this occasionally and it is something that I installed it myself. I've never had any problems with it. I didn't make any corrections or deletions related to this.
DIGStream: I visit ESPN's website quite often and enjoy thier "ESPN Motion" video clips, which uses DIGStream. I never had any problems with this and didn't make any corrections or deletions.
Homestead: Homestead.com is a site I use for filehosting. I didn't see any harm here either.

Sorry about the DIGStream, I looked it up and knew it wasn't a problem; I don't know why I included it. :confused:

You may want to reconsider WeatherBug, as it is reported to be associated with adware and spyware:
http://www.2-spyware.com/file-weather-exe.html
http://www.liutilities.com/products/wintaskspro/processlibrary/weather/

As far as the Homestead, I wasn't sure, and fixing it wouldn't have caused any problems, it would have just come back the next time you visited the site.

No, I searched several sites and found nothing about it. Doesn't even get a single hit on google.

In refrence to hkmtauvn.exe, usually when you can't find info on something with Google, it's a pretty good indication its bad (or very new). However, you can usually right-click on a file and go to Properties to get information about it. A lack of info there pretty much guarantees it's not good.

Can you try to do a System Restore to about two weeks before you used the Killbox (instead of a point right before)?

How right you are! Thanks :) It's the same as method "A" in your post, but let me try it again:
http://www.windowsreinstall.com/install/tips/winme/tswinme/how_to_find_product_id_in_regist.htm

It looks the same, but now it works! :D

That's not a complete hijackthis log, it should show what version of hijackthis you're using. If you're not using 1.99, please update it.

In any case, please close all browser windows, scan with HJT (ver. 1.99), and post the complete log.

It looks okay to me, anyone else see anything bad?

CTHELPER.EXE should probably be disabled; quote from sysinfo:

CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers, add-on features, and fixes that will integrate with a tighter fit with Creative’s sound drivers and utilities. Given its purpose CTHELPER would normally be classified as a "leave alone" background task. It also allows Creative speaker setup to be synchronized with Windows Control Panel speaker setting. Without it running that check box in Creative speaker setting is not functional (settings are not in sync). Unfortunately there are often problems with CTHELPER, most notably that it can use 100% of CPU time so it's best left disabled unless you need it.

Hi Powder; first of all never click on a pop-up ad, no matter how enticing it maybe. Don't even click on the X to close it, either use Task Manager (as you did), or right-click on it and select Close.

Get SpywareBlaster and/or SpywareGaurd to help prevent this from happening again.

Get Ad-Aware SE and Spybot Search and Destroy to help remove most of what will get in anyway.

These are all free, and there are links to them in this thread:
http://www.daniweb.com/techtalkforums/thread5690.html

Keep them all updated, along with your antivirus program, and run them at least once a week.

Go to Add/Remove Programs in your Control Panel and remove (if found):

DIGStream
WeatherBug

Close all browser windows, scan with HJT, and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [hqclgc] C:\WINDOWS\system32\hmktauvn.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {01CA75F1-054B-4A63-9221-C6926369EC52} (HS_live Control) - http://install.homestead.com/~site/...ive/HS_live.cab

Reboot into Safe Mode

Go …

Try going to Window Update, that may help with the WMP. I don't know about the pictures and games though. You may need to start a new thread in the Software forum.

Go ahead and have HJT fix
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} - http://www.errorguard.com/installation/Install.cab

A lot of people are turning to browsers other than IE, such as Firefox and Opera, because of the security flaws. You still need to keep IE, however, because it is the only way to get your Windows Updates.

If you're the only user on this PC, you should have admin rights. Is it XP Home?