Posts by DMR

One way to narrow things down is to install the drive as a slave in another computer if possible. If it still has the "Click of Death", you'll at least know that the problem lies with the drive and not your computer. As for the freezing, catweazle is right- it's only meant to be a last-ditch method to allow you some time to copy off your critical data.

However, people on other tech support forums have reported a variety of results for different variations of the freezing fix: I've used the method sucessfully a few times recently, but I've only had to try it once on any given drive; I've read posts where a second freezing is what did the trick. I've also read threads in which the poster said that their drive had been running for months after trying the deep-freeze only once. Of course, there are also those whose drives were too far gone for the freezing to work at all. YMMV, it seems.

The whole thing started when i tried to format my computer. An error came up, and there was nothing i can do.... Also. when i boot up it says all those messages about missing files and replacing them

What were the exact errors?? If you got partially though a reformat, it's most likely that you've trashed enough of your current installation that a reinstall will be your only option. Why exactly can you not perform the reformat/reinstallation?

... turn off System Restore to clear the restore points, then turn it back on again. It has been corrupted and must be reinitialized.

That is a definitely a good idea: If the last system restore "snapshot" was taken when your system was infected, the infections we're trying to help you remove right now could be "brought back to life" by a reinstallation/reintroduction of the infected backups.

Working in Safe Mode ensures that they are not running interference as you work on the problems.

That's true (and often necessary) for Ad Aware, SpyBot, and similar removal programs, but HJT doesn't quite operate in the way that those programs do. To get the full picture of what's going on from a HJT scan, it's more "revealing" to run the scan from a normal boot.

If you're asking if you should be in safe mode when you run HijackThis, no- you should actually run it while booted normally, as many of the programs that you want HJT to detect and report might not be running while in safe mode.

... the one I now suspect is a gnjivapg.dll.

And rightly so. Random, gibberish filenames like that are almost always components of a malicious program, and in the case of the above file that's most certainly the case.

Take the advice given by deonnanicole concerning Ad Aware, SpyBot, and HijackThis. However, before running any of those programs, do the following (assuming you're running WIn 2K or XP):

- Reboot into safe mode

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders:

1. Local Settings\Temp
2. Cookies
3. History
4. Local Settings\Temporary Internet Files\Content.IE5

- Delete the entire content of your C:\Windows\Temp folder.

(If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed.)

- Empty your Recycle Bin.

- Reboot normally.

Then:

1. Run Ad Aware and Spybot first, have them fix everything they find in their scans.

2. Run HijackThis, but close/quit all open programs, especially your Web browser before doing so. When you do run HJT, do not have it fix anything yet! Just have it perform a scan and post the contents of the log file it generates.

Whoops- thanks for the catch crunchie, I missed that one... :o

First of all, you're using an older version of HijackThis; please download the latest version (1.98.2) and post a fresh log from that version.

I did close ie :( This is with no browser windows open. Like I said, even when i close ie, this ie process remains running

Open Window's Task Manager, select any/all instances of iexplore.exe, and click the "End Task" option for each. If the iexplore references seem to close and then automagically reappear shortly after, let us know; that would indicate something fishy.

Also uninstall WeatherBug if it's the free verision that you're using; it displays ads and installs MySearch/MyWay toolbars which you do not need.

To get to the root of the problem most quickly, you should give us all of the IP configuration settings for both computers and the router. If we can review those configurations we'll have something solid to go on.

ykahn,

If the monitor isn't the cause, the video card would be the next thing to look at, especially since you said that the problem either goes away or changes when you run in safe mode. In safe mode, Windows uses its standard VGA driver instead of the video card's own driver, so what you described would make sense. You might want to try another video card if you can to rule out a hardware fault in that area.

angus71,

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforu...b_faq#faq_rules

Thanks for understanding.

has this freezer trick worked even with HDs that had the clicking noise?

Yes it has, but the chance of sucess depends on the severity of the damage already done.

The clicking noise is the sound of the drive's head actuator trying to engage, but failing to do so. This can be caused by either an electronic fault in the control circuitry, or by a physical malfunction of the actuator mechanism itself. Freezing can help in both situations, but as Catweazle said- even if it does you may only have half an hour or less before the drives "thaws" enough to fail again.

In the case of faulty controller electronics, it's often possible to replace the entire controller board with another, although the two controllers must be identical, and the process does take some skill.

You absolutely should only run one firewall at a time--in your case, use the Norton firewall only. Though it is better than nothing, the Windows firewall is still deliberately crippled and nearly useless compared to anything else. It should only be used if nothing else is installed; even then, the free Kerio, ZoneAlarm, or Sygate firewalls are each far better and one should be downloaded immediately if a retail program is not available.

Absolutely. The firewalling and "Internet security" features built into Windows are severly limited compared to the third-party products TC1 mentioned. Since you've already purchased the Norton product, use it.

sillsj and cjpitsch,

First of all- welcome to TechTalk :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforu...b_faq#faq_rules

Thanks for understanding.

The manual removal route probably wasn't the best way to go (unless it was your only recourse): aside from the files that the modem installation added, it also would have made changes to your registry which will be difficult to find and remove by hand. You might want/need to use the System Restore function to reset things back to a state just prior to your attempted installation of the modem.

As to your specific question though, try one of the following to get to a point where you can delete the files in question:

1. Open Task Manager and look in the running process list for the 2 files. If you find them there, select each one and click on the "End Task" option. See if you can then delete the files.

2. Reboot into Safe Mode (by hitting the F8 key just as Windows starts to load). You should be able to delete the files from there, as they shouldn't be automatically started by Windows under Safe Mode.

Yes- you'll definitely still need to use IE, if only for the fact that the Windows Update site won't work with any other browser.

Duped? How could you say you were duped? I downloaded SpyAssassin too, thinking it was something else, but I willingly paid for it, and it did a good job on my system.

That's one of the problems with some of these programs- there's no need to pay for such a product, as the free alternatives do as good a job, if not better.

1. I have a lot of files that I want to keep but they are under windows. Is there a big diference in general file names like. .jpg, .mp3, etc? Can I convert them somehow??

As already mentioned, there's no big difference in common filetypes like jpegs, mp3s, etc., although Linux doesn't really need to use filename extensions to determine the actual type of the file (and therefore what application to open that file with) in the way that Windows does. Still, a Linux graphics viewer will open any jpeg, a Linux audio player will open mp3s, yada, yada, yada. Even better, Linux can read and write data from/to Windows 98-formatted drives and partitions, so you can share your files between both operating systems.

2. I have some games that I would like to play now and again. Will they run in linux?

Any program specifically written for one operating system won't natively run on other operating systems, so directly- the answer is no. However, (depending on the actual game titles) there may be Linux versions of the games, or they may run under "Windows emulation" software such as WINE or VMWare. If you tell us which specific games you're concerned about we can problably give you more info.

cevans,

Considering that this thread was started almost 1 year ago and has been dormant for 8 months, you should start your own thread and post your question there. Being at the end of a very old thread, other members might miss you question here. Also- in our posting guidelines we do ask that members not add their questions to a thread already started by another member, regardless of any possible similarity in problems. Things just tend to get confusing when multiple questions are being asked and answered within a single thread.

Thanks :)

Log looks clean now :)

Yup- Marking as solved now.

american212001,

Please see my two previous posts above regarding adding questions to a thread already started by another member- you need to start your own thread and post your question there.

Thanks.

Glad we could help :)

OK, this will take a bit due to the number of problems you have, but:

1. Close/quit all open programs.

2. Run HJT again and have it fix the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.begin2search.com/googlesidesearch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://store.presario.net/scripts/r...&c=2c02&lc=0409
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/googlesidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.begin2search.com/googlesidesearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://image73.eguard.com/lowermybi...ent23491-0.html
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: 216.130.185.143 www.xzoomy.com
O1 - Hosts: 216.130.185.143 xzoomy.com
O1 - Hosts: 216.130.185.143 www.advnt01.com
O1 - Hosts: 216.130.185.143 advnt01.com
O1 - Hosts: 216.130.185.143 websearch.com
O1 - Hosts: 216.130.185.143 www.adwave.com
O1 - Hosts: 216.130.185.143 adwave.com
O1 - Hosts: …

I missed a couple of things in my last post- take care of these before we proceed:

1. You are running an older version of HijackThis. Please download the latest version (1.98.2) and use that instead, as it does a more thorough job of detecting and reporting than previous versions. Post a new log from that version.

2. You are running HijackThis directly from your Desktop folder, which is not advised. Please create a separate, distinct folder for HijackThis and run it from there. The folder should not be created within any Temp or Temporary folders; something like C:\HijackThis or C:\downloads\HijackThis will do.

Have Hijackthis fix these as well:

O4 - HKLM\..\Run: [Network Service] C:\WINDOWS\svhost.exe -sr -0
O16 - DPF: {10000000-0000-0000-0000-000000000000} - http://213.159.118.226/x/x.exe

Once done, delete the C:\WINDOWS\svhost.exe file.

Also- FlashGet is Adware; you should remove it. Have HJT fix all entries related to Flashget and delete any FlashGet folders/files that you find on your system.

Moving to the Security forum now...

Is there more to the error message than "IDE Error #1"? If so, please give us the full and exact text of the error. The more specific you are, the faster we'll be able to help.

Sorry, but off the top of my head- no. Hopefully another of our members will be able to offer a suggestion for that.

Considering what you described about the program's use of resources, it might very well be a memory leak. However, you should look at options/preferences in the program itself for something that might define the program's use of resources; perhaps its behaviour in that area can be adjusted.

If you'd like, give us the name of the application; we might be able to find some info on the application that could help solve the problem.

diana- is it XP Home edition that you have, or XP Pro?

The instructions I gave will definitely work with XP Pro, but I didn't verify them for XP Home as I don't have a system with the home version of XP available at the moment.

Turn off virtual memory [aka swap file, page file], reboot and try defragging. Turn virtual memory on again afterwards.

Not a bad idea in general, even if it doesn't solve the specific problem at hand here. The swapfile used for disk paging gets fragmented just like any other file; by disabling VM before defragging you can be absolutely sure that the disk space used for swapping/paging will get optimized along with the rest of the space on the drive.

It's possible that the particular editing program you're using has a memory leak; do some research on the company's website and on Goolge to see if this might be a known, documented issue.

Also, since you have a lot of disk space, you could try increasing the size of your VM even further.

Compressed versions of system files such as rundll32.exe are stored in .cab (as in "cabinet") files on your installation CD. Instructions for extracing a fresh copy of rundll32.exe from the cab files can be found here:

http://www.compphix.com/rundllerrors.html

If things are extremely cramped at present, even defrag could be 'falling over' with not enough elbow room to work in.

That's possible, as defrag does need a certain amount of free disk space in which to temporarilly store the data it's trying to rearrange. However, you did say that after deleting programs you have 24% of the disk free, which should be more than enough "breathing room" for a defrag.

Windows installation will automatically format the system partition for you.

And should also overwrite the Linux boot code in the MBR, thus getting rid of the Grub screen.

I am not really sure but I think some toolbars that downloads into your IE could mess it up. (As well most of the free software that install them as well)

Quite true; you might want to uninstall any IE add-ons such as the Yahoo and AIM toolbars just to eliminate any variables.

You need keep on your computer Winsock repair tool. http://cexx.org/lspfix.htm. You can try use it to fix your IE problem (most of them connectivity problems.)

Be careful with Winsock utilities though: they can repair a corrupted Winsock layer, but they can also break that layer if used improperly.
Also, while spyware/trojans/hijackers and the like can definitely alter or cripple your web browsing, relatively few of them actually do so by grafting themselves into your Winsock implementation.

Given that, tools such as LSPFix should only be used when you know for certain that a corrupt Winsock stack is part of your problem; Winsock utilities will be of no help whatsoever for the numerous other problems caused by malicious programs.

By the way- Hijack this does detect irregularities in the Winsock/LSP stack; it will report them with an "010" code in its log.

Hey- just go wireless and you can have the best of both worlds.

It's about 7:30 on a comfortable Saturday evening over here, and I'm sitting out in my courtyard getting plenty of nice fresh air while I' m covering 2 forums, finishing up some invoices for clients, and well- I guess the only thing I'm missing is a nice pint of stout...

:mrgreen:

I noticed that you've been on a bit of a posting frenzy tonight, so given the ground that you've covered, nobody can fault you for that one... :)

A simple Google search for the keyphrase "trojan revop.c" brings up a lot of information and removal instructions:

http://www.google.com/search?hl=en&ie=UTF-8&q=trojan+revop.c&btnG=Google+Search

In Memorium: "Google first, ask second." ;) :cry:

Nice & clean :).

True- the log is clean. Would you like to give us some info as to why you posted it? In other words, what specific problems are you having?

Also-

Your version of HijackThis is old; you should update to the current (1.98.2) version.

Some infected files cannot be removed if they live in certain Windows folders such as system restore folders. Did your AV program indicate the location of the files it was unable to delete? If so, give us that info.

Also- run HijackThis and post the full contents of the log file it generates; the information in that log can tell us a lot.

If your computer connects directly to your cable modem, it's most likely that you're supposed to be getting all of your IP info from your service provider automatically via the DHCP protocol.

Open your Network Connections, right-click on the Local Area Connection, and choose Properties from the resulting menu.

In the General tab of the Properties window, double-click on the "Internet Protocol (TCP/IP)" entry. Check the "obtain...automatically" options for both the IP and DNS settings.

Click OK in the Properties window and again in the Network Connections window.

Open your Internet Options control panel. Go to the Connections tab and click the "LAN Settings..." button; make sure the "automatically detect settings option there is checked.

Reboot just to make sure your changes take effect.

Once the computer reboots, you can see if it picked up its IP info automatically by opening a DOS box (MS-DOS Prompt) and typing the following command:

ipconfig /all

That should show DHCP to enabled, and should list your IP address, subnet mask, gateway IP, and DNS server addresses.

If the above doesn't work, post the info that the ipconfig command did report.

Thanks for the reply,

Did as you said is copied this from the Hijack This Log. . .

A) HijackThis logs are only to be posted in our Security forum, as the announcement at the top of each forum's main page indicates

B) If you think that "unwanted guests" in your computer might be the culprit, you would need you to post the entire contents of your HJT log in order for us to see if you have any "nasties" in it. As I said though, you would need to start a new thread in the Security forum and post the log there.

One of these suggestions should help:

http://www.annoyances.org/exec/show/article04-103

That message is indicative of a trojan/spyware infection. I'm moving your thread to our Security forum; read the other threads there to find out how to download and use recommended detection and removal tools such as Ad Aware, SpyBot Search & Destroy, and HijackThis. Also run a full system scan with your anti-virus program, making sure that you install the lastest virus definition updates for the program before running it.Read the following thread for more information and suggestions:

http://www.daniweb.com/techtalkforums/thread5690.html

Give us as much detailed info as possible on your system's hardware (motherboard model, CPU type/speed, RAM, makes/models of video, network, sound, etc. cards and the like). One of those components could be causing a conflict.

Is it possible that you simply have a DNS problem? The conditions you desrcibe are exactly what would happen if your system couldn't contact a DNS server in the process of resolving URLs to their IP addresses.

Try this:

- Open a DOS box

- Type:
ping 64.233.167.99

and then:
ping www.google.com

If the first works, but the second doesn't (both pings should reach Google), check the DNS server IP entries in your TCP/IP properties and make sure the IPs are present and correct.