Posts by DMR

Some of Grub's boot info is still living in your Master Boot Record (MBR), although if you have your BIOS set to boot from the CD-ROM before the hard drive this shouldn't be an issue.

1. Go into your BIOS setup and make sure the boot device order has the CD-ROM listed before the hard drive.

2. If necessary, you can restore the MBR by booting into rescue mode from the Windows installation CD and running the following command:

FIXMBR

Try shutting down all other programs you might have running, including those running in the background (for example, programs that show up in the notification area of your taskbar); some programs can interfere with the defrag process.

BLECH!

lol!

Not exactly the most technical of assessments, but I couldn't have put it any better myself.

In all seriousness though- while the log does indicate heavy infestation, it is most likely fixable without a total reinstall if you don't to take the "shotgun" approach.

The only thing I see left to fix is this:

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/05419fb...ip/RdxIE601.cab

Other than that, your log is squeaky clean :)

I think McAffee's equivalent to Norton's Internet Security package might have similar privacy functionality. Why, specifically, do you ask?

Nothing to add at all; I'll mark this one as solved. :)

Catweazle is right- two computers can be networked together as he described to share files, folders, printers, etc. However, the computers will not share resources such as memory or CPU time.

Considering the reallocation errors, your drive might truly be pooched.
However, have a look through some of the following related discussions, as the error seems to be sort of common for that era of Thinkpad:

http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=%22hard+drive%22+windows+%22error+174%22+thinkpad&btnG=Search

The NT/2000/XP/2003 forum would be the best place to post your question.

Also, try some of the suggested fixes in these links:

http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=%2216+bit+windows+subsystem%22+autoexec.nt&btnG=Search

Cool- in that case, I'll mark this thread as solved.

Did the techs even bother to try a replacement modem? Any idea what led them to tell you it was a virus?

I'm sorry, but we'll need much more detailed information on exactly what you are trying to accomplish. An intranet is an internal (private) network; it does not get developed on a single machine.

You need to state your question more clearly.

http://www.daniweb.com/techtalkforums/thread10948.html

This thread from last month has some info on that. :)

SpyBot alone isn't going to do the trick for that mess... :eek:

1. I don't see any indication in your log that you're currently running any anti-virus software at all. Get your hands on a good anti-virus program which also detects adware and spyware components. Both Norton (Symantec) and McAffe make such products.

2. Download Ad Aware and Spybot Search & Destroy; the download links are in my sig below.

3. Open Ad Aware and click the "Check for updates now" option on the main startup page; follow the prompts to install the most current reference file.

4. Open SpyBot and get the latest updates for it by clicking the "Search for updates" option. Once it finishes updating, close the program.

5. Delete the contents of all Cookies, Temporary Internet Files, and Temp folders, and empty your Recycle Bin.

6. Reboot into Safe Mode. You do this by hitting the F8 key as the computer is booting.

7. Run SpyBot; have it fix everything it finds.

8. Reboot into safe mode again.

9. Run Ad Aware. Once it finishes its scan, select all of the items it finds and have Ad Aware delete them.

10. Reboot normally, run HJT again, and post a fresh log.

Glad we could be of assistance :)

Just curious- did deleting the "WindowsRegKey..." help anything?

Log's getting better, but there are still some nasties.

Have HJT fix:

- All entries which indicate "(file missing)"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
O2 - BHO: Band Class - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - C:\WINDOWS\DEALHLPR.DLL
O2 - BHO: CExtension Object - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O3 - Toolbar: Begin2Search.com Bar - {52FE5233-367C-4EFB-BDD7-0BE4D212C107} - C:\WINDOWS\SYSTEM\WINB2S32.DLL
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/05419fb...ip/RdxIE601.cab
O16 - DPF: ConferenceRoom Java Client - http://mail.igl.net:8000/java/cr.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://mirror.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {E62A47D8-74B1-4A93-963A-E5E43B7CC5C2} (UCSearch.ucUCSearch) - http://www.zuvio.com/opnste/UCSearch.CAB
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab

- Restart

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- Find and delete all of the .dll files mentioned in the HJT entries above.

- Delete the entire C:\Program Files\ISTsvc folder.

- Delete the entire C:\PROGRAM FILES\SIDEFIND folder.

- Empty your Recycle Bin.

- Post'um heap new HJT log.

For the startup error messages, look in the "startup" folder uder the Programs menu of the Start button. If you see any shortcuts there to programs you've deleted, delete the shortcuts too.

Also- sorry, but I missed a couple of entries in your log which would give those errors; run HJT again and have it fix them:

O4 - HKLM\..\Run: [AEIWLSTA.EXE] AEIWLSTA.EXE START
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

No waste of time at all, but unfortunately I don't have anything else to suggest at the moment. I'll post back if something brilliant comes to me... :mrgreen:

As I asked before, please post the contents of your boot.ini file (if you can get to it now). To avoid having to make guesses as to what the problem is, we relly need to see what's in that file.

Ok- given Mother Nature's activity in your area lately, it's quite possible that the tech will find something to be truly fried. Give us an update once they've visited.

You're still heavily infested. Can you give us the locations (folders) of the infected files that Norton could not fix? That info would help.

Also- most of your problems are coming from the dreaded "about:blank" infection, which can be a nasty beast to remove; search this forum and Google for the keyphrase "about:blank" and you'll find many possible solutions. Try them and tell us the results.

Just a thought, but DSL services usually require that you use the PPPoE protocol instead of DHCP to automatically obtain your IP info from them (when your computer is directly connected to the DSL modem). However, when you had the router in the equation, it probably did use the DHCP protocol to to give your computer its IP info.

- If you haven't tried this already; with the computer connected directly to the modem:

* Remove power to the DSL modem.
* Shut down the computer.
* Plug the modem back in, turn it on, and let it go through its startup sequence and stabilize (that is, wait until all of its lights have stopped flashing).
* Turn on the computer.
* Try connecting again, and if that doesn't work run the ifconfig /all command and let us know if any of the values have changed since your last post (also let us know if you get any error messages along the way).

As for the "locked out" user accounts, try this (as administrator):

- Open your Folder Options Control Panel, click the View tab, scroll down to the "Use simple file sharing" option in Advanced Settings. Uncheck that option and click OK to close the control panel.

- Open Windows Explorer, and under the Documents and Settings folder:

* Right-click on one of the locked-out user account folders and choose the Sharing and Security option.

* Click on the Security tab, click the Advanced button, and then click the Owner tab in the resulting window.

* Note the username listed as the current owner. In the "Change owner to:" list below that, select Administrator (or what ever name you use for the Admin account which you are logged in under).

* Check the "Replace owner on all subcontainers and object" option at the bottom of the window.

* Click Apply and let Windows apply the changes.

* Click OK in each of the open windows until all Properties windows are closed.

* Repeat the process for the other locked-out user account.

You should now have full access to those main user folders and all folders below them. If that doesn't work, let us know; I might have missed a step in there.

As for your log, I don't see any obvious nasties in there any more.

Cool, glad you found the fix (and let's hope it stays fixed). :)

You're welcome, glad we could help! :)

This sounds like the same issue.

Yes, it does. Windows is telling you that it can't negotiate with the router to obtain IP info from the router via DHCP. Doing so is called "renewing the IP lease", hence the error message.

To set IP manually in XP, go to "Network Connections", which should show up as a submenu under your Start button menus.

- Right-click on the connection you want to configure (Local Area Connection is the wired connection, Wireless Network Connection is, um... obvious).

- Choose Properties

- Under the General tab of the Properties window, scroll down to the bottom of the list of items and double-click on the Internet Protocol (TCP/IP) entry.

- In the resulting window, select "Use the following..." for IP Address and DNS server address.

- In the IP section, enter the values I posted before; for a DNS server, try 206.133.119.72.

- Click OK twice to close the properties windows.

- If you try the IPconfig /all command again, it should reflect your changes.

- Turn off the computer, the modem, and the router. Turn the equipment back on in this order, letting the router and modem go through their power-up cycle before turning on anything else:

Router, modem, computer.

If that works, you should now be able to get to the router setup page at 192.168.0.1. Make sure the router is set to provide IPs to the LAN with DHCP, and …

Make sure you log in under an account with full administrator rights and try again; your log indicates that you haven't removed everything yet.

Also- for some reason you're still running HJT from within a Temp directory despite our giving you instructions on how to do otherwise. It strikes me that perhaps we weren't clear enough in what we were saying: when we asked you to put HJT in a location which was not in a Temp/Temporary folder, we also meant that the new HJT folder you create should not be a folder within/under any Temp directory as well. As it stands, you have indeed put HJT in its own folder, but that folder is still a sub-directory of your Documents and Settings\diana\Local Settings\Temp folder/directory.

At the moment:

1. Have HJT fix these:

O4 - HKLM\..\Run: [Winad Client] C:\Program Files\Winad Client\Winad.exe
O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe
O4 - Global Startup: Cloudmark SpamNet for OE.lnk = ?
O4 - Global Startup: Exif Launcher.lnk = ?
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_f...fd7b16e84dcf04e

2. -Delete these folders entirely:

C:\Program Files\WindUpdates
C:\Program Files\Winad Client

3. - Reboot into safe mode

- Open Windows Explorer. Go to the Tools menu and select Folder Options. In the Advanced section under the View tab, check "show hidden files and folders"; uncheck "hide extentions for known filetypes" and "hide protected operating system files". Click OK.

- For every user …

what do you mean by "probably induced by something dumping "hum" onto your power lines"?

Depending on your part of the world, your AC power operates at a frequency of 50 or 60 cycles per second. However, some equipment (especially equipment with electric motors like refridgerators, elevators, power tools, etc.) generate other frequencies when operating, which can "backfeed" down the power line and mix in with the power feeding other devices on that power line. The result is that these frequencies combine with the frequency of the AC feed to produce unwanted voltage/current frequency fluctuations, which can affect the performance certain devices. In the case of televisions or video monitors, the interference often mainifests itself as visible "bars" which slowly creep up or down the screen. In the case of audio equipment, the result is usually an audible hum or buzz emanating from speakers or headphones.

and by the way, this computer is in office. not home. so are the solutions given to me still relevant?like the microwave and refrigerator stuff...

Even more relevant, because you probably have no control over, or might be totally unaware of, any changes or additions your company makes to your environment. Additionally, being an office environment, there will obviously be many more possible sources of the interference than there would be in your home.

That's pretty strange- just a longshot, but is it perhaps a question of the autoexec.bat file having its read-only attribute set?

I may dump Linux and go with 2000 Pro

Since you have an 80G hard drive, why dump Linux? You can just add 2K to your existing installs and have a quad-boot system.

NT-based systems such as XP use a file called boot.ini to store boot information for the operating system(s) you have installed; you can boot to DOS by adding the following line to the end of the file:

C:\="MS-DOS"

boot.ini is a hidden system file in your C:\ directory; to view it and edit it, open Windows Explorer and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

Open the file in Windows Notepad and cut-n-paste the contents of the file here.

Anyway after deleting the MSXMIDI.EXE file, i got an error msg stating that this required file is missing. Any idea on how to get rid of the error msg??

Do these three things:

1. Have HJT fix these entries:
F1 - win.ini: run=C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE
O4 - HKCU\..\Run: [xpsystem] C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE

2. Open your win.ini file with Notepad, locate the line that reads "run=C:\WINDOWS\SYSTEM\SERVICES\MSXMIDI.EXE". If that line exists, delete everything to the right of the = sign, and then save the file.

3. Check the C:\WINDOWS\SYSTEM\SERVICES folder once more just to make sure MSXMIDI.EXE was definitely deleted. If it wasn't, kill it now.

O10 - Broken Internet access because of LSP provider 'osmim.dll' missing -> regarding this wat does it mean anyways?

LSP = Layered Service Provider. Very basically, this is a Microsoft networking software component which is an extention/addition to the core TCP/IP software (TCP/IP stack). The word "layered" refers to the fact that many different individual networking components can be layered/stacked/chained together such that they act as a single "pipeline" for network communication. Unfortunately, malicious programs can insert themselves into this chain to alter that communication; think of it as a parasitic biological organism grafting itself into the ladder structure of DNA.
When the offending program is removed, it leaves a broken link in the chain, which should be repaired; one of these two programs might do the trick:

http://cexx.org/lspfix.htm
http://www.bu.edu/pcsc/internetaccess/winsock2fix.html

Sorry, my bad- you'll have to manually configure your IP settings as follows before you'll be able to try to get to the router's web config page:

IP address: 192.168.0.5
subnet mask: 255.255.255.0
gateway IP: 192.168.0.1

A reboot might be a good idea after making those changes.

You're right about that entry, but I don't see a likely culprit in your new log. I'll have to snuffle around for more info and get back to you.

If you truly created a new folder in your C:\ directory for HJT and moved the program to that folder, it should run from there without errors. Make sure you've actually moved HJT to the new folder and not just created a shortcut there.

Um, as I posted above:

"(If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed.)"

:mrgreen:

Is 192.168.0.1 really the address of the router? Actiontec doesn't seem to have squazoola in terms of support info on their site.

First of all, you need to do as crunchie said and create a new separate folder for HijackThis. You're currently running it directly from your desktop folder, which doesn't give HJT a centralized place to create and store its backup files.

Once you do that, run HJT from the new folder and have it fix:

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: (no name) - {39AC6708-B71B-7DCD-8275-645579D52A4C} - C:\WINDOWS\System32\gonlyshm.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [SuperBar.Component] C:\WINDOWS\system32\inetsrv\services.exe
O4 - HKLM\..\Run: [AdRotator.Application] C:\WINDOWS\system32\drivers\csrss.exe
O4 - HKLM\..\Run: [{357AA41A-B7A8-4632-A27D-5B980B25CF43}] C:\WINDOWS\system32\wbem\svchost.exe
O4 - HKLM\..\Run: [WindUpdates] C:\Program Files\WindUpdates\WinUpdt.exe
O4 - HKLM\..\Run: [Winad Client] C:\Program Files\Winad Client\Winad.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O16 - DPF: {23273A1C-C870-43C4-A3E3-67DC98630AC6} (IntSOFTEC Class) - http://213.229.160.209/dialers/it.cab

- Reboot into safe mode

- Open Windows Explorer. Go to the Tools menu and select Folder Options. In the Advanced section under the View tab, check "show hidden files and folders"; uncheck "hide extentions for known filetypes" and "hide protected oprating system files". Click OK.

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders:

1. Local Settings\Temp
2. Cookies
3. History
4. Local Settings\Temporary Internet Files\Content.IE5

- Delete the entire content of your C:\Windows\Temp folder.

(If you get any messages …

c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

The above entries seem to indicate that you had Internet Explorer runnning when you did your scan; please make sure all instances of IE are closed before having HJT perform any fixes!

Once IE is closed, have HJT fix:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.cyberpowersystem.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.makemesearch.com/?said=124
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.jxltmgmtnpcutokhvwl.com/...SLX6tL/peRs.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: ZIBho Class - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - C:\Program Files\Kontiki\bin\bh304181.dll (file missing)
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll (file missing)
O2 - BHO: (no name) - {A69ECDDB-8DE7-F546-E60D-313D527B06C0} - C:\PROGRA~1\COMPMP~1\AxisFlaw.exe
O4 - HKLM\..\Run: [SHIMFILMONCETHUNK] C:\Documents and Settings\All Users\Application Data\proxy grey shim film\send exit.exe
O4 - HKLM\..\Run: [amenextra] C:\PROGRA~1\VGABOW~1\Vcthunk.exe
O4 - HKLM\..\Run: [Windows Services] wsz32.exe
O4 - HKLM\..\RunServices: [Windows Services] wsz32.exe
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - C:\Program Files\Desktop Sidebar\sbhelp.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.cyberpowersystem.com

- Reboot into safe mode

- Open Windows Explorer. Go to the Tools menu and select Folder Options. In the Advanced section under the View tab, check "show hidden files and folders"; uncheck "hide extentions for known filetypes" and "hide protected oprating system files". …

explorer pops up saying i must close it due to some htmp error stuff.

Please be more precise; knowing the exact errors will help us find a solution more quickly.

I tried deleteing from adware and spyware program.

Which exact porgrams did you use?

last few programs i installed before thios thing happen is prolly kazaa

Filesharing systems like Kazaa are about the best way to get infected by spyware, pop-up ads, etc. You're really just asking for it there.

If it I type sys c: while in drive A and my dos start up disk in the floppy drive I get bad command or file name.

You've got the command right this time- not sure why you get the error.

I can not seem to find the sys files needed to make c drive bootable. are these hidden files?

The sys command copies three files, two of which are indeed hidden:

IO.SYS (hidden)
MSDOS.SYS (hidden)
COMMAND.COM (not hidden)

To verify that all three files are available on the floppy, use the following command:

DIR /A

Can you tell me why when I type in ( at the comand prompt ) a:\ sys or c:\ sys , d:\ sys it actually changes directories...

Your syntax is incorrect; the command to transfer system files to a given drive is "sys drive letter:'. For instance, if you wanted to make C: bootable, the syntax would be:

sys C:

With the syntax you're using, your commands are interpreted as:

A:\
C:\
D:\

which to DOS means "change to drive directory A:\, C:\, and D:\" respectively).

Does the system even recognise the physical drive?

Right-click on My Computer, choose Properties, and go to Hardware->Device Manager->DVD/CD-ROM drives. Do you see the drive listed there? If so, does it have a red X or yellow exclamation point next to it?

Try deleting the "WindowsRegKey..." entry.

Thanks for understanding tggoodrich.

I know that a lot of forums have no guidelines concerning "piggybacking" onto another thread, but many do; it reduces the chaos and makes it easier to methodically work through each individual's problem. :)

I deleted the .bat file and recreated it

Yes... that is what I'm asking about. How exactly did you "recreate" the file and what exact entries did you put in it?

You might be lucky enough to have a backup version of autoexec.bat on your system somewhere which, even though it might need a little editing, would at least give you a basic template to start with. Search your system for other files named autoexec (they'll probably have an extention other than ".BAT"; perhaps .BAK or .NSW).

O10 - Broken Internet access because of LSP provider 'wps.dll' missing

The above entry in your HJT log does indeed indicate a broken/corrupted TCP/IP stack, as others have suggested. The winsockxpfix program mentioned is only for Win XP, so it probably won't help you; try one of these alternative programs:

Winsock2 Fix

LSP-Fix

Have you been able to check the router's configuration settings yet? I'm not familiar with your particular model, but there should be a way for you to verify that it is obtaining IP info from your ISP on the WAN port and serving IP addresses to the LAN via DHCP.

Also, if the wi-fi adaptor came with any configuration/diagnostic utilities, see what those have to say.

Obviously, without being able to sit in front of your computer, it's rather difficult to say if the router is actually dead or not at this point.

No problem with the mis-posting; it was your first post, and you may indeed have issues other than those caused by the spyware. If you can post the exect text of some of the error messages you're getting we can probably help you pinpoint the problem(s).