Posts by DMR

Hi mlesniak,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

Please give us as much specific information as possible, please. (You didn't even tell us what version of Windows you're using.)

* Can you reach the site by using its IP address instead of its URL?
* Can you ping the site, both by URL and by IP address?

-

I had windows 2002 which i than replaced with xp.

Windows 2002?? There is no such beast. Did you mean Win 2000?

Before I suggest any fixes, please tell us if the move to XP a full, fresh installation of XP, or if it just an upgrade to your Win 2000 installation.

You do it as a Scheduled Task. Instructions are here:
http://www.microsoft.com/windowsxp/using/helpandsupport/getstarted/ballew_03may19.mspx

Or maybe we'll have to wait for Firefox 2.0

Crud. Just installed FF 2 beta 1; no fixy problem. :(

I'll pass Dani a link to this thread; maybe something will jump out at her.
Or maybe we'll have to wait for Firefox 2.0.............

Win: 98, 2K, XP
Linux: Fedora, SuSE, Mandriva

Definately for spyware....

Not any more, unfortunately; neither Ad Aware nor SpyBot can deal with many of the newer and nastier infections.

For Windows XP, installing Microsoft's free "Windows Defender" program is something you should do if you haven't already. Links to "ewido Anti-spyware" and some other highly recommended utilities can be found in this thread.

The missing dll error is a result of your infection(s), and the fact that the Task Manager becomes disabled every time you boot tells me that you machine is probably not infection-free yet.

Please do the following:

Download the (free) HijackThis utility:

Once downloaded, follow these instructions to install and run the program:

Create a folder for HJT outside of any Temp/Temporary folders and move the HijackThis.exe file to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file in to a new thread in our Malware forum (we do not deal with malware in this particlar forum). The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

In your new post, also include descriptions of the problems you are having or include a reference link to this thread.

-

Due to the fact that the member who originally started this thread has not responded in over 1 year, and also indicated that his problem was solved, this thread is now closed.

In accordance with our posting rules, other members having similar questions or problems need to start their own threads and post their questions there.
In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi Swiss,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

1. Is it that the two machines can't communicate with the router at the same time, or that the two machines can't communicate with the Internet at the same time?

2. Is this a wireless-related problem? That is, can you (or can you not) get the two machines online if you connect the computers simultaneously to two of the wired Ethernet ports on the router?

3. Get one of the computers connected through the router to the Internet and then do the following on that machine:
* Click on the "Run..." option in your Start menu. In the "Open:" box of the resulting window, type "cmd" (omit the quotes) and hit Enter. This will bring up a DOS window.
* At the DOS prompt, type the following command and hit Enter. You won't see any result from the command, but when it completes, a second prompt with a flashing cursor will be displayed; close the DOS box once that happens:
ipconfig /all >"%userprofile%"\desktop\ipconfig.txt

The above command will have created a text file on you desktop named ipconfig.txt; double-click on the file to open it in Notepad, and then cut-n-paste the file's contents in your next post here. The contents of the file will give us some important details of your IP configuration.

This may sound obvious, but since you didn't mention it explicitly:
Are you getting the same results from your test when you use the sites' IP addresses instead of their URLs?

Also- what exact sites are we talking about?

-

I can open IE (where the threads appear correctly) and edit out a bunch of the redundant info in one or two of the logs (like tracking cookie detections in ewido logs) to shorten the thread.

I just tested that on this thread, and it worked for me (yay!).
While in IE, I took out all of the blank lines that were in the Kaspersky log in the first post here, saved the changes, and then came back to the thread in FF and was able to view it correctly.

Hmmmm.........

DMR do you know how to fix this whiteness.

No, but let me guess: you're using Firefox, right? If so, you're not alone; it happens to other Firefox users, including me. It's happening in this particular thread for me too.

It seems to be at least partly a length issue, as threads in this forum can get very long due to logfile postings. Dani once suggested that might be something about the actual contents of the logs thenselves, but we were never able to pin down a culprit.

The only thing I do know is that if encounter one of those threads while I'm using Firefox, I can open IE (where the threads appear correctly) and edit out a bunch of the redundant info in one or two of the logs (like tracking cookie detections in ewido logs) to shorten the thread. Once I do that, the whole thread displays properly in Firefox. [IMG]http://www.stevewolfonline.com/Downloads/DMR/Visuals/dunno.gif[/IMG]

If you post the results of whats running...

If the original poster is still alive... :mrgreen:

(Hint: this thread has been inactive for over 7 months)

Also do you know what the following are?

Level 3 Communications, Inc.

RIPE Network Coordination Centre

If you dont go to HJT and check all of the entries that have 017
behind them.
Close all other windows and click fix checked.

Info on RIPE: "The RIPE NCC is one of five Regional Internet Registries (RIRs) providing Internet resource allocations, registration services and co-ordination activities that support the operation of the Internet globally."

However, addresses assigned by RIPE may belong to malicious domains, and that's true in this case: the entire IP address range of 85.255.112.0 - 85.255.127.255 is owned by the fine folks who bring us the Smitfraud/SpyWareQuake/SpyAxe/SpySheriff infections. Any time you see an 017 HJT log entry containing a 85.255. IP, it should be fixed and the system should be checked for the above-mentioned infections if that hasn't already been done.

Level3 is a legit network service provider; the 209.244.0.3 and 209.244.0.4 IP addresses belong to Level3's (legit) DNS servers.

Ahhh- that explains it. You probably don't have any more infections; "fastclick" ads are usually served from the website you're visiting, not from something malicious that's actually installed on your computer.
The specific message you're getting from Internet Explorer is due to this IE option being enabled.

The FastClick folks work pretty hard to find ways to get around pop-up blocking software, but these solutions might help with fastclick and other annoyances that you can encounter at different site:

Configuring popup blocking settings built in to IE: http://www.microsoft.com/windowsxp/using/web/sp2_popupblocker.mspx

Configuring popup blocking settings built in to Firefox is done by going to Tools->Options->Content. The settings are pretty self-explanatory.

The free "IE-SpyAd" utility for IE: http://www.spywarewarrior.com/uiuc/resource.htm

The free SpyBot Search & Destroy utility has an "Immunize" feature.

The free SpywareBlaster utility blocks "bad" sites in IE.

and it has two ide cables...

Right- one cable for the controller's Primary channel, one cable for the Secondary channel. That means that you can connect two drives to each cable for a total of 4 devices.

You are running a very outdated version (1.99.0) of HijackThis. Please download and run the latest version (1.99.1) and post the log that the new version generates.

[Note from DMR:
Hey folks- I found this post wandering around all lost and alone in a separate thread, so I thought I'd bring it back here to its family. :D]

Ok, i did the repairs listed in my last post, here are the latest HJT and ewido reports.

Thanks,Benny

Logfile of HijackThis v1.99.1
Scan saved at 5:35:46 PM, on 7/17/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~3\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\NORTON~3\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Trend Micro\Tmas\Tmas.exe
C:\Program Files\MSN\MSNCoreFiles\msn6.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\My Documents\Trojan Remover\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1082\en-us\msntb.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: ZeroBar …

That is not a pretty log. :(

You have multiple infections, so let's start with some general malware removal steps:

* Uninstall the BPS Spyware & Adware Remover software; the product is not reputable or recommended. See this link for more info on BPS and other "bogus software products.

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

* Download the most current updates for Windows Defender and Norton Antivirus.

* Download the following utilities:

ATF-Cleaner
ewido Anti-spyware (30-day trial version) - http://www.ewido.net/en/download/

To Install and Configure ewido:

• Close all other Applications and then run the ewido installer
• Select language click Ok
• Click I Agree
• Click next
• Click Install
• Click Finish
• Wait Ewido will open main screen automatically.
• Wait again a few minutes and Ewido Should Auto update itself. If it doesn't click update at top of screen.
• It is very important to get the updates
• When updating has finished. Close Ewido.

* Close all open programs/windows, (especially web browsers). Run another HijackThis scan, put a check in the boxes to the left of the following entries, and then click the "Fix Checked" button.
Close HiajckThis once the fixes complete:

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {3ceff6cd-6f08-4e4d-bccd-ff7415288c3b} …

This thread pretty much covers all of the suggestions that I was going to post here. The three main areas covered in thread above are:

* Further steps to qualify/disqualify faulty RAM as a possibility.
* Verification of your hardware and driver compatibility.
* In-depth analysis of the "dump" files created by the BSODs.

The troubleshooting steps in the thread are very well detailed, so it shouldn't be too daunting to try the suggestions. Post your results, and/or any questions, here.

Given the fact that there are multiple accounts on the machine, each with multiple problems (not all of which may be malware-related), it might actually be more efficient to rebuild the system.

There are no more signs of infections in your logs. Can you give us any specific information (websites, product names, company names, etc.) that appear in the ads?

What exactly do you mean by "won't allow you"?
Remember that we're not sitting there at the computer with you, so you need to provide as much specific info as possible in your posts.

0x08E stop errors iusually ndicate either a driver problem or a faulty RAM module.

* Given that particular STOP error, it would be a good idea to roll back/uninstall/reinstall the Omega drivers and any other driver software you may have recently added or chenged.

* Run the System File Checker, which will attempt to find/replace/repair damaged or missing Windows system files. Info on SFC can be found here.

* Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning", especially those that occur at or very near the time that the system Blue Screens.
Double-clicking on such an entry will open a properties window with more detailed information on the error; post the details from a representative sample of some of the different error messages (please don't post duplicates or flood us with the entire logs). To do so:

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.
(Please note that booting into Safe Mode generates a lot of error messages about different components …

Should i reinstall my old drivers?

Doing that might compound the problem rather than fix it.

Let's turn off the function that automatically restarts the computer after a BSOD failure; that will at least allow you to read the entire BSOD error screen. The screen could contain a useful error code or filename which will help us narrow donw the cause:

* Right-click on your My Computer icon and choose Properties from the resulting drop-down menu.
* In the System Properties window, click on the Advanced tab.
* Under the Startup and Recovery section of the Advanced tab, click the Settings button.
* Under the System Failure section, check the Write an event to the system log option and uncheck the Automatically restart opiton.
* Click the OK button in the Startup and Recovery window and then OK again in the System Properties window.
The next time the BSOD occurs, the system will just freeze on the Blue Screen instead of restarting. Write down the full and exact contents of the BSOD error and post it here.

I couldn't find specs for that particular motherboard, but from what you posted, you appear to have (2) 82801EB controllers on the motherboard. Each 82801EB controller has a Primary and a Secondary channel, so you should see 4 IDE/ATA connectors on the motherboard. Does that sound about right?

Since each channel of each controller can handle two drives, it looks like you should be able to connect 8 drives to that system.

the reason behind is tht , with limited or no connectivty the icons keeps on flashing try that.

Er... just turning off the notifications won't fix the actual problem, now will it? :mrgreen:

Welcome to the site, networkisdown :)
If you have specific questions about your laptop, feel free to ask. Just start a new thread in which ever one of our forums seems most suitable, and one of members will help you out from there.

While cable Internet services usually use DHCP, PPPoE (Point-to-Point Protocol over Ethernet) is most common with DSL services; it's probably what your friend's ISP is using. The reason that the computer can reach the Internet when connected directly to the modem is that the ISP's setup software installed and configured the PPPoE client program on the computer. You may even see a PPPoE adapter listed in the Network Connections settings or in the output of the "ipconfig /all" command.

When using the WRT54G with a PPPoE modem, configure the router as follows:

* Choose PPPoE in the protocol drop-down box.
* In the User Name box, enter the user ID that the ISP gave your friend when the account was set up. This is often the email address associated with the account.
* In the Password box, enter the password that the ISP gave your friend when the account was set up.
* The Host Name may or may not be required. The ISP can tell you about that.
* The Domain Name is the ISP's domain name (without the "www" prefix).
* Leave the MTU setting at Auto. The default PPPoE MTU (Maximum Transmission Unit) value is 1492.
* Click the Save Settings button to apply the changes.

To properly initialize the connection once you've configured the router, it's best to:

* Power down the modem, router, and computer.
* Wait about 30 seconds or so.
* …

It's crapware; have a read of this explanation of the program:
http://www.stopbadware.org/reports/reportdisplay?reportname=pcmightymax

As the original poster's problem was resolved more than two years ago, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar questions or problems need to start their own threads and post their questions there.
In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi c_flowers,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

In light of the above, I've moved your post into a new thread of it's own, which you can find here:
http://www.daniweb.com/techtalkforums/thread50233.html

Please read this page for a full description of our posting guidelines and general rules of conduct:
http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

-

Call your providor get them to do a thourough line test, it could be a faulty line.:sad:

Or a fault with the modem. Either way, your provider can narrow down the culprit with the line test. Also- they don't need to send a tech to you or anything complicated; they just run the test from their end.

Assuming by "broken", you mean that it sustained physical damage, you should take it to a repair shop and have it examined. Even the smallest fracture on the circuit boards could be responsible for major problems.

It really depends on the exact model of your motherboard. Do you have any info/specifications for the motherboard?

Please give us the full and exact contents of the BSOD error screen.

This happens with various updates, and it happens for various reasons. You'll probably have to uninstall and then reinstall the package, although sometimes just installing it again on top of the already-installed verison clears things up. A full, fresh reinstall may require a Registry edit; info on the process can be found here:
http://www.updatexp.com/windows-update-already-installed.html

Does the ide controller exist in the hard disk itself and only the IDE host exists in the PC mother board?

The host controller circuitry resides on the motherboard, or in the case of an IDE/ATA accellerator/expansion card, on the card. The drive controller circuitry is (obviously) on the drive.

how can I find out that how many IDE hosts my mother board had

Look on the motherboard or consult your motherboard's documentation. Traditionally there are two IDE channels (Primary and Secondary) on a motherboard.

and how many hard disk I can connect to each ?

You can connect a maximum of two devices to any given IDE channel.

Due to the fact that the member who originally started this thread has not responded in over 1 year, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar questions or problems need to start their own threads and post their questions there.
In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi gabex,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

As the original poster's problem was solved over two years ago, this thread has been closed.

In accordance with our posting rules, other members having similar questions or problems need to start their own threads and post their questions there.
In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi aliceryuryu,

First of all- welcome to DaniWeb :)

As per our forum rules, we ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your log there. When you do post the log, please make sure you post the entire contents of the file; the log you posted here is missing some important header information (compare it with logs posted by other members).

Thanks for understanding.

I see no problems in your HijackThis log, exept this:

C:\Documents and Settings\User\Desktop\Spyware Doctor 3.8.0.2575\Spyware Doctor 3.8.0.2575 + good crack\crack\swdoctor.exe

Crack? Really...
Pay for the product or don't use it.
Working on systems that are running illegal software goes against our forums rules. Personally, I'm not going to assist anyone who is using illegal copies of antimalware utilities; kind of rub me the wrong way........

Hi- sorry for the delay; "real life" has been hectic latley.

I can't honestly tell if the biU.exe file is really still on your system, or, if it is, if it's going to present any problem. If you'd like a "second opinion" to AVG's findings, you can try the free online virus/spyware scanners plisted at the end of this post.

As far as Norton goes, it sounds like the infections did corrupt it (which is not uncommon). It should work properly if you reinstall it.

Hi- sorry this fell throught the cracks.

ewido obviously cleaned a couple of hiddne nasties, but I'm assuming the missing Run option, Task Manager, etc. are still problems, yes?

If so, please tell us the exact name of the worm decribed on the Symantec site. As you've discovered, many such infections make changes to certain areas of the Registry which disable potentially useful tools like Task Manager, Regedit, the Run option, etc.
I'm pretty sure that there is a Registry fix file available which resets all of the altered Registry settings that get modified by the infections, but I want to make sure we're applying the right fix for the right infection before I post that Reg file.

memtest is not a Windows executable program (it's acutally Linux-based), so you need to make the boot floppy (or CD). The process is really pretty easy.

I suggested that you check the RAM and other components first not only because the errors often point to a hardware (or driver) problem, but also because you said that you just built the machine and have been getting the errors since then. In other words, you could waste time looking for a software/program fault when in fact, you may have a faulty/mismatched/mis-installed piece of hardware.