Posts by DMR

Hi roswell1329, welcome to our site! :)

Your HJT log does show signs of the Antispylab infection, so let's get to work...

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

1. Download and install the following utilities:

CCleaner - www.ccleaner.com
ewido Anti-malware - http://www.ewido.net/en/download/

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open Windows Defender and check for/install the most current updates. Close the program after you've verified this.

- Open Norton antivirus and make sure that it has the most current virus definitions installed. Again- don't scan yet, just close the program once it's updated.

At this point, please close/quit all open programs and disconnect from the Internet.

2. Run another HijackThis scan, place a check mark in the boxes to the left of the following entries, and then click the "fix checked" button:
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O2 - BHO: (no name) - {e52dedbb-d168-4bdb-b229-c48160800e81} - (no file)
O4 - HKLM\..\Run: [Adware.Srv32] C:\WINDOWS\system32\runsrv32.exe
O4 - HKLM\..\Run: [Transponder] C:\WINDOWS\system32\susp.exe

3. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key just as your computer is starting up).

1. Those three dlls are legit components of your TCP/IP stack.

2. If you really are experiencing conflicts/problems caused by Norton (and that does seem likely given what you've posted so far), you'll need to have the option of uninstalling or at least disabling the program in order to definitively troubleshoot your system. Troubleshooting network connectivity problems with firewall/Internet security software active is just an excercise in tail-chasing. If you yourself don't have the rights to administer the Norton package, you should notify/involve the person who does.

That leads me to my last question.

Are ya still having problems?

Which leads to yet another question: What exactly are the problems?
If you can give us some idea of what troubles/symptoms you're experiencing, that would help. While HJT is a great tool for finding certain problems, it is by no means a comprehensive diagnostic (nor is it meant to be).

{22D6F312-B0F6-11D0-94AB-0080C74C7E95} is the Class ID for a version of Windows Media Player. Is it always that CLSID listed in the event log errors?

Cool- then marked as solved she be... :)

Apparently the Vonage adapter has some DCHP Server functionality...

Correctomundo!
If you've got Linksys RT312Ps, those are full-blown routers in and of themselves (the "RT" in Linksys product lines indicates "router"), so they can definitely act as DHCP servers. As a matter of fact, DHCP is active by default on those devices, at least the ones I've installed.

Good troubleshooting; glad you got it sorted :)
Does everything appear to be happy in IP Land now? If so, I'll mark this topic as "solved".

<EDIT>

I'll throw this link from Vonage's site in here just for reference; it contains info and instructions on connecting vonages devices in different network environments:
http://www.vonage-forum.com/setup.html

</EDIT>

Cool- glad you got it sorted fairly painlessly. :)

I'd go with a little more firepower than Ad Aware and SpyBot can provide:

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

1. Download and install the following utilities:

CCleaner - www.ccleaner.com
ewido Anti-malware (14 day trial version) - http://www.ewido.net/en/download/
Windows Defender - http://www.microsoft.com/athome/security/spyware/software/default.mspx

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open Norton antivirus and make sure that it has the most current virus definitions installed. Again- don't scan yet, just close the program once it's updated.

2. Run HijackThis again, put a check in the box to the left of the following entry, and then click the "Fix Checked" button. Close HJT once the fix is completed:
O4 - HKLM\..\Run: [Winram32 Driver] winram32.exe

3. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key just as your computer is starting up).

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types". Close Explorer after that.

* Run CCleaner.
- Go to Options-> Advanced: Uncheck …

1. Post the full details of the DCOM error; they might help. To do so:

Double-click on a DCOM error to open its properties window. In the Properties window, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

2. Before running the actual WinsockXPFix repair, did you have the program make a backup of your Registry first?
Of course you did, because you, like most other people, are a cautious and careful troubleshooter, right? :mrgreen:

If you were paranoid enough to make the Registry backup, run the ERDNT.exe program found in the backup folder to restore the Registry to its "pre-fixed" state. See if that eliminates any of the problems.

... i replaced it with an Intel p4 3.0 that survived in my washing machine and dryer.

You're really supposed to dry clean those things, you know.
I mean, sure- the washer/dryer trick usually works, but getting the wrinkles ironed out of a good CPU can be a big pain... :mrgreen:

Do me a favor - run HJT (from my signature) and post the log file...

Hi TiJay, and welcome to the site :)
While we definitely do appreciate help and other input from new members, please read this announcement, pinned at the top of every forum's main page, specifically regarding the posting of HijackThis logs.
Due to the sheer number of HJT logs that get submitted at this site, we confine those postings and the subsequent log analysis to our Viruses, Spyware, and other Nasties forum only.

A few questions:

1. Has the computer ever been a member of a domain (or at least configured as such)?

2. Can you manage to get in to the system via one of the options (Safe Mode, Last Known Good Configuration, etc.) available in the boot menu? (you get to the boot options menu by hitting the F8 key as your computer is starting up).

3. Have you installed/uninstalled any applications recently? Please think carefully about this one...

You're welcome; feel free to ask if you have any further questions.
Also- I see that this is your first thread- welcome to our site! :)

Thanks for the info- that explains a lot. Madness indeed; I feel for 'ya. :mrgreen:

With the network configuration you've outlined, it sounds like you'll want to retain the DHCP functionality if for nothing else than the ease of connecting the visiting/floating laptops to the LAN. If so, I'd suggest going the route (no pun intended, of course) of configuring the router's DHCP server settings to use a range (scope) of IP addresses that don't conflict with any IPs that you've manually assigned.

With a network range of 192.168.1.x and a subnet mask of 255.255.255.0, one common configuration is to set the starting address of the DHCP server's scope to 192.168.1.100, and to then assign all static IPs working from 192.168.1.1 (usually used/reserved for the router itself) up to 192.168.1.99.

1. Did you run WinsockFix, or WinsockXPFix?

2. Re-registering core cryptographic/security-related dlls often fixes the problem; see this post for specific instructions on that, as well as a few other possible solutions.

3. Is this problem specific to IE? Install Firefox and see if you experience the same access problems.

Your HJT log indicates one trojan infection (winram32.exe), so there's a good possibility that there are other infections lurking as well. Soooo- off to the Viruses, Spyware, and other Nasties forum we go....

1. See if the crashes are leaving any clues in your logs:

Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning". Double-clicking on such an entry will open a properties window with more detailed information on the error; post the details from a representative sample of some of the different error messages (please don't post duplicates or flood us with the entire logs). To do so:

In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

2. You didn't mention which web browser you're using; if you haven't tried to replicate the problem with more than one browser, try doing so.

Glad we were able to be of help, and welcome to the site! :)

Um... hang on here- just how many computers do you have on this LAN, and out of those, how many existed "pre-switch installation"?

The error messages you've posted are what you would expect on a network in which the computers are using a mix of dynamically assigned (DHCP) and statically assigned IP addresses, but where the scope of IP addresses handed out by the DHCP server (the router, in your case) overlaps the range of static IP addresses you've chosen.

As an example: You have a network (with or without a switch; the switch really is transparent here) in which the router is configured to assign computer IP addresses via DHCP from the private IP address range of 192.168.1.1 -> 192.168.1.50.
However, you also have 2 computers on that network which you have manually (statically) configured to use the IP addresses 192.168.1.7 and 192.168.1.8. In this scenario, the router has no way of knowing that the IPs 192.168.1.7 and 192.168.1.8 addresses are already in use, and, as those IPs are within its DHCP scope, it tries to assign those IPs to other computers on the network. Since each computer on the network needs a unique IP address, you can see where/why the conflicts occur.

Assuming I'm shooting somewhere close to the bull's eye here, you have two options:

1. Don't use DHCP at all; just configure all of the computers to use static IPs. For smallish networks …

Last time i had a vid card go bad i could atleast see the bios start so im worried this is a mobo problem or cpu rather than a vid card.

It could be a lower-level problem than the vid card, but even at the BIOS stage, the vid card is still part of the signal flow. The reason that one sometimes sees good output during the BIOS stage but not after that is that the card swtches to a different display mode once Windows takes over in the boot process. In other words, a vid card can fail in such a way that it can display the "primitive" output used by the BIOS screens, but not the more advanced modes used by the OS.

In the normal hierarchy of troubleshooting a problem such as yours, testing with a different video card would be the next logical step unless you have specific reason to suspect another component.

... the lights on router's ethernet ports would flash quickly and never be able to hold solid...so I'm off to the store today and if it doesn't work with the second one, I'll be back...

Ok- hopefully it's just a duff switch, but if the new gives you problems too, we'll be here... :)

Hmm- not quite clean, judging from this entry in your last log:
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

1. Download and install CCleaner. Don't actually run the program yet.

2. Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

3. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up) and:

* Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

* Open/Run CCleaner.
- Go to Options-> Advanced: Uncheck "Only delete files in Windows Temp folders older than 48 hours"
- Go to Options>CustomFolders>Add Folder>Navigate to these folders (click on bold file once and hit OK) :
* C:\Windows\Temp
* C:\Windows\Prefetch
* C:\Documents and Settings\<Your Profile>\Local Settings\Temporary Internet Files\ (This will delete all your cached internet content including cookies.)
* C:\Documents and Settings\<Your Profile>\Local Settings\Temp
* C:\Documents and Settings\<any other user's Profile>\Local Settings\Temporary Internet Files
* C:\Documents and Settings\<Any other user's Profile>\Local Settings\Temp
* C:\Documents and Settings\<Your …

... and its not working.

Well now, that certainly gives us a lot to go on... :mrgreen:
Please give us as many details as possible on your IP addressing scheme as a whole, what exact errors you've encountered, etc.

As far as the switch goes, the EZXS88W is nothing fancy, and there aren't any special configuration settings or the like involved with that device AFAIK. The only thing to keep in mind is that when using the uplink port on that switch, the normal/PC port directly adjacent to the uplink port becomes disabled; the two physical ports are shared internally, so the uplink and PC connections cannot both be used at the same time.

1. It's a bit unclear from your description: Do you get a proper display during the BIOS/POST phase?

2. Does the problem occur if you boot into Safe Mode?

3. If possible, connect another (known-to-be-working) monitor. Does the problem persist?

4. Change the video card.

That's definitely not a Good Thing; can you give us any more specific details on the problem and what (if any) troubleshooting steps you've already tried?

- What exact version of Windows are you using?
- Is there any more information in the error message, or is just the standard "A Disk Error Occurred, Press Ctr+Alt+Del to restart." error?
- Give us specific details of your hardware, especially your drive configuration(s).
- Did the system exhibit any symptoms of problems before the crash occurred?
- Had you recently made any significant hardware/software changes?
- Is the hard drive correctly recognized/reported in the BIOS' setup?
- Can you boot from the Windows installation CD?

A fairly common question/problem; the solution is known as "bandwidth limiting", "bandwidth shaping", or "bandwidth throttling".

The options are basically these:

1. Use a router which supports QoS (Quality of Service). Through QoS, the router can manage/limit/prioritize bandwidth usage on a per-computer, per-application, or per-port basis. The Linksys WRT54G is one popular router which has QoS, but there are others.
This is probably the best (and least complex) solution for you.

2. Bandwidth-shaping applications such as NetLimiter can be installed. However, the software would have to be installed on the computer whose bandwidth you want to control, and I doubt your brother is going to go for that...

3. A cheap Linux machine can be used instead of (or in addition to) a hardware router. The Linux OS has built-in network routing/filtering capabilities which make it a pretty powerful solution for traffic management, but the downside is that you really need to know what you're doing. If you aren't Linux-savy, this solution isn't for you.

Probaby, we have to ask you to post your problem inside a new thread.

We'll help ya from there.

Thanks.

Yes, exactly.

pro_baby2008,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.
Also- submitting multiple posts about a question or problem is not allowed here; please post your question only once, in the most suitable forum, and we will respond to it as soon as we can.

Please start your own thread and post your question there. In your post, please give us as much detail as possible, including the full and exact text of the error message you are receiving.

If the error message you are getting is exactly the same as the message that the member who started this thread was getting, you have at least one malware infection on your computer. When you start your new thread, please do the following:

Download the (free) HijackThis utility. Once downloaded, follow these instructions to install and run the program:

Create a folder for HJT outside of any Temp/Temporary folders and move/extract HijackThis to that folder now. A folder such such as C:\HijackThis …

Due to the fact that the member who originally started this thread has not responded over 1 year, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar questions or problems need to start their own threads and post their questions there.
In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Due to the fact that the member who originally started this thread has not responded in over one year, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar questions or problems need to start their own threads and post their questions there.
In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Due to the fact that the member who originally started this thread has not responded in almost one year, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar questions or problems need to start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Due to the fact that the member who originally started this thread has not responded in over 1 year, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hello,

i have the same problem

Hi amandak,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your HijackThis log in that thread. The log you posted here does show signs of at least three separate infections, so you should get that thread started ASAP...

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

well, seing as i'm still getting the 'blue screen of death', it's not as easy to get on and run those programs as you make it out to be...

In your last post you said you could "dodge the Blue Screen of Death" in Safe Mode. I was hoping that the BSOD Gremlins might leave you alone long enough to run the utilities in Safe Mode, but I guess that isn't the case. Bummer...

my brother told me it is possible somehow to reinstall or repair windows with the driver disc without losing the entire contents of my hard drive... if this is possible, how do i do it?

It's possible, but not with the driver disk; you'll need the original XP installation disk.
A good walk-though of the Repair installation process can be found here, but if you decide to go that route, please read the instructions and warnings fully and carefully! There is always at least some risk of accidental data loss when performing such an operation, and there is also a chance that it will not fix the problems.

However- given what you've tried already, and the fact that you can't run diagnostic programs at this point, the Repair install is the next thing I would be trying if it were my system.

I will post back as soon as this proves either to be the problem or a red herring.:rolleyes:

[IMG]http://www.stevewolfonline.com/Downloads/DMR/Visuals/fishwhack.gif[/IMG]
You...Your ISP

Cool- glad we could help :)

Hi nickakastu, welcome to DaniWeb :)

* What version of Windows are you using?
* When did the problem start to occur?
* Had you made any changes to the system at about the time you first noticed the problem?
* When you say: "or anything else in that table", what"table" are you referring to? Please be more specific.

Download and run the free IEFix utility.

Let's get a bigger picture; please do the following:

* Click on the "Run..." option in your Start menu. In the "Open:" box of the resulting window, type "cmd" (omit the quotes) and hit Enter. This will bring up a DOS window

* At the DOS prompt, type the following command and hit Enter. You won't see any result from the command, but when it completes a second prompt with a flashing cursor will be displayed; close the DOS box once that happens:

ipconfig /all >ipconfig.txt

* The above command will have created a text file on you desktop named ipconfig.txt; double-click on the file to open it in Notepad, and then cut-n-paste the file's contents in your next post.

MOM24 has found the solution to the virtual memory error message, so I'm marking this one as solved.
The solution the member found can be viewed here:
http://www.daniweb.com/techtalkforums/thread44050.html

Hi DarkWarrior088,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

In light of the above, I've split your post into its own thread, which is located here:
http://www.daniweb.com/techtalkforums/thread44061.html

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

When i try that it says it already has a copy should i replace it with the new one?

Yes.

... It turned out that when norton has the popups saying blah blah is trying to connect to the internet, accept or deny, she put deny... but somewhere there is a list of things it has blocked or allowed...

Yeah, it's easy to make that mistake; I've had a number of clients do the same thing.

Binoirm, here are a few things to try:

1. Re-enable Norton and reboot; just having turned it off and then back on might have cleared up the glitch.

2. Look through Norton's list of allowed/blocked programs as nizzy1115 suggested; you may very well find something(s) blocked that should not be.

3. Norton's Internet Security package has a "Program Scan" feature which looks at your installed programs and tries to automatically create a list of access rules for all of the programs which are known to need network/Internet access. It is the Program Scan feature which generates the original list that nizzy1115 mentioned, and sometimes that list gets corrupted (for reasons beyond the comprehension of we mere mortals).
I've had situations where I needed to remove every program in the list and then force a manual program scan in order to restore the correct network access rights. This page on Symantec's support site has a walkthrough on using the Program Scan feature.

Hi mcrrcoker,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem; the more details we have, the faster we'll be able to help you.

For a full description of our posting guidelines and general rules of conduct, please see this page:
http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

actually not solved but solved

I was referring to the above statement, which is a quantum superposition of seemingly contradicatory states.

Give Schrodinger's cat a scratch behind the ears for me, will you please? I'm off to bed now....

Huh??

It's a Quantum Physics thing; don't sweat it... :mrgreen:

In one of my previous posts I asked you to run Spy Sweeper and post the resulting log. Any chance of doing that, and/or getting ewido to run? HijackThis alone isn't giving us enough feedback or removal "firepower", so I'd really like to see reports from at least one of the other utilities.

Keep us posted on your progress...

Due to the fact that the member who originally started this thread has not responded in 2 years, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi Batt,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

Yeah, RAM is a common failure point in cases of random shutdowns/BSODs, so although it doesn't sound like the most likely suspect in this particular case, it is worth testing to rule out the possibility.

Also- RAM faults can be subtle, exhibiting themselves only (as sykopath8 mentioned) during times of heavier resource usage.