Posts by DMR

Your latest log is clean. Is the computer still exhibiting problems? If so, please try to give us as many specifics regading the problems as possible.

As the member who originally started this thread has not responded in nearly two years, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi frankieroks,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, names/versions of relevant programs, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

Glad you got it sorted out. :)

* Is the network adapter an internal PCI card, or a removable (USB, PCMCIA, etc.) device?
* Do you know the make and model # of the device? If so, post that info.

Hello mdimranullah, welcome to DaniWeb :)

Obviously, teaching someone a programming language is well beyond the scope and purpose of our site, but if you have any idea of what programming language you are interested in or what type of programs you would like to write, I'm sure we can at least give you some good beginner's resources.

Due to the fact that the member who originally started this thread has not responded in quite a long time, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi myaspop007,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

There are generally two types of DSL you can get...ADSL (Asynchronous) and SDSL (Synchronous). Synchronous essentially means the connection is "always on" and Async simply means that the connection must be initiated in some fashion before you can get to the Internet...the software you installed on your pc may be doing this for you or the old USB DSL modem itself. I am much better with cable modem standards so if anyone wants to correct me about DSL stuff, please do!

Actually, the major difference between the two types of DSL is that with SDSL, the upload and download speeds are identical (Symetric), but with ADSL the maximum download speed is greater than the max upload speed (Asymetric). SDSL also demands the use of a dedicated line, whereas ADSL can be "piggybacked" on top of the existing line which carries your telephone service.
In terms of the "always on" characteristic of a broadband connection, it could probably be (and probably has been) argued that neither PPPoE or PPPoA are truly always on connections because both protocols, being based on the PPP technology used for dial-up modems, do require that a session connection request be initiated at the user's end (either via software on the client computer or by the router, if a router is used).

You're welcome. Did that do the trick for you?

this is whats confusing me so much. i've heard that to connect up to a dynamic IP connection i need to enable the dhcp client, yet, under the modem properties it states that it is pppoa, meaning i can either follow the modem and use pppoa without the dhcp client or use something else and enable the dhcp client.

Yes- the different terminologies and protocols can (understandably) cause confusion. One thing to keep in mind here is that use of dynamic IP assignment by your ISP does not automatically mean that DHCP is the protocol used to facilitate those IP assignments; IP addresses assigned by PPPoE and PPPoA can be (and in fact usually are) dynamic addresses.

when i connected up to homecall, i was only given a usb modem.

That does beg the question of how you are then able to connect that modem to the router. Can you give us the details on that please?

Although I understand that you eventually want to connect wirelessly, I second chrisbliss18's suggestion of wiring the computer directly to the modem as a first step. Not only will doing so verify whether or not you can achieve a basic connection, but the connection information gleaned from the ISP's supplied setup/connection software could provide configuration information which could be helpful to us in terms of configuring the router.

* Right-click on the My Computer icon on your desktop and choose Properties from the resulting context menu.
* In the Properties window, click on the Hardware tab.
* In the Hardware tab, click on hte Device Manager button.
* Under the Network Adapters heading, see if there is a network device marked with a Red "X". If so, double-click on that device entry and post the information listed in the General and Driver tabs of the device's Properties window.

If the modem uses PPPoA (or PPPoE; most DSL providers use one or the other) you should set the same protocol type in the WAN/Internet settings on the router, making sure to enter your username and password in the appropriate PPP boxes. DHCP is a different protocol, and as such, is not used when connecting to PPPoA or PPPoE modems.

Did you buy a new router, or are we still working with the original router. If you've purchased a ne router, please post the exact make/model name.

[img]http://www.wombania.com/wombat-pictures/wombat_4.jpg[/img]

Being a Wombat, I'm mostly here for the fresh green grass and yummy roots. Of course, those pesky malware infections make delicious desserts, so I try to snarfle up as many of those as I can while I'm around.

The original ranking system was:

Junior Poster >= 0 posts
Posting Whiz >= 100 posts
Senior Poster >= 250 posts
Guru Poster >= 500 posts

But in this thread, Dani indicated that she upped the ante x10 when she redesigned the site, so you should become a Posting Whiz (or perhaps Cheeze Whiz) at 1K posts.

I suppose I can't solve this problem by simply deleting that audio file, right?

Actually, I was going to suggest that. Delete the file, run Spy Sweeper again, and post the new log.

Spy Sweeper indicated that I have a "rootkit".

I'm pretty sure that the "violin concerto" audio file is causing Spy Sweeper to throw up the rootkit warning. The file is .wma format, which brings up the possibility of monopolistic money grubbing... er, I mean, *cough* music industry copy protection software being installed. I see no signs of such software on your computer, though.

Can you post the Spy Sweeper log from the Safe Mode scan?

I wrote "bye". I didn't mean "goodbye"; bye is the password. Don't ask me why, though; I didn't write the program...

Sorry, I forgot about the password prompt; the password is:

bye

Why didn't you ask one of your company's IT people to help you with this in person? That probably would have been the fastest and most reliable way to accomplish what you're asking us about. Regardless:

1. This link has step by step instructions for using Outlook's built-in Rules Wizard to accomplish the forwarding you're asking about.

2. To leave copies of your messages on the Exchange server:

- Open Outlook.
- Click on the Tools menu.
- Click on the "Email Accounts..." option.
- Click on the "view or change email accounts" option and then click the Next button.
- Double-click on your email account name.
- Click on "More Settings".
- Click on the "Advanced" tab.
- Put a check mark in the "Leave a copy of messages on the server".
- Click OK.
- Click the Next button.
- Click the "Finish" button.

Close all open programs, as this next step requires a reboot. You also need to be totally isolated from the Internet; physically unplug the network/Internet cable from your computer.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter. It will process then start. Your desktop and icons will disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, it will be ready for a reboot. Press any key to reboot.

After the reboot, notepad will open with a log. Copy the contents of that log and paste it back into this thread (after restoring your Internet connection, of course). Also run HijackThis again and post the new log.

I want to make sure that I one of the moderaters of the forum confirms this onfo before I use this application to solve my problem.

One "moderator confirmation" here, fresh out of the oven... :)

O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_98.dll' missing

Unfortunately, HijackThis can't actually fix a broken Winsock stack; it can only alert you to the fact that the stack has been broken (in this case, by the removal of the malicious newdotnet LSP).

Luckily, we have a pretty painless solution:

1. 1. Download the Winsock XP Fix utility.
      This utility will make a backup of parts of your Windows registry, reset your TCP/IP settings and replace your existing Winsock2 registry entries with a default set and replace your Hosts file with a default one.
   2. Launch the WinsockXPFix.exe
   3. On the Winsock and TCP Repair Utility screen, click ReG-Backup.
   4. On the Welcome screen, click OK.
   5. On the Backup to: screen, click OK.
   6. On the Folder does not exist question screen click Yes.
   7. You will see a status screen as your registry is being backed up.
   8. On the Registry backup is complete! screen, click OK.
2. Reset the Winsock Stack
   1. On the Winsock and TCP Repair Utility screen, click Fix.
   2. On the Apply the VB_Winsock fix? screen click Yes.
   3. The Winsock and TCP Repair Utility screen will display a status message.
   4. On the Repair Completed screen click OK to re-boot your computer.
   5. If your computer was not using DHCP, you will need to re-configure TCP/IP.
   6. You should have connectivity restored.

First of all, I tried to add to the old thread but I couldn't figure out how.

I've merged the old thread into this one for you. :)

It was not my IP address so I checked it

:eek: Those weren't your IP addresses, they were the DNS server IPs assigned by your ISP (Tiscali). If your ISP automatically assigns you the IP/Gateway/DNS IP addresses, don't sweat it; your computer will re-acquire the info. If you manually enter your IP settings into your network card's Property pages, re-enter those addresses in the DNS server section of the Properties window.

Glad you found the problem, and the fix. :)

This thread is 9 months old - why dig it up?

9 months? Check again- this puppy was started over a year ago. :eek:

Due to that fact, and to the fact that the member who originally started this thread has indicated that his problem was solved, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

I thought so; the Doubleclick and Avenue A messages from SpyBot usually come together (the sites are trying to set cookies on your machine). To get rid of the messages, please do the following:

Open SpyBot and click on the "Immunize" option. In the Immunize window, put a check mark in the "Enable permanent blocking of bad addresses..." box and choose "Block all pages silently" from the pull-down menu.

Hi racecar22,

You still have a few signs of malicious entities in your HJT log, including a variant of the Look2Me parasite and a CoolWebSearch (CWS) infection. To begin with, please do the following:

1. Download and run these CWS-specific removal tools (before scanning/fixing with about:buster and CWShredder, use their online update features to make sure you have the most current updates installed):

CWShredder - http://www.intermute.com/spysubtrac...r_download.html
about:Buster - http://www.majorgeeks.com/AboutBuster_d4289.html
HSRemove - http://www.majorgeeks.com/HSRemove_d4286.html

2. To remove the "crazywinnings" site referenced in your log:

- First, remove the site from your Trusted Zone:
Start Internet Explorer, click Internet Options on the Tools menu, and then click the Security tab. Click Trusted Sites, and then click Sites. Click the "crazywinnings" site, and then click Remove.

- Click on the "Run..." option under your Start menu, type "regedit" (omit the quotes) in the resulting "Open:" window, and hit OK. This will open the Registry Editor program.

- In the editor, press F3 to bring up the Find window, type crazywinnings in the find box, and hit enter. There may be more than one "crazywinnings" entry, so you need to keep repeating the find until you get the message "finished searching through the registry". Delete all "crazywinnings" entries you find.

Do not delete or modify anything else in the registry!!!

3. Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot …

What is Avenue A, Inc.? Basically, they are one of those well-loved Internet marketing/data gathering/etc. companies. From the "About Us" section of their website, we get this descriptive little gem:

Avenue A | Razorfish is an interactive services firm that helps companies use the online channel as a marketing and business tool. We combine data, insight-driven design, leading technologies and rigorous optimization to build strong brands and improve relationships with customers, employees and partners.

If you really want to make yourself violently ill, read some of the other creative crapola they have posted there... [img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/puke3.gif[/img]

Does the message you get come directly from IE, or is it generated by one of your antispyware programs (SpyBot, perhaps)? It sounds as though one of your adware/spyware programs is alerting you to the fact that a site is trying to put an Avenue A cookie on your machine.

Your log looks infection-free, but if you want to do a little more in-depth detection and cleaning, here's the "canned answer" method I usually suggest:

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

1. Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot Spy Sweeper (14 day free trial) - http://www.webroot.com/shoppingcart...4011&vcode=DT02
ewido Anti-malware - http://www.ewido.net/en/download/

- Open Spy Sweeper, click on "Options", and then click on "Update Definitions" under the Program Options tab. Do not run a scan yet; just close the program once the update completes.

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.

- Open Norton antivirus and make sure that it has the most current virus definitions installed. Again- don't scan yet, just close the program once it's updated.

2. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key just as your computer is starting up).

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select …

OK- you've got one NTFS partition which occupies the entire drive. In that case, if you want to make another partition on the drive without starting over from scratch, you'll have to resize/shrink the existing partition with a utility such as Partition Magic.

IT wouldn't hurt to clean it out anyways...

That log is from the threadstarter's (walton's) post; dano27green's posts are actually separate "piggybacked" posts....

OK- that looks better :)

1. Open ewido and SpySweeper and use their online update features to make sure you have the absolutely most current updates installed for both programs. Do not run scans with the programs yet, just close them once they finish the update process.

2. Create a new folder on your desktop (or in some other convenient location) and name it VundoFix. Download the VundoFix.exe utility and save it in the new folder.

* Run vundofix.exe
- Click the Scan for Vundo button.
- Once it's done scanning, click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click YES.
- Click yes; your desktop will then go blank as it starts removing Vundo.
- When the removal is complete, you will be prompted to shutdown your computer; do so.
- Start the computer again and let it boot normally.

3. Run HijackThis again, put a check mark in the box to the left of the following entries, and then click the Fix Checked button:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {20D57A66-F7DF-467d-907B-9B7F4A118AB7} - (no file)
O4 - HKLM\..\Run: [Microsoft Telecoms Center] telcoms.exe
O4 - HKCU\..\Run: [Microsoft Telecoms Center] telcoms.exe
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.

Can you give us the specifics of your drive and partition layout(s) please? It's definitely possible to create new partitions after installing the operating system, but exactly what you need to do to accomplish that depends on how your system is currently configured.

Good find, dano27green; thanks for posting the fix. :)

I updated Windows XP...

Not according to the header information in your new HijackThis log; it still reports that you are running the same (and outdated) versions of XP and Internet Explorer as before:

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Thanks for reposting the HJT log; it's much more readable now. It is also clean; no signs of malicious infections or any other abnormalities.

"Server busy" errors usually mean just what they say: the web server you are trying to reach is already handling a lot of other requests, so it can't process your request to connect to it at that moment. If you get these errors infrequently and randomly, or if they occur mostly at high-traffic sites like MySpace or Yahoo, there's most likely nothing wrong on your end, and also nothing you can do about it but wait until there's less load on the servers.

what should i do with the antivirus problem...??

Actually, it looks like only one component of the Authentium Command AV product is installed; I'd expect to see more signs of it in your HJT log if the program were fully installed. Had you installed the program at some point and then removed it? If so, it didn't totally uninstall correctly.

Since Norton/Symantec AV seems to be fully installed:

1. Remove the Authentium software through your Add/Remove Programs control panel if it is listed there. If not:

2. Open the Services utility in your Administrative Tools control panel and locate the service named "DvpApi" in the services list.

A) Double click on the DvpApi service. In the resulting Properties window:

- Choose "Disabled" from the Service Type drop-down box.
- Click the Apply button.
- Click the Stop button in the Service Status section and wait until the service is stopped.
- Click OK to close the Properties window.

B) Click on the "Run..." option under your Start menu.

- In the resulting "Open:" box, type the following command and then hit OK:

sc delete DvpApi

I need help with this also

You should really start your own threads when you have questions/problems to post here; we do ask that members not "tag" their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

explorer is running at 22,024k

That's perfectly normal.

commit charge is 203/2462 I have a gig of memory

That's normal too. You have 1 gig of physical RAM installed and what looks to be about a 1.5 gigs of virtual memory (swap file) on your hard drive, for a total of 2.462G of usable memory. The total commit charge is only 203M, which is almost exactly what my XP system is reporting right now.

when I start a program it goes to 100cpu

Yes, that will happen; when you first start a program, the CPU will often give its full attention to that task. There is nothing unusual about this if the program's CPU usage then settles back down. If you have a program which continues to use a very large amount of your CPU even after the program is up and running, then you may have a problem. If Task Manager is showing you such a program, please give us the program's name.

Open the Event Viewer utility in your Administrative Tools control panel and look through the System and Application logs for networking-related messages/warnings/errors which occur at or around the time of the connection loss. If you find messages which might shed some light on the problem, do the following:

Double-clicking on an entry will open a properties window with more detailed information on the error. In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

Hi pete25,

Your latest log still shows signs of infections, but the following info in your HJT log's header also shows that you are running a totally "virgin" version of Windows XP (no Service Packs, Security/Bug Fixes, etc. appear have been installed):

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

If you are running such an outdated, unpatched version of Windows, your system will almost certainly get reinfected in no time. You should use the Windows Update feature to bring your system up to a fully-patched version of Service Pack 1 (note that upgrading to Service Pack 2 on an infected system is not recommended!). Once you've done that, the info in your log's header should read as follows:

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

In all honesty, my bet is that your version of XP will probably fail validation at the Windows Update site, as the most common reason that people are still running such an outdated version of XP is that their installation of XP is, whether they know it or not, not a fully legal copy. Give the update a try though, and let us know the results.

There are no obvious "nasties" in your log, although the log does indicate that you are running two anti-virus programs (Symantec and Command Software), which is not recommended. You should choose a single AV package and use that software only (running anti-spyware programs along with your AV program is OK).

If you can give us more specifics about what you mean by "acting weird", we can probably help you get to the bottom of the problem(s).

Hi chicteenager, welcome to DaniWeb :)

A couple of things:

1. Can you please try to repost/repaste your HJT log? There are abnormal line-breaks in it which make the log contents difficult to read.

2. Please tell us what specific problems you're having, as I don't see anything overtly malicious in the log you have posted.

Thanks

xgmx,

1. We do not need a forum for the rules; they are posted here.

2. Please read and abide by the rules I linked to above, especially the following:

Do not spam the forum with useless or offtopic nonsense.

The frivilous posting spree you're on tonight will end one way or another; I would *ahem* suggest that it would be better for all if it ended by your doing and not ours.

Thanks in advance.

[img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/DWThreadLock.jpg[/img]

[img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/greengrinwink.gif[/img]

Due to the fact that the member who originally started this thread has not responded in well over 1 year, this thread is considered abandoned and has been closed.

In accordance with our posting rules, other members having similar problems should start their own threads and post their questions there. In order to help us help you most quickly, please include as much information about your problem as possible in your posts.

If the member who originally started this thread wishes to have the thread reopened, please send your request, including a link to this thread, to one of our moderators via email or Private Message.

Thank you.

Hi nawal,

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

1. Download the SmitRem utility. but do not run it yet. Instructions and download link are here.

2. Reboot into Safe Mode.

3. Run SmitRem according to the instructions on the download page.

4. Go to Start -> Control Panel -> Display -> Desktop -> Customize Desktop -> Web. Uncheck "Security Info" and/or "Desktop Uninstall" if present.

5. Restart your computer in normal mode. The tabs in your Desktop Properties window should now be restored, allowing you to reset your background.

I thought it would be good incentive to get people to want to contribute more.

Good idea, Dani. :)
I think the recognition may give our newer and/or perhaps more hesitant contributors a bit of a confidence boost, and help to let people know that their input is a valued addition to the community.
As for the "spam" aspect- sure, there's the possibility of a little bit of competitive "post-padding", but I don't really think we'll see too much abuse.