Posts by DMR

Windows doesn't recognize your SATA card, so you'll need to load the card's drivers (probably from floppy) at the appropriate point in the Windows installation procedure.

If you give us the exact make and model # of the SATA controller card we can probably give you more specific instructions.

Your post is OK in this forum, and here is some info:

1. Both the MSI 6378 motherboard model line, and the VIA KT133A chipset it uses, can actually support more than 512MB of RAM, but since your particular version of the mobo seems to have only 2 physical slots, 512Mb is all you get. The individual memory sticks are 168-pin 256MB PC100/133 SDRAM modules; pretty standard stuff.

2. The mobo doesn't have an AGP slot, so you're stuck with only PCI video cards as an alternative to the on-board video. PCI cards are getting harder to find, but the reviews in this article might help you find a PCI video card that fits your needs:
http://compreviews.about.com/gi/dynamic/offsite.htm?site=http://www.sudhian.com/showdocs.cfm%3Faid=445

Simply is it possible for the PC (motherboard) to blow PSU'S I.E.from a shorting motherboard or other device on the mobo

Yes- definitely possible, especially if it's a very hard short straight to chassis ground. We've had a few members who had similar experiences, and at least one of them found that a screw securing their motherboard had made contact with a 12V motherboard trace at one end, and was touching the bare metal chassis at the other end. A badly-shorted component like a capacitor could have the same effect.

If you have a multimeter, you might be able to narrow down the location of the fault by testing for lack of resistance between the different circuit traces/power rails and chassis ground. You should also inspect (look and smell) the motherboard and all other components for signs of physical/thermal damage.

CAn anyone please tell me if there is something i need to do differentley when i have two harddrives or just how i bring it back to one, please i need help.

If you've actually been installing programs on the second hard drive, you won't be able to get everything back on to one drive without reinstalling those programs. At issue is the fact that every program you installed on the second drive will have written references to its location into the Windows Registry (among other places); if you move the programs' files to another location, they will become disassociated from Windows and will no longer work.

stymiee pretty much summed up what a second drive is normally used for: storage of user-created files/documents and backups. Unless you're well aware of the possible "gotchas" involved in spanning Windows or program installations across two drives, you shouldn't have any software actually running from the second drive, it should only be used as a safe storage area for data files.

if you don't understand the reason for two hard drives, then go with the harder option: partition your single hd (not that hard, but harder than adding a second one.)

There are two reasons why I'd personally advise against that:

1. Windows machines are usually configured with a single partition which occupies the entire boot drive; in order to make a second partition, the original partition has to be shrunk. Performing that kind of partition manipulation requires third-party software …

I'll say this up front: Given that your step son is obviously a bit out of his element, you'll need to find someone more qualified if it turns out that you need some in-person help with this. If you let your step son continue to "assist" you, he could make things a lot worse (although I'm sure he means well).

Assuming that you can at least get Windows to boot, there are two pretty straightforward things you try which might undo the damage without requiring the Windows disk or other extra software. Please note that, depending on exactly what your step son altered, neither of these methods may work. They should not, however, make things any worse.

Return the computer to its "Last Known Good" configuration:

• Restart your computer
• Immediately after the computer starts up (well before the Windows logo/icon appears), start tapping the F8 key continuously.
• A menu, with white text on a black background, should appear.
• Use the Up/Down arrow keys on the keyboard to hilight the option labelled "Last Known Good Configuration (your most recent settings that worked)"
• Hit the Enter key and let the computer continue booting.

If #1 doesn't work:

Perform a System Restore:

* Click Start, point to Programs, point to Accessories, point to System Tools, and then click System Restore. On the resulting "Welcome" page, there should be two options:
- Restore my computer to an earlier time
- Create a restore point

Im also helping other people to the best of my ability all over Daniweb

Good- we can definitely use your help. Your post wasn't purposely ignored or anything like that. Some posts go unanswered simply due to the fact that compared to the number of people who need assistance, we're very short on people who can give assistance. You'll find out how frustrating that can be on our end after you've been troubleshooting here for a while.

As to your question:

NOTE: The following will disable all tip/ballon windows. If you want to keep some ballons functioning, delete their corresponding Registry reference from the code I've posted in the box below. A description of which Registry entry controls which balloons can be found under the Tool Tips - Disable section of this page.

Open Windows Notepad, cut-n-paste the entire contents of the Quote box below into the new Notepad document, and then click the "Save As..." option under the "File" menu. In the Save As window, name the file ToolTipFix.reg and save it to your desktop.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"EnableBalloonTips"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"FolderContentsInfoTip"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\tips]
"Show"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartButtonBalloonTip"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowInfoTip"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSMBalloonTip"=dword:00000000

Double-click on the ToolTipFix.reg file and choose Yes when asked if you want to add the information to the Registry.

Is it some kind of cache?

Not quite, but close- msconfig reads areas of the Registry to determine what gets displayed in its startup list. Deleting the Registry keys will clear the msconfig entries.

Linkage:
http://windowsxp.mvps.org/MSCONFIG.htm

This is the stupidist thing i have ever heard of!!!

What, you mean you don't remember the riots those hideous "Cabbage Patch Kids" caused? Some retailers actually had to have policemen stationed in their stores to stop the fights that would break out. Moms and grannies duking it out for the same doll, whacking each other with the dolls, flinging the dolls all over the stores. It was a frightening comment on consumer culture, to say the least.

* The antivirus and "Internet Security" packages from both Norton and McAfee have definitely caused headaches for a lot of people, and even when they're working properly, they put a heck of a load on your system (especially your startup time).

* The free version of AVG is only the antivirus program; it doesn't include a firewall. As far as antivirus program go, though, AVG is very good; it's the AV program I install on my clients' systems when they get sick of the hassle and cost of Norton and McAfee. :D

* Unfortunately, an antivirus program alone isn't enough protection; you should have at least one antispyware program installed/running in addition to your AV program. Microsoft itself has the Window Defender antispyware program avalable as a free download, and the AVG site has a download link to the free version of ewido antispyare, which is an excellent spyware detection and removal program. The free version of ewido does have two limitations, though:
1) It doesn't constantly monitor and protect your system like AVG and Defender; you have to run ewido scans manually.
2) It doesn't automatically update itself; you have to manually download updates for it.

* You should at least enable Windows' built-in firewall (available in XP SP2 only), especially if you don't have a broadband router with a built-in firewall. As for other firewall programs, there are obviously ones that do a better job than the Windows firewall; this page …

The obvious things to check:

* Make sure the boot device order in your BIOS' setup is as follows:

1. Floppy
2. CD-ROM
3. Hard disk
4. Bootable add-in cards (if applicable)
5. Network boot (if applicable)

* Try booting another computer with the CD to verify that the CD isn't damaged.

Also- please tell us the configuration of your hard drives and CD/DVD drives:

* What device is the Primary Master, Primary Slave, Secondary Master, Secondary Slave?
* Do you have SATA drives in the system?
* Do you have an ATA accellerator/expansion card in the system?

\WINDOWS\System32\SYSTEM\SYSTEM.CONF

Please check the error again; I think the above filename/pathname is incorrect.

If the real filename in the error is "C:\WINDOWS\system32\config\system", you have a corrupt Registry. Please see this post for an explanation of the error and links to 2 methods for repairing it.

I am running FC5, at the moment. Does that make me more than sufficient a geek? :eek:

But of course! (Does your sound card work?) :mrgreen:

Yeah, Wolfie caught it- the sound works just fine. ;)

I'm actually running SuSE and Mandriva at the moment; I just said "FC5" because it was a more obscure reference to Linux, which you'd need to be sufficiently Geeky to get. I guess the sound card thing is also a throwback to my days moderating at JustLinux, when Red Hat (which spawned the Fedora project) was the most common distro, and we were swamped with newbie posts which basically gave us nothing more than: "HELP ME!!!! I CAN'T GET MY SOUND WORKING WITH REDHAT!!!!!"

...the guy told me to go to services.msc and start the DHCP client(as it was not running) but i got the following error message:

Could not start the DHCP client service on local computer.

error 1083:The executable program that this service is configured to run in does not implement the service.

He claims this is my problem??

Ok- so something in your services configuration has gotten whakced; that gives us something to work with. While "this is my problem" isn't exactly true, the error message at least indicates where the real problem might lie.

Please do the following:

* Open HijackThis and click the "Config..." button in the right-hand corner of hte main HJT window (don't run a scan, though).

* Click the "Misc Tools" button.

* Put a check in both of the following option boxes: "List minor ...", and "List empty ..."

* Click the "Generate StartupList log" button.

This will generate a report file named StartupList.txt, which should automatically be displayed in a Notepad window. Copy-n-paste the entire contents of the file in oyur next post.

...you guys are nuts...

Yeah, well... I think you're just bound to get that way if you do this for half a decade or more. :eek:

You are good. :idea:

It's amazing the inspiration that lack of sleep can give you.... :eek:

An uberly one I'm certainly not
so confusion arose in my simple thought
Surely in your marsupial abode
Ought to be a disc of windows stored?

Oh Lupine One, my heart it doth sink,
that only of Windows I see that you think.

For the crufty old code of that horrid OS,
hast made of my box a right bloody mess.

So of that abomination, I speaketh no more,
and the "FC" I mentioned is Fedora Core.

And of the sound problem, I did in jest speak,
for the truth it be told, I'm a real Linux Geek!

:mrgreen:

lol, glad to hear it.
Now- tell me, Oh Uberly One: how do I get my sound card working under FC5? :D

you guys think you're good, but my two posts beg to differ.

*snuffle* *clicky* /find all posts by srhalfwaythere/ *snuffle snuffle*......

Parsing......................./
.....Rollercoaster.
.....NanoBots.

Yup- those two posts do prove it: you are truly, and without a doubt....
an UberGeek.

:mrgreen:

Hi please help me,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

No NTL said the connection was there but i still cant connect??

I don't doubt that the connection (that is, the basic communication link between their equipment and your modem) is there, but that has nothing to do with the higher-level issue of the software installation error which you are receiving. I was hoping that they could offer advice as to the causes of and resolution to that particular error.

Hi DMR also Ntl claim the connection is fine they believe i have a corrupt DHCP client which is preventing me from connecting. Not sure what this means?

Possible, I guess. The DHCP client is a component of Windows' networking software which handles the automatic aquisistion of IP addressing info from another machine such as your ISP's DHCP server or a broadband router. The software can get corrupted, although it's difficult to verify that possibility directly as there are usually no specific error messages, etc. to that effect.

1. If you are running any firewall software (including Windows' built-in firewall), disable it. Please note that simply choosing the "Disable" option in the firewall program's settings/preferences does not always turn a firewall off entirely; you will need to deselect the preference setting that tells the firewall to automatically start when Windows boots, and then restart the computers. After reboot, verify that the firewall is indeed disabled.
Keep your firewalls dropped until you get things working.

2. Try to repair your TCP/IP stack with the WinsockXPFix utility. Download …

[IMG]http://www.stevewolfonline.com/Downloads/DMR/Visuals/Smilies/insane.gif[/IMG]

If you'd like us to check your HijackThis log for abnormalities, post it in a new thread in our Viruses, Spyware, and other Nasties forum.

* Give us the make/model of the NIC and laptop.
* Make sure the NIC's connection type is set to "Infrastructure" or "Access Point" rather than "Peer-to-Peer".

Cool- glad you got it figured out. :)

Though, I find it odd that it works on my account and not hers.

Not odd really; IE has plenty of user-specific components. You might want to start with clearing out her Cookies, Temp folder, Temporary Internet Files folder, and Recycle Bin.

Mmm... that wouldn't be my first suspicion, given that the NIC is at least picking up the NTL DHCP server IP. Did you ever get an NTL tech on the phone?

Keyloggers. They don't actually have to emulate the graphical login dialog; they can could call the real dialog window and then capture the users input into the window.

I guess I have seen (even dealt with) cards that have a coaxial-looking connector...

Yeah, those are the ones. A "brew-it-yourself" external antenna solution is definitely possible, but given the time and effort it takes to get it right, a PCMCIA card probably makes more sense.

I have a wireless router (of unknown origin) in my laptop.

No, you have a wireless NIC in your laptop; a router is an external device which serves a different purpose. :D

How does one go about hooking up an antenna to a wireless card?

If the NIC is built in to the computer, or if it's a plug-in (USB or PCMCIA) card that has the antenna encapsulated inside the card, you can't add an external antanna. In either of those caes your only option is to buy a plug-in NIC which does have an external antenna (some manufacturers ofthose wireless cards even sell high-gain antenna replacements that you can install to boost your range).

I think that Is not a virus or a spyware.

Yes, it is; as Xpenetrator indicated, the rwnt.exe file is a component of one of the IRC worms. However, your suggestion of disabling Windows' Messenger Service (which is not MSN Messenger) is good advice, and should be followed.

sTyLe,

The following info in your HJT log's header shows that you are running a totally "virgin" version of Windows XP. That is, no Service Packs, Security/Bug Fixes, etc. have been installed.:

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running such an outdated, unpatched version of Windows, your system will almost certainly get reinfected in no time. You should use the Windows Update feature to bring your system up to a fully-patched version of Service Pack 1 (note that upgrading to Service Pack 2 on an infected system is not recommended!). Once you've done that, the info in your log's header should read as follows:
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

The explanation from Wikipedia sums it up pretty well:

The design of Windows NT is such that, unless security is already compromised in some other way, only the WinLogon process, a trusted system process, can receive notification of this keystroke combination (because it is the first to register the keyboard hook). This keystroke combination is thus a secure attention key. A user pressing Control-Alt-Delete can be sure that it is the operating system (specifically the WinLogon process), rather than a third party program, that is responding to the key combination, and that it is therefore safe to enter a password. It was chosen as the secure attention key in Windows (instead of, for example, the System Request key), because on the PC platform no program could reasonably expect to redefine this keystroke combination for its own purposes.

It may still have become flat though, especially if it is the original.

Yes, that's almost cetainly the case; loss of date/time and ECSD info (such as IRQ assignments) are the primary symptoms of a flat CMOS battery.

The instructions for roguescanfix indicate the following:
Please note that when the program starts it will download a program from the Internet that it needs to use during the cleanup. If your firewall gives an alert about this, please allow the download.exe or run.bat program to access the Internet.

BFU.exe (Brute Force Uninstaller) is the additional program that roguescanfix needs to download, so you need to have an active working Internet connection when you run roguescanfix. The error you got indicates that roguescanfix couldn't go online to get BFU.

In addition, we (well, OK... I) babble at some length about other router/WiFi security settings in this thread.

You are infected with the "VirusBurst" parasite, which is a member of the Smitfraud/SpywareQuake/etc. family of bogus antispyware products.

Description:
This application uses false positives and fake security warnings in your taskbar as a goad to scare you into purchasing the full version of this software.

Complete removal instructions, including visual/graphical aids, can be found here; please work through the steps in the automated removal section of the instructions fully and completely.
When you've finished the procedure, please post the contents of the C:\Program Files\RoguesScanFix\task.txt log file, the log report generated by the Panda online scan, and a new HijackThis log.

The BIOS (CMOS) battery and the main battery pack are two separate items; you only need to replace the CMOS battery in your case. Exactly how you do that depends on your particular model/series of Thinkpad.

viruxz.dll is a component of the "SpywareQuake" family of infections, but simply deleting the dll will not remove all traces fo the infection.

Complete SpywareQuake removal instructions, including visual/graphical aids, can be found here; please work through the steps in the automated removal section of the instructions fully and completely.
When you've finished the procedure, please post the contents of the C:\Program Files\RoguesScanFix\task.txt log file, the log report generated by the Panda online scan, and a new HijackThis log.

You have one infection evident in your log, and there may be others lurking in your system. Please do the following:

You will need to close/quit all web browser programs and disconnect from the Internet for some of the following, so you should print out these instructions or save them into a text file with Notepad.

* Download and install the most current updates for Avast! and Windows Defender.

* Download the following utilities and save them to your desktop or another convenient folder:

ATF-Cleaner
ewido Anti-spyware (30-day trial version)

* Install and Configure ewido:

• Close all other Applications and then run the ewido installer
• Select language click Ok
• Click I Agree
• Click next
• Click Install
• Click Finish
• Wait Ewido will open main screen automatically.
• Wait again a few minutes and Ewido Should Auto update itself. If it doesn't, click update at the top of the screen.
• It is very important to get the updates
• When updating has finished, close Ewido.

* Run another HijackThis scan, put a check in the boxes to the left of the following log entries, and then click the "Fix Checked" button:

O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\RunServices: [winlog] winlog.exe

* Reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, …

PXE has to do with your LAN. I would disable this option in the bios.

But please note that this will have no effect on the problem itself; it will just keep the computer from trying to use the network as a boot option. The reason the computer attempted the network boot in the first place is because it failed to find bootable media using the other methods in the BIOS' boot device options list. Booting from a network device, by default, usually the last option attempted; you only get to that point if all other methods (floppy, CD, add-in controller card, etc.) fail.

Do you think i should phone my service provider?

Yup, that was going to be my next suggestion.

Some providers use the MAC (physical) address of your NIC as part of their verification/authentication process, and although your ipconfig output shows a valid MAC address, the NTL install routine looks like it's having some problem in that area.

Give NTL a shout and let us know what they have to say. I'm logging off for the night now.....

And that's the full extent of the error? It just says: "network adapter error"?

Can you give us the details of the fix? Having that info posted here could help someone else who might be having the same problem.

Thanks.

* What is the exact make/model of sound device listed in Device Manager?

* What are the details surrounding the initial occurence of the problem?

We're partially there- 62.252.128.22 is the address of an NTL DHCP server, but the server doesn't appear to have assigned you any IP configuration info (addresss, mask, gateway IP). I'm not familiar with the way NTL does things, but you may have to use their setup software in order to validate yourself as a registered customer. Try running the NTL install CD again now that you at least seem to have a working network connection.

Yes- you should check the boot order of your devices in the BIOS, making sure that the system is set to boot from floppy first, CD-ROM second, and hard drive third.

it looks like i have it on a disk, but it doesn't run when i reboot.

* Did you make a memtest CD, or a floppy?
* Which exact file/version of the program did you download?

One of the most common mistakes with making bootable CDs is that the user just copies the downloaded ISO image to the CD as they would a normal data file. This will not work, because ISO images are specially-encoded files which need to be burned in a certain way in order to produce a bootable disk.

You can install the new version over your existing version, but you should perform a full backup of your data before doing so. When performing the "upgrade" install, all of your personal data and settings should remain intact, but there is always the possibility that something will go awry.

Right then; post when you can.

Before doing anything else, there is one thing you need to take care of:

C:\DOCUME~1\User\LOCALS~1\Temp\Rar$EX00.234\HijackThis.exe

The log entry above indicates that you are running HijackThis from within a Temp/Temporary folder. One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else.

Please create a folder for HJT outside of any Temp/Temporary folders (a folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do) and move the hijackthis.exe program to that new folder.

The simplest method is to repair your Windows installation.

And instructions for doing so can be found here.