Posts by DMR

The labels must be heat shrink material. If possible, can the labels be printed off of a ink-jet printer or other type printer?

And you would feed lengths of 1/2" diameter round heat shrink through a printer how? :cheesy:

Seriously though, a cheaper and probably more flexible alternative to printing on the heat shrink itself would be to use printer-feedable sheets of adhesive cable labels and then shrink a piece of clear heat shrink over those. Brady makes a wide range of these labels and labelling accessories.

Your log is clean.

1. Do the restarts occur only when playing this particular game?

2. Are there any errors/messages in your log files which might help pinpoint the problem? You can view the logs by opening the Event Viewer application in your Administrative Tools folder.

3. Has the problem been present ever since you first started using the game, or did it start sometime after that?

This is not a network computer.

Erm, wouldn't that beg the question of how it is able to reach any sites at all?? :cheesy:

It seems that a fault in Netscape has done something to keep this machine from accessing one IP

Can you give us any clues as to why you think it was something Netscape did? Give us as much info/background on the issue as possible.

- What errors do you get when you try to reach the site through the applications you mentioned?

- Can you reach the site in question if you try to get to it using its IP address as opposed to its URL? For example, putting the following in Netscape's location/address bar will take you to Google:

http://66.102.7.147

- One place where URLs can be mapped to a "null" location (or otherwise redirected) is in the C:\Windows\hosts file. When you try to reach a site by its URL, Windows will consult the entries in the hosts file to determine the site's actual IP address before it looks to your DNS servers for that information. Open the hosts file in Notepad; aside from some comment lines at the beginning of the file, it should contain only the following entry:

127.0.0.1 localhost

First of all, disable McAfee entirely and see if that changes anything. Let us know what happens and we'll take it from there.

For Yahoo!, I'm pretty sure you will need to subscribe to one of their "premium" mail services in order to get POP3 (that is, non- web based) mail access. Other than that though, these links should give you the general idea of how to add new mail accounts (specifics will vary depending on the exact version of Outlook/OE that you use):

http://help.yahoo.com/help/ca/mail/pop/pop-05.html
http://help.yahoo.com/help/us/mail/pop/pop-06.html
http://its.kennesaw.edu/helpdesk/atlas/pop_access.htm
http://www.csus.edu/saclink/email/outlook.stm

OK, it sounds like some "unwanted guests" have crept in to your system.

Here are a few things you can do to help clean them out:

A) Run a full anti-virus scan, making sure that your anti-virus program is using the most current virus definition updates.
If you do not have an anti-virus program installed, do a free online virus scan at these two sites:

http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

B) Download and run Ad Aware and SpyBot Search & Destroy (download links are in my sig below).

Follow these directions for configuring Ad Aware (directions courtesy of our member "crunchie"):

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan

2.Close ALL windows except Ad-Aware SE

3. Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window

1) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

Under Definitions:
*Prompt to udate outdated definitions - set the number of days

2) Click on the …

At this point you should seriously think of backing up your critical data before proceeding with further repairs!!

Hi,
I checked the disk re your advice but still no joy.

Did the disk repair fail or refuse to run, or did it appear to run but just not fix anything?

- If it failed, please tell us the exact errors (if any) that you received.

- If it did run, did you make sure to check the "automatically fix file system errors" and "scan for and attempt recovery of bad sectors" option boxes?

Try a disk defrag if you haven't already. The amount of fragmentation reported in your printout may be inaccurate due to disk corruption, but if those numbers are correct, you have an extremely fragmented drive.

thank you for your time in looking my stuff over. ;) ;)

You're welcome :)

Remember though- HijackThis is a great tool, but it isn't the final word. Although the sum of the problems you describe makes me think the cause is something other than malicious, I'd get all the latest updates for your Norton anti-virus and do a full system scan before totally reinstalling just to be sure.

Don't sweat the "newbie" thing; we''l get you sorted out.

Incidentally, I tried to ping google as per the first response and I did get four answers.

4 positive responses would be correct if your ping succeded. Was that when you pinged Google by using "www.google.com", or by pinging "66.102.7.147"?

When I pinged my ip address I got four "Request timed out" messages...

The IP address of your own computer's network card failed? Given that you said above that you could ping Google, that doesn't make sense.

- Is your router set up to provide your computers with their IP info automatically via DCHP, or do you maunually enter the IP address, subnet mask, gateway IP, etc. in each computer's network properties?

- On the problematic machine, please run the following command from a DOS prompt and post the information that the command returns:

ipconfig /all

- On the problematic machine, do the following ping command and tell us the result:

ping 127.0.0.1

- Just for reference, what exact model of belkin router are you using?

.bak is the extension used to identify backup files. Is this a single .bak file that is reportedly taking up the space, or multiple .bak files? If it's only a single file, that would almost cetainly point to some corruption with your filesytem; .bak files just simply do not get that large.

Try to check your drive for (and correct) filesystem errors; instructions for doing so in XP are given here:

http://8help.osu.edu/1721.html

Your problem drives me nuts that we don't have a fix .

No kidding... :mad:

did you check START /All programs ,and see if anything is in the Startup folder .

Good point- check that.

The commit charge is the cumulative amount of memory used by all of your open/running applications and processes. As you continue to use programs, the amount of memory they use may grow; an abnormal increase in memory consumption could also be indicative of a "memory leak" in a program.

If you sort the processes listed in Task Manager's Process tab by "Mem Usage" and monitor them, you should be able to determine which processes are responsible for "chewing up" your memory. Have a look at that and tell us the names of the programs which seem to be the most "piggy" in terms of memory usage.

Please give us more specific information on:

1. The make/model/age/processor type and speed/etc. of the computer

2. Your drive configuration:

- Is this the only hard drive in the system?
- If so, did you make sure to connect it to the Primary IDE ribbon cable and set its Master/Slave jumpers to Master?
- Tell us how all of the devices (hard drives, CD-ROMs, etc.) are connected and configured in terms of which devices are on the Primary and Secondary IDE channels, and which devices are Master and Slave on each of those channels.

harryt,

Please do not start multiple threads on a topic/question/problem; doing so goes against our Posting Guidelines. In light of that, I've merged your most recent thread on your problem into this one.

I brought my laptop to the office and plugged it into my LAN connection and both browsers (IE and Firefox) worked without any problems. I have not tried to see if the same would hold true if I just plugged it in to the router at my home.

You should definitely try wiring directly into your home router; that will help us determine exactly where the problem lies. The fact that things operate correctly at work, however, does tell us that the problem lies somewhere in your home network's setup/configuration

You can definitely have all three of those devices enabled at the same time, but because all functions of each pointer are simultaneously active, something like a faulty/sticky/overly-sensitive function key associated with the trackpoint or touchpad could cause the behaviour you're experiencing even though you might be using the mouse as your primary pointing device.

On the IBMs you should be able to use the IBM-supplied laptop configuration utility to disable the trackpoint and/or touchpad; try disabling those one at a time to see if you can determine if one of them is the root of the problem.

<EDIT>

Looks like we were posting at the same time... Let us know what you find out from selectively disabling things.

</EDIT>

Ah, OK. Look in to that and let us know what you find.

Yup- that's pretty much where I was headed.

I did have a client a while ago who had something similar happening- it turned out that she was occasionally resting her palm on her touchpad's (overly-sensitive) scroll/slider button while she was typing... :cheesy:

Again- always glad to be of help... :cheesy:

Sorry I couldn't respond earlier, but I'm glad you got it sorted.

Actually, what you encountered isn't too uncommon on XP systems. XP's own Wireless Zero Configuration utility can often conflict/contend with the manufacturer-supplied install/config utilities that come with WiFi NICS. The instructions for some NICs say to disable Wireless Zero before installing, while others will tell you to install the NIC using Windows' Found New Hardware and Wireless Zero utilities; go figure. For your particular model of Negear card, they mention a bit about this at the beginning of chapter 3 of the full User's Manual.

Each user's Temp folder is under the Local Settings sub-folder of the user's account:

C:\Documents and Settings\username\Local Settings\Temp

If you can't see some of the folders/files I listed, please make sure you set Explorer's View options as I indicated in my last post; some of the folders are normally hidden:

Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

The only thing I can think of at the moment that might help is to go to Internet Options control panel->Security->Internet Zone->Custom Level->User Authentication and see if the logon preference is set the same on both machines.

I'll keep u posted how i get along. It may interest you.

Please do keep us posted. We'd definitely like to know if you find the cause/solution, and by posting that info here you could be helping others out there who are having a similar problem. :)

I have a question, why do you have a keylogger?

Um... you might just want to leave that one alone, Danny. ;)

Always glad to help; that's why we're here.

However, keep in mind that although The Sacred Wet Trout is indeed a force to be reckoned with, there will always be those users who are simply so clue-deprived that more drastic measures may be in order:

[img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/biggrinshot.gif[/img]

[img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/headshot.gif[/img]

[img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/phaser.gif[/img]

[img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/Axe_anim.gif[/img]

Ah... I was going to ask if it was a notebook. What does it have for built-in pointing devices; is it touchpad-only, or a touchpad/trackpoint combo?

I have the latest version and all the previous ones.

Multiple versions as "side by side" installations? Perhaps that's caused a conflict.

I believe that Forums need a Slap Feature!

Oh, sorry- I guess no one told you about this forum's TroutSlap feature. Here, feel free to try it out:

[img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/fishwhack.gif[/img]

That is pretty odd.

Have you tried reinstalling your mouse drivers or tried using a different mouse and/or keyboard?

1. Downloadable ISO of many distros are available at www.linuxiso.org, including an ISO for Knoppix, a popular "Live CD" distro (and yes- you got the definition of a Live CD right).

2. In terms of remote connectivity from/to Windows boxen, there are a few different options; SSH/Putty, rdesktop, or one of the many flavors of VNC are popular ways to go.

3. Networking should definitely not be a problem, just make sure that the particular chipset your NIC uses is supported under Linux. Just ask us if you're unsure on that.

A few things to try:

1. Disable any firewall software you might have running.

2. Reboot into safe mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up)

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders:

1. Local Settings\Temp
2. Cookies
3. History
4. Local Settings\Temporary Internet Files\Content.IE5

- Delete the entire content of your C:\Windows\Temp folder.

Note- If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed. Windows will allow you to delete the versions of those files which exist in sub-folders within the main Temp/Temorary folders, but might not let you delete the versions of those files that exist in the main Temp folders themselves; this is normal and OK.

- Empty your Recycle Bin.

- Reboot normally.

3. Go to Start Menu->Programs->Accessories and click on Command Prompt to open a DOS window. At the DOS prompt, type the following command and then hit Enter:

ipconfig /flushdns

4. The 017/NameServer entries in your log indicate that you are only using a …

Given the bizarre nature of the problems you're describing and the fact that we can't have a physical look at your system, it's difficult to say where the cause(s) lie. Diagnostic and repair utilities like Norton Systemworks, Registry Mechanic, etc. might be able to help, but those utilities do cost money and there's no guarantee that they'll work.

In terms of your drive going bad, that's always a possibility. However, if you haven't done a clean reinstallation of ME in a while, it's just as likely that your software has gotten "ragged around the edges" over time and it's time to back up your data, reformat, and reinstall Windows from scratch. If you took that route though, I'd highly suggest installing something other than ME.

I can load my home page, but when I try going to "my favorites", it reports "can't find server". I have run Spybot, Ad-Aware and Spy Doctor and they can't find anything. I have run hijack this and have a log.

Your HJT log doesn't indicate that anything malicious is responsible for the "broken" Internet connectivity.

1. Can you surf to any websites at all, or do you get the server error regardless of where you try to go?

2. Can you reach websites by typing their actual IP address into your browser's location/address bar? Try getting to Google using the following address:

http://66.102.7.147

P.S. My computer takes forever to load at first now.

You do have a lot of program components set to run automatically when Windows starts up, but not all of them are necessary; they'll just slow down your startup and use up system resources. Unfortunately, the anti-virus/Internet Security package from McAfee can put quite a load on your startup time, but obviously you don't want to disable that one. These other startup items are "User's Choice" though, and can be safely disabled:

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

Most of the above programs should have an option in their …

...our long lost daughter

Oh, no... have we lost here again?! That girl- always sneaking off to write new code, staying up late to tend to that "TechTalk" site... what are we going to do with her?

:mrgreen:

natasha,

You're log looks clean now; can you get the latest virus definition updates for NIS and run a full system scan to to see if it comes up with anything please? If not, the weird dialing behaviour may be the result of some sort of (non-malicious) registry/file-association corruption or the like.

I doubt we'll find the answer here, but do the following (if your computer will let you):

1. Open Windows Eplorer.
2. Click the View menu button and then chose the Folder Options item.
3. In the resulting windows, click the File Types tab, locate and hilight the ".doc" file extension, and then click Edit. Don't change anything; just look through the the file-association information; Is there anything in it that would indicate that Word documents (.doc files) are linked to anything other than Microsoft Word?

While I doubt this has anything to do with your toolbar settings problem, the following HijackThis entry indicates that you're infected with a keylogger trojan:

O4 - HKCU\..\Run: [BPK] C:\PROGRAM FILES\PERFECT KEYLOGGER LITE\BPK.EXE

This is not a Good Thing. :mad:
More information on the trojan (including removal instructions) can be found here:

http://securityresponse.symantec.com/avcenter/venc/data/spyware.perfect.b.html

Hi Carol,

You posted the log correctly, and I don't see anything malicious in it. However, there are two entries in the log which indicate that you have to correct a couple of things before you use HijackThis again:

1.

C:\Program Files\Internet Explorer\IEXPLORE.EXE

That entry indicates that you had at least one instance of Internet Explorer running when you ran HijackThis. Before fixing problems with HijackThis, you must make sure to close/quit ALL instances of your web browser(s)! HijackThis cannot fully perform its fixes while browsers are running.

2.

C:\DOCUME~1\CAROL\LOCALS~1\Temp\HijackThis.exe

That entry indicates that you are running HJT from within a Temp/Temporary folder. Please do the following:

Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, by running disk clean-up utilities, etc.

3. In terms of the msdart.dll file- that's a valid Microsoft library file upon which more than a few programs might rely. The file may have been deleted or become corrupted, causing …

my CPU has turned into a glorified playstation...

Unfortunately though (unless I'm overlooking something), your HJT log doesn't show anything to indicate that malicious programs are the cause. :?:

depending on wich machine i am using somtimes it will log me on as the correct user

What happens on this machine when it doesn't log you on correctly?

another machine will log me on anonymously

On this second machine, does it always log you on as anonymous?

1. Also at the DOS prompt, type the following command to verify that your computer's IP address, the gateway IP, DNS server IP, etc. are configured correctly.

2. If you can ping the IP of the router, but cannot ping "www.google.com", try pinging Google by its IP address instead of its URL:

ping 66.102.7.147

3. What exactly does happen when you try to surf with your browser? Please give us more detail on that, including any error essages that you receive.

I don't think this is a software problem, but more of a hardware problem

Quite possible.

kindastuff,

Does the freeze also occur if you choose to boot into Safe Mode instead of booting normally?

1. Your lastest HijackThis log no longer shows indications of infections; but a clean HJT log doesn't necessarilly mean a clean system.

2. A description of the Aboutblank CWS hijacker variant, as well as manual removal instructions for it, can be found here: http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453082839

However, as fully-patched versions of Windows/Internet Explorer are reportedly immune to the infection, you should go to the Windows Update page on Microsoft's site and download the most current critical fixes for your system before attempting a manual fix which involves mucking around in the Registry.

Again, your log shows no indication of this, but there are new CWS-based, about:blank-related infections which CWShredder cannot fix. If you want, you can see if these two additional utilities find/fix anything (it won't hurt to try):

about:Buster: http://www.majorgeeks.com/download4289.html
HSRemove: http://www.majorgeeks.com/download4286.html

3. You can protect against DSO (and other) exploits by tightening up some of the default security-oriented settings in your Internet Options control panel; instructions can be found here:
https://netfiles.uiuc.edu/ehowes/www/btw/ie/ie-opts.htm#security

4. I deleted your duplicate post for you, but FYI: you can modify your own posts if you need to- just click on the "Edit" button in the lower right-hand corner of a post and a window will open in which you can delete or edit the post.

I have run them on at least 50 different computers from win95 to win xp pro and have never had a problem with them,and consider them the best to cleanup before really getting into picking apart the hijackthis log , .that why i suggest them...

Agreed. In terms of general "spyware" detection and removal tools, Ad Aware and SpyBot are the programs most used and most recommended by those of us who do this for a living. Having personally run both programs on about 100 systems (Win95 to XP); I can honestly say that I've never encountered a problem with either.

Could be; I didn't have the time to resaerch it when I last posted.

Only little niggle we have now is the connection speed shows 115200 instead of the normal 57???. Have tried changing this but it still comes back at the higher speed. Anyone know why?

The 115,200 "speed" doesn't really relate to your modem's max connection speed over your phone line. The 115,200 number is the maximum BAUD rate at which the circuitry in the particular COM port on your computer (to which you've attached the modem) can communicate. It's best to let the COM port operate at it's highest speed unless you notice problems with modem attached to that port. More info on this can be found here:

http://www.helpdesk.uconn.edu/ppp/Win3X/HTML/PPP-Win3X-Modems.html

Unfortunately, I still have the same problems. Meaning, Explorer opens and closes very fast. And, when SpySweeper is running, it detects another application attempting to change the home page to about:blank.

Is this a train and error process where we continue to work our way through startup programs and processes to eventually locate the threat?

I think it may be heading that way, unfortunately.

:?: Hmm- HijackThis can usually determine the version of Windows you're running, but your particular log reports the following instead:

"Platform: Unknown Windows (WinNT 5.02.3790)"

What exact version of Windows are you using?

being as I'm new here, and dont know my way about yet, feel free to move this thread if you feel it is in the wrong forum

No problems in terms of being new to our site whatsoever. However, given the symptoms you've described, I'm moving this thread to our Viruses, Spyware, and Other Nasties forum. The unwarranted and automatic dial-up attempts can definitely be indicative of "unwanted guests" in your system. Let's either confirm or rule out that possibility before proceeding.

:)

Give us the exact makes/model numbers of your Wifi/network devices. Each of those devices have their own config utilities; if we know which exact devices you have we can give you specific instructions on how to configure them to connect properly.

Your TBS Montego II adapter is not plugged into the Primary PCI bus... Unfortunatly, we no longer have the manual, so I was hoping I could get some help here. Although I know dead nothing about hardware, the phrase "plugged in" suggests to me that this is a hardware problem.

If you can give us the exact make & model of your motherboard (open the computer's case and look for that info stamped on the motherboard if necessary), I can probably give you info specific to your particular computer.

In general though, here's the basic (and I do mean basic) deal with the message you're getting:

Current computers/motherboards (both PCs and Macs) have more than one PCI bus/channel, regardless of the actual number of PCI slots provided on the motherboard.

How the slots are actually electrically split/divided beteween channels depends on the mobo in question, but it is often necessary to install certain PCI cards in slots on the Primary PCI channel. On a PC, the slots which are wired to the Primary PCI channel are usually those closest to the AGP video slot, although this is not always the case; it does depend on the construction of the particular mobo in question.

If you have your sound card installed in one of the lower (that is, further away from the AGP video slot or CPU), try moving it to one of slots closer to the above components. One note though- the AGP video slot oftem …

Hi calandste, welcome to TechTalk!

We will need more specific information concerning your network/Internet setup and connections in order to help you most quickly. Can you please provide the following info:

1. What type of Internet connection do you have (cable, DSL, dial-up modem, etc.)?

2. Who is your Internet Service Provider?

3. If you have cable or DSL, are you connecting the computers directly to the cable/DSL modem, or do you have a broadband router, hub, or switch in the equation?

Give us the above info and we'll get you sorted out.

These entries are still present in your lastest log:

O2 - BHO: (no name) - {A708A39C-8DA7-4e36-B3B0-0A1FFAFD4B6D} - C:\WINDOWS\system32\javafix3.dll
O4 - HKLM\..\Run: [mshelp32] C:\WINDOWS\system32\mshelp32.exe
O4 - HKCU\..\Run: [msjava critical update] c:\windows\jjfixer.exe

Did you fully follow my previous instructions for deleting them? If not, please do that now. If you did do that, and the files appeared to be deleted but reappeared in your HJT log after doing so, please tell us if that was the case.

Or since i have several available wireless networks, its not choosing "my WAP" thus not finding the domain..

Oh well crikey, if you'd said that in the first place.... :)

Obviously- if you have more than one wifi network available and your computer decides to connect to a network other than the one associated with your domain's network, you are going to have problems. This is actually fairly common when people who use wireless connections are in areas where multiple wifi networks of sufficient signal-strength are available- the computer may just jump onto the first available network it finds. If the network is open/unsecured and your computer is configured for DHCP, you might never notice the difference unless you checked your WiFi card's status utility to see which specific network you were actually on.

Try this for starters, if the computer in question has an Ethernet connection:

1. Disable the Wireless connection on the computer.

2. Enable the Ethernet connection and make sure it's set for DHCP.

3. Connect the computer directly to the router using an Ethernet cable and see if you join the domain.