Posts by DMR

I haven't run across that particular problem before, but:

- Does this only occur with that CD?
- Can you replicate the problem if you try the CD on another computer?
- Is the CD an original, legal Windows install disk, known to be in working condition?
- Can you eliminate the possibility of a problem with the keyboard serial port by trying a USB keyboard?

"Tapping" or "clicking" sounds from the drive, combined with abnormal behaviour such as the computer freezing up, could very well indicate that the drive is going bad. On the other hand, the symptoms could be caused by software corruption; either way though, the first thing I would suggest is to back up your data ASAP.

Can you give give us any more specific information on the "illegal operation" error?

...and is this a result of spyware, virus, or trojans?

Could be. Get free online virus scans at the links below, and check out threads in our Security forum to find out where to get and how to use some of the recommended spyware/adware/hijacker/etc. detection and removal utilities.

http://housecall.trendmicro.com/
http://www.pestscan.com/

If you do find this to be a problem related to a virus or spyware infection, please post the specifics in a new thread in the Security forum; that forum is where we deal with those issues.

First off...

Erm, weaselco- look at the date of the last post in this thread. The thread has been dormant for over one year; why are you digging it up now?

i keep getting a 16 bit subsystem error... ive edited the registry and keep getting this error

Please give us the exact error(s), the name(s) of the program(s) that give you the error, and the exact registry edits you've performed. The more information you give us to begin with, the more quickly we'll be able to help.

2. Open a terminal window, type the following commands, and post the results of each

I asked for the information returned by the commands I posted because that info would at least tell us whether or not you had any low-level conflicts. Although the modem shows an IRQ and I/O address at boot-up, that doesn't necessarilly mean that there isn't a conflict with another device.

Modems can sometimes be difficult to get running under Linux, here are some links which (hopefully) contain some useful suggestions and info:

http://www.justlinux.com/forum/search.php?action=showresults&searchid=1027483&sortby=lastpost&sortorder=descending
http://www.google.com/linux?hl=en&lr=&q=USR5610B+suse&btnG=Google+Search
http://www.linuxquestions.org/questions/search.php?s=&action=showresults&searchid=2897985&sortby=lastpost&sortorder=descending

Both www.justlinux.com and www.linuxnewbie.org are excellent Linux-only tech support sites; I'm sure you'll get some help from the members of those sites if you register and post your question there.

Good find; glad you got it sorted! :)

(Just FYI: My suggestion of creating a new user account was more of a test than anything else. User accounts do get corrupted sometimes, and it helps to know if a given problem is global, or just limited to one user account, as that narrows down the possibilities.)

Unfortunately, IE is now intergral to the Windows OS; you can't really get rid of it altogether. Also, although you should use another browser for your normal Web surfing, you do neen IE on your system to download Windows critical fixes and updates; the Windows Update site requires it.

I have searched for the EXITST~1 folder and cannot find it

So you definitely can't find a folder whose name begins with "exitst" in any of the C:\Documents and Settings\username\Application Data folders? Your new log now shows another "unwanted guest" running from another bogus folder:
O4 - HKLM\..\Run: [Programdrawbooblogo] C:\Documents and Settings\All Users\Application Data\DASH PILE PROGRAM DRAW\Program Knob.exe

Can you see that one in Windows Explorer?

The core components of some of these malware programs can be very hard to track down and remove, and HijackThis alone isn't enough to do the trick. A few other things that won't hurt to try:

1. If you haven't already, run a full system scan with Norton, making sure you've installed the absolute lastest virus definition updates.

2. Run the free online scans from these two sites:
http://www.pestscan.com
http://housecall.trendmicro.com

3. Individual utilities have been written to eradicate specific and particularly difficult to remove infections (CoolWebSearch, VX2, etc.). The following sites offer removal utilities and instructions for such infections:

http://www.spychecker.com
http://www.subratam.org/?page=removal
http://www.majorgeeks.com/downloads31.html
http://aumha.org/a/parasite.htm

Many of the tools found at the above site …

C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe

Your new log shows IE running again, although your last log did not. Any idea what changed between the posting of the two logs?

Resetting the BIOS: motherboards usually have a reset jumper on them to do this; you'd need to check the documentation for your particular motherboard for the exact procedure.

Flashing the BIOS: Upgrading/restoring the BIOS' firmware. This is done by downloading a flash upgrade utility from the website of your BIOS, motherboard, or computer manufacturer's support site. Flashing the BIOS can be dangerous though- if you apply the wrong version of BIOS software or make a mistake in the procedure, you can severely hose your computer.

The CMOS battery: yes, it's the watch-type battery (usually type CR2032) on the motherboard. They're very easy to come by (I get mine at the local drugstore) and only cost a couple of dollars. Basically you just pop out the old one and install the new, although it's a good idea to:

1. Go into your BIOS and write down your current configuration settings.

2. Unplug the computer's power before removing the battery and wait 30 minutes or more before installing the new battery. This lets any residual charge dissipate from the system, which essentially is the same as a BIOS reset- the BIOS is restored to factory default settings.

After installing the new CMOS battery, you will probably have to go into the BIOS setup and tweak some of the settings (such as date and time).

As far as the XP setup goes: if the install CD does detect the installation on your hard drive it …

I haven't heard of that problem, but what exact version of IE are you asking about?

NIS 2004 does list IE version 5.01 SP2 as the minimum requirement for IE; older versions/builds might exhibit problems.

Ok- sounds like it really is hung.

- Does your BIOS correctly identify the hard drive?

- The PPL/RPL messages are from the BIOS as it searches for bootable devices. In your BIOS setup, temporarily set the system to boot from the hard drive first, and, if possible, disable options to boot from other sources (CD-ROM, network boot, etc.). Does doing so change the symptoms of the problem at all?

- Any chance of installing the drive in another computer just to see if it boots there?

- Some people have apparently resolved issues which seemed similar to yours by resetting or flashing the BIOS, or replacing the CMOS battery. I'm not saying that would work for your particular problem, but I thought I'd put it out here anyway.

If your Windows Updates are current, this is most likely due to a glitch in Spybot

Yup- the SpyBot "DSO Exploit" issue is well known and documented, although still not fixed AFAIK.

Not much help, I know, but-

What you're seeing improperly interpreted/parsed formatting coding in the message. I doubt it's virus-related, although I can't say why Hotmail isn't handling it correctly.

Definitely a spyware/adware problem; the mention of HotBar and web.yoursearchfinder.com tells us that much. I'm moving this to our Security forum; have a look through previous threads there to find out how to download and use the HijachThis utility. Run the program and paste the contents of the log file it generates in a new post in this thread.

Have you installed all the motherboard drivers yet? And if you don't have on-board audio and graphics, have you installed drivers for those devices as well?

Yes- you need to give us more information along those lines:

- Is the Win 98 install disk an OEM version that came with the old computer, or is it a full-blown, off-the-shelf Microsoft disk? If the installation disk came with the original, it may be tailored to that computer.

- What are the specific makes/models of each computer? Even if you have a full MS Win 98 disk, it won't have the proper drivers for your "second" computer if that computer is fairly new.

The second option is something along the lines with repairing. I tried that, but it seems to hang up. The status bar reads "Examing 76294 MB Disk 0 at Id 1 on bus 0 on atapi...

Did you let the repair process run for a while before assuming that it hung? The disk examination phase can take a long time.

- Is this a partition that existed before the XP install, or did you create it during the install process?

- How is the partition formatted (FAT32, NTFS,etc.)?

- What exactly is on the partition?

If the partition is currently reported in Disk Manager as "Basic", don't muck with the "Dynamic Drive" option; it won't help.

There could be a number of causes for that, ranging from a buggy program/process to a hardware fault. A few things to start with:

- How long has this been happening, and had you made any changes to hardware or software around the time the problem surfaced?

- If you boot the computer in Safe Mode, does the freeze happen after a while there too?

- Have you disabled any and all programs/processes/services that you don't need to have running?

- Do your event logs list any errors which might help pinpoint the cause? You can view your logs with the Event Viewer application in your Administrative Tools folder.

- Could it be heat-related? Make sure that your system is well-ventilated and free of dust, and that all fans are working properly.

- Check all of your cables and components; make sure everything is seated properly and tightly.

Sorry for the short reply, but I only have a moment to post right now.

- The first box you've described is the standard Windows "Run As" dialog box; more info on it can be found here:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q294676&

I'm not sure why you're getting it just by clicking on icons normally, but you might try disabling the Run As/Secondary Logon service and see if it goes away.

- Not sure about the second dialog window- see if that also goes away when you disable the Run As service.

I believe the stock version of the Optiplex GX150 used the shared memory scheme in which a portion of main system RAM was dynamically allocated to video/graphics functions. If that's true, the fact that your getting a distorted video display as well as the general memory error message would indicate that your stick of RAM is "going south".

Since you don't have another stick of RAM to swap in, you should run an intensive memory-testing program such as memtest86.

Also- you said:

I get the "Dell" screen for a few seconds and then two beeps

Those beeps are system codes which could tell us a bit more about the exact problem; can you give a more specific description of the beeps (for example, are they: 2 beeps of equal duration or 1 long and 1 short or 1 short and 1 long, etc.).

I have downloaded and installed NAV 2005. I cannot run it however. When I start it shuts down before I can even configure it.

Try running NAV while booted into Safe Mode. To get into Safe Mode, hit the F8 key as your system is rebooting (just as/before Windows itself starts to load).

My original pop-up problem disappeared after doing what you suggested-Thanks

Unfortunately though, you still have a lot of "unwanted guests" on your system judging from your HJT log. Getting rid of them will probably take a few tries, but let's start here (after doing the virus scan):

-> Have HijackThis fix the following entries:

O3 - Toolbar: (no name) - {00000000-0000-0000-0000-000000000001} - (no file)
O4 - HKLM\..\Run: [Configurations Menu] iexplore.exe
O4 - HKLM\..\Run: [Windows Configuration] iexplore.exe
O4 - HKLM\..\Run: [services] C:\WINDOWS\Help\system\services.exe
O4 - HKLM\..\Run: [Microsoft MSRE] msrexp.exe
O4 - HKLM\..\Run: [Windows DLL Loader] C:\WINDOWS\nvsv32.exe
O4 - HKLM\..\Run: [Microsoft Services] sress.exe
O4 - HKLM\..\RunServices: [Configurations Menu] iexplore.exe
O4 - HKLM\..\RunServices: [Windows Configuration] iexplore.exe
O4 - HKLM\..\RunServices: [Messenger Services] msnse.exe
O4 - HKLM\..\RunServices: [Microsoft Services] sress.exe
O4 - HKLM\..\RunServices: [Microsoft MSRE] msrexp.exe
O4 - HKCU\..\Run: [Microsoft Services] sress.exe
O4 - HKCU\..\Run: [Microsoft MSRE] msrexp.exe
O4 - HKCU\..\Run: [Eost] C:\Documents and Settings\Anybody\Application Data\raoc.exe
O4 - HKCU\..\Run: [Wkaumccq] C:\WINDOWS\System32\w?nlogon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - …

oo.. well u taught me alot.. tx for the time u spend helping me on this.... If i have any other problems with IE 6 i will keep u posted.... tx once again :)

No problem; glad I could help. :)

Also if i got any other problems i will let you know in a new thread or somthing..

Yeah- if any other kinds of problems crop up, post them in new threads of their own.

o yea how old are you? just wondering.. i am 16

Umm- I'm 101010 (or 2A if you prefer Hex) :mrgreen:

Hi fishauk,

First of all- welcome to TechTalk!

Secondly:

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforu...b_faq#faq_rules

Thanks for understanding.

help!!!!!!!: You really should start your own thread and give specific details about what you are experiencing and any error messages you are getting. This thread, particularly the post you are referring to, is a few months old, and you will come closer to getting the attention you need for your problem if you start your own thread. :)

As advised above: Put this question in a new thread of your own please.

I've moved this thread to our Security forum. Have a good read through other threads here to learn where to download and how to use some of the other recommended virus/trojan/adware/spyware/etc. detection and removal tools. AVG alone might not be enough to thoroughly clean your brother's system.

Thread marked as solved.

Or not. Oh well... :rolleyes:

You can try doing the following, and then doing another full anti-virus scan (make sure you have the absolute latest virus definition updates installed for your AV program):

- Reboot into safe mode

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- Delete the entire contents of all Temp, Cookie, and Temporary Internet Files folders

(If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed.)

- Empty your Recycle Bin.

- Reboot normally.

but when I try to end the process it just reappears in another location in the list (weird)

Good catch on that one- IE should definitely not automagically restart itself under normal circumstances. That kind of behaviour almost certainly indicates that you're still infected.

We missed an entry in your HJT log, and it's definitely a "nasty":

O4 - HKCU\..\Run: [AXISFACE] C:\DOCUME~1\RICHAR~1\APPLIC~1\EXITST~1\name grey.exe

Have HJT fix that entry. Once you've done that, delete the entire C:\Documents and Settings\Richar~1\Application Data\EXITST~1 folder.

(The "~1" in the folder names is just indicating that the folder names have been truncated; the full names will be visible in Windows Explorer.) Only delete the EXITST~1 folder; not any of the folders above it!

A DSO exploit is not an infection or intrusion in and of itself, but rather a security hole/flaw/bug in a program (Internet Explorer in this case) which can allow a malicious Data Source Object to execute code on your computer.

When Ad Aware, SpyBot, and other detection/removal tools report a "DSO Exploit" in their scans, it indicates that a DSO-related security hole exists in your version of Internet Explorer, but it does not necessarilly mean that a malicious program has taken advantage of the hole yet. Using Microsoft's Windows Update function to make sure your system always has the latest critical fixes, patches, and program updates installed is the best way to ensure that your system contains as few of these types of flaws as possible.
(* Note that there has been a bug in SpyBot which causes it to always report a certain DSO exploit, even if you just fixed the problem in a previous SpyBot scan. Until the bug is fixed, that particular item can be ignored.)

Given the above, your particular problem seems to obviously been caused by something that Ad Aware removed, but without knowing exactly what Ad Aware did find, it's impossible for me to say whether any of the "nasties" infected your system by taking advantage of a DSO exploit.

Glad we could help :)

Thread marked as solved.

cybergenie:

american212001,

Please see my two previous posts above regarding adding questions to a thread already started by another member- you need to start your own thread and post your question there.

Thanks.

Hi american and welcome to DaniWeb! As the post right before yours suggested, you should have posted this in a new thread.

there is a file call DSO EXPLOIT.... the description of that item was somthing like allow others to change cofig. on your window IE ..... so yea.. If you don;t alrdy know about DSO EXPLOIT you should check it out.

DSO= Data Source Object. Very basically, the "exploits" involve crafting data source objects (a chunk of XML code, for example) which contain maliciuous code, and then binding that code to an HTML page. Due to the nature of DSOs and security loopholes involving them, when a user views that page, the malicious code included with/in the page can perform unauthorized tasks on the users computer.

hmm... i donno if itz just me.... but i don;t see a world icon... but i did update the defintions.. and after that there waz no gear icon either.. mayb i have a dif version.. ?

The current version is Ad Aware SE Personal, build 1.05.

Nothing else there to be concerned about.

Agreed- the log is clean now.

Also, after you have HJT fix the entry crunchie listed, do the following:

- Reboot into safe mode

- Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files".

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders:

1. Local Settings\Temp
2. Cookies
3. History
4. Local Settings\Temporary Internet Files\Content.IE5

- Delete the entire content of your C:\Windows\Temp folder.

(If you get any messages concerning the deletion of system files such as desktop.ini or index.dat, just choose to delete those files; they'll be automatically regenerated by Windows if needed.)

- Empty your Recycle Bin.

- Reboot normally.

It's good practice to do the this any time your dealing with a "spyware" infection, as pieces of malicious programs often hide themselves in one or more of the above locations.

should i remove osen.exe after i use hijackthis to remove because i still see it in the files hidden

Yes, good catch-

Any files in HJT's "04" category that you have HJT fix must be manually delted afterward. HJT only removes the registry entry which auto-starts the progrmas, but it does not delete the program files themselves.

...i see iexplorer and some other program doubling up ati2evxx.exe.

Having multiple instances of some processes listed in Task Manager is normal. The ati2evxx.exe program, which is related to your ATI video card, is one such process; you'll also notice that your HJT log shows two instances of svchost.exe running, which is also normal.

HJT doesn't show any "suspicious" duplicates; is Task Manager showing you anything else that you're concerned about?

i will do that DMR...

And I see that you have- I've given you a couple of suggestions in that new thread. :)

I personally would have HJT fix this, as I'm 99% sure it shouldn't be there:

O4 - HKCU\..\Run: [Aths] C:\Documents and Settings\Alexander Chang\Application Data\osen.exe

Use your own judgement though- this is your system we're working on, not mine.

Other than that, the log is clean. If you're still experiencing problems, the causes could be elsewhere (that is, not spyware-related).

* Run a full anti-virus scan, making sure that your anti-virus program is using the most current virus definition updates.

* Download and run Ad Aware and SpyBot Search & Destroy.

Follow these directions for configuring Ad Aware (directions courtesy of our member "crunchie"):

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan

2.Close ALL windows except Ad-Aware SE

3. Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the preferences/settings window

1) In the ‘General’ window make sure the following are selected in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)

Under Definitions:
*Prompt to udate outdated definitions - set the number of days

2) Click on the ‘Scanning’ button on the left and select in green :

Under Driver, Folders & Files:
*Scan Within Archives

Under Select drives & folders to scan -
*choose all hard drives

Under Memory & Registry: all green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my …

That's still a suspiciously incomplete-looking log. Before running HijackThis:

- Close/quit all running progrms.

- Open Task Manager and end all instances of the following programs/processes if found:

thunderbird.exe (THUNDE~1.EXE)
firefox.exe
iexplore.exe

Almost clean. :)

Have HJT remove these:

O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/min...ransporter.cab?
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52...meInstaller.exe

And if you didn't specifically add mt-download.com to your Trusted Sites, have HJT fix this also:

O15 - Trusted Zone: http://*.mt-download.com

Can you post a fresh log please?

A protection error indicates a problem with a virtual device driver in your system. You'll need to give us more information concerning the problem in order for us to be more specific:

- When did the problem start occuring?

- Had you made any hardware or software changes to the system right around the time you started getting the error?

- Have you run any diagnostic programs or done any other troubleshooting yet?

To narrow down the culprit, try the "Logged (\Bootlog.txt)" option in the startup menu. That will create a textfile named bootlog.txt in your root (C:\) directory which will contain entries indicating the load status ("success" or "failed") for each device driver that Windows loads at startup.

Obviously, Windows will probably throw up the protection error and freeze at some point during the logged bootup, so you'll have to reboot into Safe Mode to read the contents of the bootlog.txt file. Hopefully you'll find entries in the file which indicate what specific driver(s) failed to load.

Have you run a full virus scan on the system yet (with your A-V program's most current updates applied)?

Considering that another browser does work for you, I'd look into the possibility of spyware infections; they can wreak havoc with Internet Exploder. Have a read through the threads in our Security forum to find out how to identify and remove these malicious programs, and if you find them to be the cause of the problem, start another thread in the Security forum.

You get to the Safe Mode boot choice by hitting the F8 key as the computer is starting up. You have to hit the key at just the right time though (right as the initial BIOS startup messages finish and Windows begins to load), so you might have to try it a couple of times to catch it just right.

Hey to all the newbies here! Unless you have a suggestion to help the original poster, you shouldn't post in this thread; you should start your own new thread for the best response!...

Yes, all true.

For more info, please read our full posting guidelines here:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_faq#faq_rules

Thanks.

"ipconfig /flushdns" perhaps, if you haven't tried that already?

(The monitor I was using was one not being used at my husband's office.....I guess I killed it)

Could well be; hooking it up to another computer when you get a chance will give you a better idea of that, though.

I was then able to type "rstrui.exe". I then received the following message: "rstrui.exe - Entry Point Not Found"....."The procedure entry point SHRegGetValueW could not be located in the dynamic link library SHLWAPI.dll."

Now what do I try?

{I'm still searching for my Windows CD.....grrr} :sad:

If you're lucky, it may only be your shlwapi.dll file that's corrupt. If so, it can be replaced, but you're going to need to find/get a proper/correct version of that file somehow and copy it into your C:\windows\system32 folder.

Something that would be good for us to know if possible:

In your first post you said: "I realized that an update was being downloaded to my computer". Do you know exactly what update was being performed? That is, was it a Windows Update that was happening, or was it an update initiated by some other program?