Posts by DMR

Your log is clean. :)

In terms of the programs you mentioned:

* The McAfee components should all be left as they are.
* You don't need the Adobe "acrotray.exe" component running, but you'll probably want to leave the Acrobat BHOs installed, as they provide the ability to read .pdf documents from within Internet Explorer.

So all is back to normal then?

* Download the XP .exe Registry fix file by right-clicking on xp_exe_fix.reg and choosing "Save link as..." or "Save target as..." from the resulting pop-up menu.

* Save the file to your desktop.

* Double-click the file you saved, and when it asks if you want to merge with the registry, click YES.

*Reboot your computer; your shortcut functionality should be returned to normal.

Sounds like filesystem corruption.

1. Double-click on your My Computer icon.
2. Right-click on your C: drive.
3. Choose "Properties" from the resulting drop-down menu.
4. In the Properties window, click on the "Tools" tab.
5. In the "Error Checking" section, click the "Check now" button.
6. In the resulting pop-up window, put a check in both option boxes and then click the "Start" button.

The filesystem/disk scan will take a while, so be patient.

...and after closing at those port.. even my connection and computer performance getting bettr and faster!!!

That makes sense- the fewer network services you have up and running, the more bandwidth you have for everything else. :)

Hi people:

As stated in our posting rules, we ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

Hi chungkiap,

The behaviour you're seeing is apparently due to a security hole found in netapi32.dll, which (as of about Aug. 12th) is being exploited by hackers. Please do the following:

1. Download and install Microsoft's security fix.

2. Download the free Windows Worms Doors Closer utility. Run the utility and choose to disable all of the ports/services it lists. Note that if you have a local network and need to share files/printers with other computers on that network, you'll have to leave NetBIOS enabled.

After doing the above, test-drive the computer for a while and let us know if you still experience the crashes or not.

I have this exact same problem!... What am I supposed to do?

Hi tyranny,

As stated in our posting rules, we ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

i noticed that both the CRT monitor and LCD cable had only 14 pins and were thick and heavy. the new cable had 15 pins and was not as thick and very light.

Bingo- it's the thickness/sturdiness/quality of the cable that you need to look for. The heavier-duty cables are better shielded (grounded) than the cheap, thin cables, and the wire they use is of higher quality. (The missing pin on the sub-mini D connector, however, is normal; it's pin #9, which carries no signal.)

i DO have a DVI port on the back of the monitor, however, my graphics card seems to support just the VGA one. are there adaptors available for the 2?

Not all types of DVI connectors carry the analog as well as the digital signals, but if your monitor has the type of DVI connector that does, VGA->DVI adapters are available.

Look at the DVI side of the adapter below; the four pins insde the cross at the right of the connector are the analog (VGA) lines. If your monitor has a connector like that, you should be in business:

[IMG]http://www.stevewolfonline.com/Downloads/DMR/Tech%20Uploads/DVI-VGA%20Adapter.jpg[/IMG]

when we boot the system in safe mode what are the files shown before booting the system??

What you are seeing is the list of core files that Windows loads in Safe Mode.

i have some files in my startup list & when we boot using safe mode will those files be executed??

In Safe Mode, Windows loads only the minimal set of programs/processes/drivers/services. Programs referenced in your Startup folder and other "autorun" locations will be bypassed.

will drivers be loaded when v use safe mode??

In terms of drivers, Windows' basic/generic mouse, keyboard, VGA video, and storage drivers are loaded, but not much else.

You dont have to re activate everytime if you reinstall the OS on the same computer...

Thanks for posting that info, goldeagle2005. You're right- that method does do the trick.

Glad we help, joe_blow; feel free to ask if you have further questions/problems with the upgrades.

1) Installing RAM and a CD drive to an existing system isn't a substantial enough change to trigger a reactivation.

2) A reformat will obviously require reactivation; the process is very straightforward.

More info on the subject can be found here:
http://www.microsoft.com/technet/prodtechnol/winxppro/evaluate/xpactiv.mspx

.

* From the l2mfix folder, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Save the log file; you will be including it in your next post.
(If you get prompted for a password while running L2MFix, type: bye )

* Download the (free) HijackThis utility. Once downloaded, follow these instructions to install and run the program:

Create a folder for HJT outside of any Temp/Temporary folders and move the HijackThis.exe file to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

* Click on the "Run..." option in your Start menu.

* In the resulting "Open:" box, type "cmd" (omit the quotes) and hit Enter. This will bring up a DOS window.

* At the DOS prompt, type the following command and hit Enter:
ipconfig /release

That can be caused by a fault in either the video card or the monitor; we'll need to narrow thing down a bit. Try the following troubleshooting steps and give us the full and exact details of the results:

* If possible, connect a different (know-to-be-working) monitor. Does the problem still occur?

* Connect the suspect monitor to a different computer. Does the monitor still blink/flash?

* Check the VGA connector(s) at the end(s) of the monitor cable. Do you see any bent/broken pins? Does the monitor cable look severely bent/kinked or damaged in any other way? Try a different cable if possible.

* Boot Windows in to Safe Mode; this forces Windows to use its own generic VGA video driver. Does the problem still occur? (You get to the safe mode boot option by hitting the F8 key as your computer is starting up.)

* Upgrade/uninstall/reinstall your video card's drivers.

* Open the computer's case; make sure your graphics card and othr components are fully and properly seated in their slots, verify that all fans are working, and that the interior of the computer is free of dust/dirt/etc.

From Intel's support site:

These are the specifications for the integrated graphics solution on the Intel® Desktop Board D101GGC.

• Integrated Radeon* X300* based graphics solution
• Memory is shared with system memory
• Up to 4GB system memory (with up to 256MB reserved graphics memory)
• Users can set maximum automatic memory to share with steppings of 32MB, 64MB, 128MB and 256MB. If more memory is needed, it is allocated dynamically through system memory by the driver.
• Full DirectX* 9.0 Support (Vertex Shader v2.0 and Pixel Shader v2.0)
• Supports resolutions up to 2048x1536 @32bpp
• SmartShader* 2.0 allows complex, movie-like 3D effects
• SmoothVision* 2.1 improves image quality through anti-aliasing using multi-sampling algorithm with support for 2,4, and 6 samples

Hi arnibol,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member, regardless of how similar your problem might seem. Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

OK...

1. The pings to the localhost/127.0.0.1 address indicate that your TCP/IP software stack on the laptop is most likely not corrupt.

2. The 169.254.153.7 auto-configured IP address means that the DHCP client software on the laptop is most likely functioning correctly, but either cannot obtain a valid address from the router's DHCP server, or cannot find the router at all.

3. Did you try connecting the desktop to all of the router's ports to make sure that they work with that computer?

4. Have you tried disconnecting the desktop and connecting the laptop in its place (using the desktop's Ethernet cable as well)?

5. Run the ipconfig /all >"%userprofile%"\desktop\ipconfig.txt command on the desktop machine and post that machine's ipconfig.txt file.

When swithing devices/cabling around, remember that for the best test of connectivity you should power down all of the device each time something is switched. Once connected power the devices back up in the order of: modem first, router second, computers last. Allow each device to complete its power-on self-test and stabilize before powering up the next device.

Hi damnesiac,

First of all- welcome to DaniWeb :)

Another new addition to a very old topic, gotta keep em' alive I guess.

Actually, we try to let old topic rest in peace. :p

For a couple of reasons, we ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please give us as much specific info as possible regarding the problem (exact error messages, system specs, troubleshooting steps you've already tried, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

It'd be great if anybody could get hold of an English manual for the router!

Oh, so we're both in the same boat, eh? I was hoping that you might at least be able to translate some of the settings for us. Hmm... I'll see what I can turn up while you're gone.

I'll talk to some of our mods and see if they have any ideas.

Only one thing come to mind at the moment, and that is: given the fact that the computer can connect to secure sites at other locations, I'd start looking at the home router's settings.

I'm on my way out to class right now, but I'll come back to this in a few hours. In the mean time, can anyone pass us a link to an English version of that router's manual? I don't read German.

OK- and what about the results of the two "ping" commands? If the pings work correctly, you should, for each command, get 4 positive replies followed by a block of summary info. If they fail, please post the output you received.

but thr is option in properties of lan with "show icon with limited r no connectivty unchck this box"

That will do nothing to fix the conneciton problem, it will only hide the alert message.

By the way zygon- please try to use proper spelling and grammar in your posts here. Not all of our members are familiar with chat/IM-style typing abbreviations, and we need to provide concise, easily-understoood advice when helping others with their problems.

-

* Getting the router password would obviously be a Good Thing. Please do that.

When I get the password, what settings could cause my router not to communicate with my laptop?

The only thing I can think of that would give you that problem (assuming nothing is actually broken) would be if someone had limited the router's DHCP scope to exatly 1 client. That is, the router was set to hand out only one IP address via DHCP. This would obviously be very unlikely, though.

1. I honestly don't know if the "cultural differences" between the Chinese and US devices could play a part, but my hunch would be no.

2. Plug the desktop machine in to each and every Ethernet port on the router, one at a time, rebooting the computer each time you change ports. If the desktop can connect properly to every LAN port, the router is almost certainly not faulty.

3. Just FYI: "Limited or no connectivity" means that a network link/handshake has been established between the router and laptop, but that TCP/IP settings aren't getting correctly configured for some reason. Some ways to weed out the suspects in that area:

* Turn off the router's DHCP server, configure static IPs, reboot all devices, and see if you get connectivity that way.

* Verify the integrity of your TCP/IP stack:
- Click on the "Run..." option in your Start menu.
- In the "Open:" box of the resulting …

It slid on the rails well enough... but somehow still got stuck....managed to get stuck in the position closest to the slider.

Yeah, that's their "idle" position; sometimes they need a little nudge to get them up and moving.

About WHY I got confused.. just... nevermind.

Ooooo....kay. Probably don't want to know anyway.... :mrgreen:

The reader simply got stuck.

Do you mean the assembly that the laser travels on got stuck; that it wasn't sliding in and out on its rails? Just curious.

Nope, it's not that. All the pins are in working condition on the motherboard...

I'm confused. I just got an email notification which indicated that you had posted the following:

-_-v; I thought I'd checked that...
one of the pins on the motherboard broke, and is stuck in the IDE cable going
to the cd drive.
brilliant..

I don't see that post reflected here, though. Any idea what gives?

Open the case and double-check that IDE cable for starters. Make sure that it is correctly aligned and seated at both ends, and that no pins are bent/broken on the mobo and drive connectors.

You do it as a Scheduled Task. Instructions are here:
http://www.microsoft.com/windowsxp/using/helpandsupport/getstarted/ballew_03may19.mspx

Hi aliceryuryu,

First of all- welcome to DaniWeb :)

As per our forum rules, we ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your log there. When you do post the log, please make sure you post the entire contents of the file; the log you posted here is missing some important header information (compare it with logs posted by other members).

Thanks for understanding.

I see no problems in your HijackThis log, exept this:

C:\Documents and Settings\User\Desktop\Spyware Doctor 3.8.0.2575\Spyware Doctor 3.8.0.2575 + good crack\crack\swdoctor.exe

Crack? Really...
Pay for the product or don't use it.
Working on systems that are running illegal software goes against our forums rules. Personally, I'm not going to assist anyone who is using illegal copies of antimalware utilities; kind of rub me the wrong way........

The logs look good :)
Are you still getting the error message?

That log file looks very light on content, but it does show one sign of malware. I suspect there are more "unwanted guests" lurking about.

Please do the following:

You will need to close/quit all web browser programs and disconnect from the Internet for the following, so you should print out these instructions or save them into a text file with Notepad.

* Download the most current updates for Avast!.

* Download and install the following utilities:

Windows Defender - http://www.microsoft.com/downloads/d...displaylang=en
ewido Anti-spyware (30-day trial version) - http://www.ewido.net/en/download/

To Install and Configure ewido:

• Close all other Applications and then run the ewido installer
• Select language click Ok
• Click I Agree
• Click next
• Click Install
• Click Finish
• Wait Ewido will open main screen automatically.
• Wait again a few minutes and Ewido Should Auto update itself. If it doesn't click update at top of screen.
• This in very important to get updates
• When updating has finished. Close Ewido.

* Download ATF-Cleaner and save it to a convenient location. Don 't actually run the program yet.

* Close all open programs/windows, (especially web browsers). Run another HijackThis scan, put a check in the box to the left of the following entry, and then click the "Fix Checked" button.
Close HijackThis once the fix completes:
O4 - HKLM\..\RunServices: [Microsoft Update 32] explorer.exe

* Reboot your computer in Safe Mode by …

Great- glad we could help you get it sorted out. :)
Does everything seem to be back to normal now?

* Good- your new HJT log is clean, and ewido seems to have disinfected a few other malicious items. :)

* In terms of the TrustIn Contextual folder, it may have been deleted already, as it was marked as "(file missing)" in your first HJT log. If you search for the folder in the way I suggested, but didn't find it, it most likely doesn't exist anymore.
Sometimes the names of programs that have been sucessfully uninstalled get "stuck" in the Add/Remove Programs control panel's list and need to be removed manually, and this might be the case with your TrustIn entry. To remove the entry from the control panel, see this Microsoft support article.

* Are you still experiencing shutdown issues or other problems? If so, please give us the details.

1. Your HJT log looks like very "light on content"; logs usually contain much more info that that. Did you run the scan while Windows was running in Safe Mode, or when you had startup items or other programs disabled (via MSConfig, perhaps)? If so, please post another log from a scan done while booted normally and with all normal startup items enabled.

2. Do you know what this file is?:
C:\Documents and Settings\User\Desktop\programs.exe
If not, right-click on it and choose Properties from the resulting drop-down menu. In the Properties tabs/pages, look for identifying information (Company name, creation/modification date, etc.) and post any such info you find.

3. It would be very sloppy troubleshooting not to eliminate the possibility of a non-malicious fault. Replace your keyboard with another (known to be working) keyboard if you haven't done that already.

4. "dumprep" is part of Windows' error-reporting scheme; the fact that you're seeing it in Task Manager may mean that Windows is noticing something amiss.
Open the Event Viewer utility in your Administrative Tools control panel and look through your System and Application logs for entries flagged with "Error" or "Warning", especially those whose time-stamps coincide with the occurence of the problem(s). Double-clicking on such an entry will open a properties window with more detailed information on the error; post the details from a representative sample of some of the different error messages (please don't post duplicates of a given entry, or flood us with the entire …

Hi crazy girl, welcome to DaniWeb :)

While startup and/or shutdown problems can definitely be caused by non-malicious problems, I do see indications of at least one malware program in your HJT log.
Before we begin cleaning though, there is one thing you need to take care of:

C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\~AceTemp\hijackthis\HijackThis.exe

The log entry above indicates that you are running HijackThis from within a Temp/Temporary folder. Please do the following:

Create a folder for HJT outside of any Temp/Temporary folders and move the HijackThis.exe file to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, by running disk clean-up utilities, etc.
____________________________________________________________________________________

Once you've fixed the above problem:

You will need to close/quit all web browser programs and disconnect from the Internet for the following, so you should print out these instructions or save them into a text file with Notepad.

* Open your Add/Remove Programs control panel and uninstall any software related to "TrustInBar" or "TrustInCash" if you find it listed there.

* Download the …

Yes- your latest HJT and ewido logs are both clean, and it appears that your hosts file is clean as well.

You should wait until kylethedarkn gives a final OK to this as well, as he was your primary troubleshooter on this issue.

Keep us updated on your progress; we'll be here... :)

...its not like im gonna stalk you or anything...

Hey, feel free- it's been a while since I had a good *glomp*ing... [IMG]http://www.stevewolfonline.com/Downloads/DMR/Visuals/jesterlaugh.gif[/IMG]

Seriously though- you're welcome, I'm glad the info helped.
Are you all set with the rest? If you have any other questions, let us know.

Have a look at the contents of your hosts file:

Open Windows' Notepad utility. In Notepad:
* Click on the "File" menu option.
* Click the "Open" option in the File menu.
* In the "Files of Type:" drop-down menu box, choose "All Files"
* In the "Look in:" drop-down menu box, navigate to the C:\Windows\System32\Drivers\etc folder.
* Double-click on the file named "hosts".

A default Windows hosts file contains only the following text:

# Copyright (c) 1998 Microsoft Corp.  #
  # This is a sample HOSTS file used by Microsoft TCP/IP stack for Windows98
  #
  # This file contains the mappings of IP addresses to host names. Each
  # entry should be kept on an individual line. The IP address should
  # be placed in the first column followed by the corresponding host name.
  # The IP address and the host name should be separated by at least one
  # space.
  #
  # Additionally, comments (such as these) may be inserted on individual
  # lines or following the machine name denoted by a '#' symbol.
  #
  # For example:
  #
  #      102.54.94.97     rhino.acme.com          # source server
  #       38.25.63.10     x.acme.com              # x client host
  
  127.0.0.1       localhost

If your hosts file contains entries beyond the "127.0.0.1 localhost" line, please post the contents of the file here.

-

...an unexpected error has occured at procedure: modmain_fixotheroneitem(sltem=01-hosts:local127.0.0.1
error#75-path/file access error

That most likely indicates that the hosts file has its "read-only" attribute set, meaning that HijackThis cannot make changes to the file.

The hosts file is located in the C:\Windows\System32\Drivers\etc folder, and is a plain text file which can be viewed by opening it with Windows Notepad. The "localhost 127.0.0.1" entry in a hosts file is perfectly normal, but if your hosts file contains other lines below the localhost entry, they could be the work of malware.

I think the 017 entries are fine. wp.fsi is my internal network.

You look good to go, then; glad we could be of assistance. :)

@DMR - The lines...They are gone!

It's magic!

... or was it sheer boredom on my part? :mrgreen:

By the way- crunchie got me hip to the fact that there is a Vundo variant which involves sysprotect.com, and which also hides itself from HijackThis. You might want to do the VundoFix routine.

I hate to say this, but it is pretty hard to read that log, with all those lines in it...

What lines, T? [IMG]http://www.stevewolfonline.com/Downloads/DMR/Visuals/dunno.gif[/IMG]

:mrgreen:

...the desktop was private so i did not have permissions so i tried to go through the admin to transfer permissions but was unable to.

Getting the permissions and ownership changed correctly can be a bit difficult sometimes. The article below describes the basic process pretty well:
http://pcsupport.about.com/od/pcrepair/a/reclaimfolder.htm

To begin with, please give us the make and model of the computer.

Less elaborative verbiage and more succinct detail would be good for starters; the exact circumstances of your situation get a bit lost in your telling of the tale. :mrgreen:

Seriously though:

1. Please clarify why exactly, when the problematic hard drive was installed in the other computer as a slave, you couldn't access the data you wanted to rescue? If you were denied permission to a folder, you can gain access to it by going in to the advanced security settings of the folder's Properties and taking ownership of the folder.
If you had a different problem, please explain.

2. As for the original error, the windows\system32\config\system file is a component (called a "Hive") of the Registry, and yours appears to have become corrupted. The hives are unique to the system on which Windows was installed, so you cannot just replace them with copies from another computer.

* Booting into the "Last known good configuration" might do the trick, although it often doesn't. It is the easiest fix though, so it's worth trying.
To boot into that configuration, start tapping the F8 key right after your computer starts up (that is- well before you see the Windows startup graphic/logo). This should bring up the boot options menu, where you can choose the "Last known good" menu item.

* There are a couple of other ways to fix the corruption, which are discussed in these links:
http://www.kellys-korner-xp.com/xp_sys32.htm
http://support.microsoft.com/kb/307545/en-us