Posts by DMR

Great; glad we could help :)
How is the rest of the install coming? DO you still have trouble with it?

He could also remove the hard drive too and just use a bootable floppy...

We know that works from info in his first post:

I can manage to get it to boot from a WIN98 recovery floppy disk...

If this now boots up to a C prompt

Er- "A" prompt? :mrgreen:

One way to further pinpoint the fault would be to remove the original hard drive and install another hard drive (which you know to be good) as the Primary Master drive and see if the XP install CD sees that drive and allows you to install to it.
If that works, then your current drive likely has some sort of problem. Unfortunately, if that doesn't work, you could be looking at a pooched motherboard. :(

With the hard drive connected (and jumpered) as the Primary Master drive, remove/disconnect all unnecessary components from the motherboard (CD-ROM/DVD drives, network cards, sound cards, etc.) and try to boot the computer. Let us know the results.

...then i change how to open the file cause it was an application and i hit always open on notepad...

Do you know the extension of the deleted file's name? It would definitely help to know if the file was an .exe, .com, .lnk (shortcut), etc. file.

OK- let the system, as it is presently configured, cook long enough for you to be fairly certain that the problem is not (or is) still occuring.

Give it a reasonable amount of time and see if it remains stable before calling Comcast. Also- did your modem give you the upstream SNR? If so, it didn't make it into your post. (The other signal stats you posted look OK.)

I hope I've done it OK

Yes, you did. :)

You will need to close/quit all open programs and disconnect from the Internet for some of the following, so you should print out these instructions or save them into a text file with Notepad.

1. Open your Add/Remove Programs control panel and uninstall the "Spyware & Adware Removal" product, as it is definitely not a recommended program. It appears on the list of Rogue/Suspect products with the following explanation:
"uses flawed, inadequate detection scheme"
Before buying/downloading/installing any purported "antispyware" program, you should definitely consult the Rogue/Suspect list.

2. Your log indicates that you have two antivirus programs (Panda and F-Secure) running simultaneously. This is not advised, as having multiple antivirus programs installed can cause conflicts. Note that this is not the case with antispyware programs; they can coexist happily. It's up to you which program you keep, but you should uninstall one of them. Let us know which product you decided to keep.

3. Click on the "Run..." option under your Start menu, type "CMD" (omit the quotes) in the resulting "Open:" window, and hit OK. This will open a DOS window.
* At the DOS prompt, type the following two commands one at a time, hitting the Enter key after each:

sc stop rpcapd
sc delete rpcapd

* Close the DOS window after the second command completes.

--- Please close/quit all open programs …

OK- try/check the items I posted earlier and get back to us with the details after that. The problem could well be on Comcast's end, but it's always best to eliminate everything that you can before you call for a service visit. Comcast does support your modem, so that's one thing in your favor.

* When you power-cycle the equipment, physically remove the power cord from the modem and let it sit that wayy for a few minutes before repowering it, and wait until all of the front-panel status LEDs have stabilized before turning on the computer.

* Post the signal-level info from the modem if you can get it.

Hi Lc0756, welcome to DaniWeb :)

To begin with, can you please post the exact make/model/version of the modem?

Those errors in the modem log are all related to the WAN-side connection, so I seriously doubt that plugging a computer directly in to the modem will change anything. However, you may have to get that configuration working to avoid the inevitable "sorry, but we don't support routers" excuse that Comcast tech support will undoubtedly give you.

* When you said "I tired connection a laptop directly into my modem but got nothing":
- What exactly is "nothing"?
- Did your laptop even get an IP assigned to it by/from the modem?
- Did you power-cycle both the modem and the laptop once you connected the two, bringing up the modem first and allowing it to initialize before restarting the computer?

* What are states of the status LEDs (especially DS, US, and Online) when the problems occur?

* Can you pull the signal-strength/SNR status info from the modem and post it here? If you monitor those numbers, do they differ perceptibly during the times when the connection is working properly and when it is not?

NoAdware was actually delisted from the category of Rogue/Suspect antispyware programs because they have supposedly cleaned up their act regarding false positives and other "questionable" behaviour. However, I personally refuse to recommend "antispyware" programs which have histories of such blatant deception; there are plenty of other reputable (and free) utilities available.
Since you say that you are experiencing homepage hijacks, you may very well have "unwanted guests" which need to be removed. Let's check out that possibility.

Download the free HijackThis utility. Once downloaded, follow these instructions to install and run the program:

Create a new folder for HJT outside of any Temp/Temporary folders and move the downloaded HijackThis.exe file to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

Even though it seems like you're doing everything correctly, this still sounds like the classic problem of burning the CDs in the wrong format.

Let's verify a couple of things:

1. When you reinsert one of your burned "audio" cds into your computer's CD drive, how does Windows Explorer identify the drive/disk? Does the drive have the icon of a disc with a musical note on it? Is the disc identified as "Audio CD"?

2. When you view the contents of the disc in Windows Explorer, how are the tracks named and what does Explorer list in their "type" column?

Ok- I think we have a suspect.

Run HijackThis again, put a check in the box to the left of the following entry, and then click the "Fixed Checked" button:

O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe

Once HJT finishes the fix, close the program and then reboot the computer. Let us know if that fixes the startup problem with the installation program.

You're welcome. Let us know the results of trying the RAM,BIOS, etc. possibilities.

I have also looked to see if there is a reference to it in the Start Up files but I am not sure as some of the entries there could be anything !!!!!

Very good- you're thinking along the right track :mrgreen:

Please download the free HijackThis utility and follow the instructions below to run the program. While normally used to find viruses and spyware, HJT can also be used to list and remove non-malicious startup commands and Registry entries. Hopefully it will be able to tell us what command keeps running the NTL installer.

Create a folder for HJT outside of any Temp/Temporary folders and move/extract HijackThis to that folder now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.
Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file in your next post.

The aborted install has most likely left pending installation instructions/commands in the Registry.

* Does the behaviour occur when you boot the computer into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up)?

* Can you run other programs once the problem occurs, or does it pretty much lock you out of doing anything else?

* Did you have XP Pro installed before, or was it XP Home?
* Is the new version of XP Service Pack 2, but the old version was SP1?
* Can you give us any details about the problem(s) the computer was having to begin with that caused you to reinstall?

* Here's the official article from Micorsoft concerning the RAM possibility:
http://support.microsoft.com/?kbid=315335
If you want to stress-test your RAM, you can do that by making a bootable disk with the free memtest386 utility on it.

* Given the age of the BIOS, I'd definitely update it if possible.

When it occurs during the XP installation process, the error you are receiving usually points to a problem with your physical RAM (either a defective module or an incompatible module configuration).
Please post the full and exact contents of the error message, as the 0x0000008E code in the Stop error you're getting only indicates the general category of the error.

You're welcome. :)

Your latest log is clean. Is the computer still exhibiting problems? If so, please try to give us as many specifics regading the problems as possible.

Hi frankieroks,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread and post your question there. When you do, please try to give us as much specific info as possible regarding the problem (exact error messages, names/versions of relevant programs, system specs, etc.).

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

* Is the network adapter an internal PCI card, or a removable (USB, PCMCIA, etc.) device?
* Do you know the make and model # of the device? If so, post that info.

* Right-click on the My Computer icon on your desktop and choose Properties from the resulting context menu.
* In the Properties window, click on the Hardware tab.
* In the Hardware tab, click on hte Device Manager button.
* Under the Network Adapters heading, see if there is a network device marked with a Red "X". If so, double-click on that device entry and post the information listed in the General and Driver tabs of the device's Properties window.

It was not my IP address so I checked it

:eek: Those weren't your IP addresses, they were the DNS server IPs assigned by your ISP (Tiscali). If your ISP automatically assigns you the IP/Gateway/DNS IP addresses, don't sweat it; your computer will re-acquire the info. If you manually enter your IP settings into your network card's Property pages, re-enter those addresses in the DNS server section of the Properties window.

OK- that looks better :)

1. Open ewido and SpySweeper and use their online update features to make sure you have the absolutely most current updates installed for both programs. Do not run scans with the programs yet, just close them once they finish the update process.

2. Create a new folder on your desktop (or in some other convenient location) and name it VundoFix. Download the VundoFix.exe utility and save it in the new folder.

* Run vundofix.exe
- Click the Scan for Vundo button.
- Once it's done scanning, click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click YES.
- Click yes; your desktop will then go blank as it starts removing Vundo.
- When the removal is complete, you will be prompted to shutdown your computer; do so.
- Start the computer again and let it boot normally.

3. Run HijackThis again, put a check mark in the box to the left of the following entries, and then click the Fix Checked button:

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {20D57A66-F7DF-467d-907B-9B7F4A118AB7} - (no file)
O4 - HKLM\..\Run: [Microsoft Telecoms Center] telcoms.exe
O4 - HKCU\..\Run: [Microsoft Telecoms Center] telcoms.exe
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.

I updated Windows XP...

Not according to the header information in your new HijackThis log; it still reports that you are running the same (and outdated) versions of XP and Internet Explorer as before:

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Open the Event Viewer utility in your Administrative Tools control panel and look through the System and Application logs for networking-related messages/warnings/errors which occur at or around the time of the connection loss. If you find messages which might shed some light on the problem, do the following:

Double-clicking on an entry will open a properties window with more detailed information on the error. In the Properties window of a given entry, click on the button with the graphic of two pieces of paper on it; the button is at the right of the window just below the up arrow/down arrow buttons. You won't see anything happen when you click the button, but it will copy all of the details to the Windows clipboard. You can then paste the details into your next post here.

Hi pete25,

Your latest log still shows signs of infections, but the following info in your HJT log's header also shows that you are running a totally "virgin" version of Windows XP (no Service Packs, Security/Bug Fixes, etc. appear have been installed):

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

If you are running such an outdated, unpatched version of Windows, your system will almost certainly get reinfected in no time. You should use the Windows Update feature to bring your system up to a fully-patched version of Service Pack 1 (note that upgrading to Service Pack 2 on an infected system is not recommended!). Once you've done that, the info in your log's header should read as follows:

Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

In all honesty, my bet is that your version of XP will probably fail validation at the Windows Update site, as the most common reason that people are still running such an outdated version of XP is that their installation of XP is, whether they know it or not, not a fully legal copy. Give the update a try though, and let us know the results.

Hi again, delete your temp internet files. To do this on internet explorer. Then click

Tools>Internet Options>Then click Delete Cookies, and Delete Files.

Right, and when you get to the "Delete Files" window, be sure to put a check in the "Delete all offline content" to make sure that all of your Temp Internet files are deleted.

Then download CCleaner - http://www.ccleaner.com/

And run it.

Good suggestion, and in order to have CCleaner do the most thorough job of deleting unwanted/unneeded content, you need to make changes to a few of CCleaner's default settings.
For example, by default CCleaner will only empty the Temp files in your profile's folders, but not those in other user profiles such as the "LocalService" profile where Norton has found your infected file.

Also- this kind of cleaning is best done when booted into Safe Mode, as many Temp files cannot be deleted when Windows is booted normally, because the files are in use at that point.

1. Boot the computer into Safe Mode.

2. Open Windows Explorer, and in the Folder Options->View settings under the Tools menu; check "Show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types". Close Explorer after that.

3. Open CCleaner.
- Go to Options-> Advanced: Uncheck "Only delete files in Windows Temp folders older than 48 hours"
- Go to Options>CustomFolders>Add Folder>Navigate to these folders (click on bold file once and …

Since you logs have shown no signs of the infection, it would be helpful if you could get more details from the antivirus program, such as what specific malicious components it found, and where (exactly) those components live. Open Symantec and see if there are any files in quarrantine; also look at the scan repost log(s) to see if there is any recorded history concerning the infection;.

but still i cannot burn music onto CDs

- Is it only WMP that won't burn? If you have other burning programs installed, try one of those and let us know the result.

- Are you having trouble burning any kind of CD, or is it just audio CDs?

- Have you checked through your burning software's preferences and configuration settings to make sure that the CD burner is correctly recognized and configured?

- What does happen when you try to rip a CD? Give us exact details please.

Hey- welcome D3m3nt3d! Glad to have your help around here :)

you look like you are all clean now.

Careful there, T- it wasn't ;)

Nasties:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.imvmuyxoeelgqlcxblajyv.c...TUFBdEfQQ5.html
O4 - HKCU\..\Run: [loveinternet] C:\DOCUME~1\Owner\APPLIC~1\PHONEL~1\Byte Bows.exe
O20 - Winlogon Notify: App Management - C:\WINDOWS\system32\ckcfg32.dll (file missing)
O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\wvnsta.dll (file missing)

For the WPM 10 error, try the following:

1. There is an issue with corruption of the C:\Windows\System32\wmploc.dll file, which can cause the error you're getting.
You may have a backup of the wmploc.dll file elsewhere on your computer. If so, replace the version of the file in C:\Windows\System32\ with a copy of the backup, reboot, and try the WMP 10 installation again.

2. Run the System File Checker to check for and replace missing or corrupt Windows files which may be causing error. The following article on Microsoft's KnowledgeBase has more details on the proceedure:
http://www.microsoft.com/windows/windowsmedia/knowledgecenter/mediaadvice/0073.mspx

Please post the exact and complete message.

I was also wondering if you could delete that memory...

Oh right; I forgot to post that info:

The list of visited sites is in your C:\Documents and Settings\Your_User_Name\Local Settings\History folder, and you can clear it by doing the following:

Go to the Internet Options again and this time click on the General tab. Click on the "Clear History" button in the bottom section of the General tab to erase the stored list of visited sites.

...when u type something you've typed before (a word or address) it automaticly searches it for you...

That feature is called AutoComplete; here's what you need to do to clear its history of visited sites:

- Open Internet Explorer, click the Tools menu, and then click on Internet Options.

- In the Internet Options window, click the content tab, and then click on the Autocomplete button.

- In the resulting window, click "Clear forms" to clear all form data except for passwords and/or click "Clear Passwords" to clear the passwords.

If you don't want IE to use AutoComplete in the future, uncheck all of the boxes in the "Use Autocomplete for" section.

I'd start by completely uninstalling WMP through your Add/Remove Programs control panel and then downloading and install a fresh copy of the program.

Good job; glad you got it :)

Hi akeja5a,

First of all- welcome to DaniWeb :)

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Please start your own thread, post your HijackThis log in that thread, and we will assist you from there.

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_policies

Thanks for understanding.

Hi Keli, welcome to DaniWeb :)

- How are the two computers connecting to the cable modem? Does the cable modem itself allow multiple computers to be connected directly to it, or do you have the computers connected to a router or switch which then connects to the modem?

- Are the computers networked by Ethernet cables, wireless, or both?

- After moving the computer, did you hook everything back up exactly the way it was before the move? Did you use the same network wiring that you were using before the move (if you're using a wire, of course)?

If you can give us the answers to the above, we'll have a better idea of what might have happened and what you can do to fix it.

NO...

You don't have a virus. Your numlock key is turned on...

OMG Alex, please don't do that when I'm drinking coffee- it came right out of my nose and spewed all over my keyboard!!! [img]http://www.stevewolfonline.com/Downloads/DMR/Visuals/jesterlaugh.gif[/img]

Oh crud- now my keyboard is acting funky.... :mrgreen:

Good job- it looks like ewido and Spy Sweeper removed the remains of the WinFixer infection.
One last thing to check: open Windows Explorer and make sure the entire c:\program files\common files\winsoftware folder has been deleted. If the folder does still exist, delete it and then empty your Recycle Bin.

1. Run Hijackthis again, put a check in the boxes to the left of the following entries, and then click the "Fix Checked" button:

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [WinFixer_2005] C:\Program Files\WinFixer_2005\uwfx5.exe /scan

2. Delete the entire C:\Program Files\WinFixer_2005 folder and then empty your Recycle Bin.

3. Perform the following procedures to clean up loose ends which don't show up in a HijackThis log:

You will need to close/quit all web browser programs and disconnect from the Internet for much of the following, so you should print out these instructions or save them into a text file with Notepad.

> Download and install the following utilities:

CCleaner - www.ccleaner.com
Webroot Spy Sweeper (14 day free trial) - http://www.webroot.com/shoppingcart...4011&vcode=DT02
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en
ewido Anti-malware (14 day free trial) - http://www.ewido.net/en/download/

- Open Spy Sweeper, click on "Options", and then click on "Update Definitions" under the Program Options tab. Do not run a scan yet; just close the program once the update completes.

- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.

- Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program …

how do u post new threads

Near the top of each forum's main window, just above the list of threads, there is a button labelled "Post a New Thread". Clicking that button opens up a "Post New Thread" window where you can compose your message and give it a title. Once you've finished composing your post, just click on the button below the message window labelled "Submit New Thread". That's all.

In terms of your actual problem though:

One common cause, and the fix, are described in this article in Microsoft's KnowledgeBase:

http://support.microsoft.com/kb/q270008/

Although the article pertains to Win 2000, I've seen the problem occur with XP as well; the fix described for Win 2000 works for XP. You may need to reboot after performing the fix.

Please note that although the article only refers to the "UpperFilters" and "LowerFilters" entries in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet registry subkey, I've had to apply the fix to the similar entries (if found) in the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x subkeys as well in order to make it work.

You have a Winfixer/Virtumundo infection; please do the following:

Download VundoFix.exe to your desktop.
1. Double-click VundoFix.exe to run it.
2. Click the "Scan for Vundo" button.
3. Once it's done scanning, click the "Remove Vundo" button.
4. You will receive a prompt asking if you want to remove the files, click "YES".
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, VundoFix will prompt that it will shutdown your computer; click "OK".
7. Turn your computer back on.
8. Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Apparently, there is no Flash Recovery capability with this motherboard, so the computer was hung up trying to execute an impossibility.

Odd- if that's the case, I wonder why/how they even had the option available...

In any event, I'm glad you got it straightened out without any harm done to the machine. :)

Doesn't sound good; 3 hours is much too long for a flash upgrade.
Before you try anything, please tell us the make/model of the computer and the BIOS (including revision # if possible).

Right then; does everything still seem to be working without problems?