Posts by caperjack

i have been having this problem for quite sometime but it seemed to getting more serious ever since i install msn 7.0..
anyway my problem is that my msn keeping signing it in and out..
anyone knows what causes it and wat i can do to stop it??
please help me... thanx

Hi Welcome to DaniWeb ,I don't use MSN ,do you mean msn messenger 7 ,if so version 7 is beta ,and just trial version to work out the bugs ,with you as the ginnie pig .!if you mean msn 7 explorer than skip the above ,i don't use it either !sorry

No help?
Why?
:cry:

Welcome to DaniWeb .
It all takes time , Holidays! and we are all working volunteers!with real lives also ! good luck

go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Or HERE if that link fails to work or you don't have a zip program installed .

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE Luse of SpywarEGIT AND VITAL TO YOUR COMPUTER'S …

optain the drivers for the devices install them ,then plug them in .
what the name and model #s' of the two devices,try searching www.google.com

soor I've used nortons for years and have never had that happen .
run these online scans to check computer in the meantime .
..............
Run at least 2 of these !
http://housecall.trendmicro.com/
http://www.kaspersky.com/scanforvirus.html
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://www.ravantivirus.com/scan/
http://www.bitdefender.com/scan/licence.php

Go
Here and Get Trojan-Hunter Fully working trial! and run a full scan
,,,,,,,,,,,,,,,,,,,,,
To remove trojans there is a tool which needs to be downloaded and run.

1. Please download Stinger and save it to your desktop

2. Double-click on the stinger.exe file and open the tool

3. Choose your entire hard drive to scan.

4. Choose Scan Now

5. Stinger will fix anything that it finds

6. Click the File menu and select Save report to file

7. Post the log file results here in this thread.

STINGER

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Reboot to SAFE mode to delete files
How to start computer in safe mode

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan Please do an online scan, 2 would be better,

Micro World http://www.mwti.net/antivirus/free_utilities.asp
Trend Micro http://housecall.trendmicro.com/housecall/start_corp.asp

Make sure that you choose "fix" or "clean".

.
,,,,,,,,,,,,,,,,,,,,,,,,,,
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

as suggested in you other post ,please get the latest version of hijackthis ,ans post a new log here ,
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

,,,,,,,,,,,,,,,,,,,,,
To remove trojans there is a tool which needs to be downloaded and run.

1. Please download Stinger and save it to your desktop

2. Double-click on the stinger.exe file and open the tool

3. Choose your entire hard drive to scan.

4. Choose Scan Now

5. Stinger will fix anything that it finds

6. Click the File menu and select Save report to file

7. Post the log file results here in this thread.

STINGER

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Reboot to SAFE mode to delete files
How to start computer in safe mode

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan Please do an online scan, 2 would be better,

Micro World http://www.mwti.net/antivirus/free_utilities.asp
Trend Micro http://housecall.trendmicro.com/housecall/start_corp.asp

Make sure that you choose "fix" or "clean".

.
,,,,,,,,,,,,,,,,,,,,,,,,,,
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder …

boot to the xp disk and do a Repair install
or mabe simular to this ,
http://support.microsoft.com/?kbid=297185

a little more info please ,like windows version ,connection type and anything else you think might add a bit more !

format again and just use the xp disk to install ,if its an up grade it will still do a full install just have to have the win98 disk to but in to show proof of ownersihp of a previisous version of windows when it asks for it .

This problem could occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Or HERE if that link fails to work or you don't have a zip program installed .

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE …

check firewall settings

I just replaced the CMOS battery this morning, but no luck. The computer recognized that there had been a battery change & it automatically restored the CMOS settings to default, but I still can't get past the opening COMPAQ screen. Do you have any other suggestions?

p.s. When I use a Windows XP startup floppy disk to get to a command prompt, I can access the C drive and view the directory ("dir" function). There are only 5 files that pop up, "a" "0" "F" "t" and "f", all of which are about 7MB large, and it says that there is ~750MB left on my C drive (which is about right where it was before the crash, as far as I can remember).

You PS. make little sence ,it should show the windows directory if not you need to format and reinstall windows .
you say there are 5 files show up about 7mb each ,and 750 mb left .750+35 =785 mb HDD and you are talking about using winxp disk ,
Why arent you using a win98 bootdisk,to dir the drive .
get one here www.bootdisk.com if you haven't got one ,
boot computer to it and at the A:\ prompt type , SYS C:
and reboot ,if nothing happens try going into the bios and do a auto detect harddrive ,say yws to all 4 drive it finds,empty chanels and cdroms included in the list

Hello all,
I've recently had a problem with my pc, but it is fixed noe, but during the process I did some sort of system restore (advice from a support line). This changed the adress of some of my files on i-tunes and on my rome total war game. The i-tunes cd had a repair function so that is fine, but the toatal war game does not work. I have tried deleting it, but am left with a listing in the add/remove program list. When I try to remove the programme, nothing happens. Any suggestions on how to remove it so I can re-install?
I've been told I should use a tweak programme(?).
Any help is much appreciated

PS I know bugger all about computers as you may have already gussed! :-)

Have you tried to reinstall it without uninstalingl it ,and don't use that dreded word Delete.unless that is you mean you actually deleted the games folder and then tryed uninstall in add/remove programs .

Hey casperjack ... I couldnt open your link ... is the link inactive or I am having some kinda trouble ??

opens for me here is is again.
http://support.microsoft.com/default.aspx?scid=kb;en-us;810869

:cool: well, that's my plight. Who's got an answer

Hi ,welcome to Daniweb ,we ask that you not piggieback another thread ,please start your own ,with a better explanation of you problem and what you have done so far to correct it ,thanks

basically i want to know if it will deleate everything on the drive because my friends is not backed up and theres important stuff on it

Hi ,you can install win98 over itself with out loosing anything ,that is if all goes well ,i doned it dozens of times ,on other peoples computers and never had anything go wrong .
when installing it watch for this ,when it does a search for directory to install in it will come up with c:\windows000 ,if you intall to this directory it will not over write ,but will create a new install ,not what you want ,so when you see c:\windows000 ,you need to change directory ,you take out the 3 zeros ,and it will overwrite win98 ,relpaceing any bad or corrupt windows files ,butif the compyter has virsus or trojans ,on it they will still be around after the install over !

This might help you bring it back.
Recycle Bin

I have a dial up connection and I'm not on all the time ... and sometimes I use my own dialup connection or other wise I use net from my LAN. And I dont use p2p programs either. But yes I download a lot of things .. softwares and bla bla ... no other such big risky work done on my pc ....

I have three windows( XP, XP, 2003 server) installed ... so I use two of them for testing purposes and one of them is used regularly.

Now what will you suggest ??

Hi ,in mysignature link sotware tool ,look for spyware prevention tools, 3 tools ,ie-spyad ,spywareblaster, , and spywareguard ,i don't use the guard anymore as i use norton 2005 antivirus and it has worm blocker ,and i also use microsoft spyware beta program .
I reccommend, ie-spyad ,and spywareblaster ,and spywareguard ! all free and a good antivirus program ,At least!

This problem could occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Or HERE if that link fails to work or you don't have a zip program installed .

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE …

my brother appears to be getting different ones all the time so i dont know what it is.

ok,next time he gets one tell himto write it down

fix fo winxp,
click on download link on this site

Manul fix istructions .
http://support.microsoft.com/default.aspx?scid=kb;en-us;817571

CaperJack, I got it. Tyyyyyyy :)

Great ,just to answer you question regarding the removal of a file type in wmp 10 ,it will not affect anything else it just means that wmp will not open that file type ,until you recheck it to do so .

log looks good ,did you disable and reinable you system restore .
also some things to checkout to keep the nasties away .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

1. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

   See this link for a listing of some online & their stand-alone antivirus programs:

   Virus, Spyware, and Malware Protection and Removal Resources

2. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   Antivirus
   
3. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

   FIREWALL

   For a tutorial on Firewalls and a listing of some available ones see the link below:

   Understanding and Using Firewalls

4. Visit Microsoft's Windows Update Site …

this is not virus releated ,just frigged up computer ,the site in thisLINK should help .

you don't say how you are trying to install goback from the cd ,but i will just say what i think needs to be done ,sorry if you already tried this ,insert the norton disk ,click on install norton utilites ,select custome install and uncheck everything except goback and then click install ,if that doesn't work and you don't mind install all of nortons utilities ,just do the full install and it will overwrite what you already have installed and add goback or at least it should !!!good luck

this is what i would if it were my computer .you will need to reinstall other usb devices after doing this ,also it may not help .its just what i would do as a troubleshoot!!
I would go to device manager and remove all usb hubs listed in usb controler devices .reboot windows .then try the device again ,also have you tried it in all your usb slots !

ok,when you click the mail icon in IE is what you are refering to right !
does it open Outlook if you click the icon to read mail ! If not go to tools in IE /internet options and programs ans set outlook 2003 as your mail handler .
Just a thought but im guessing that that is done allready !

does this fit !!
http://www.maxpc.co.uk/tips/default.asp?pagetypeid=2&articleid=33718&subsectionid=719

HI ,the full error message would help, with out it ,its a shot in the dark

You may have been hit with a trojan /virus or you may not .I would call my ISP provider and make sure there service is working ok ,and then run a few scans .
,,,,,,,,,,,
Run at least 2 of these !
http://housecall.trendmicro.com/
http://www.kaspersky.com/scanforvirus.html

http://www.pandasoftware.com/activescan/com/activescan_principal.htm[/

url]
http://www.ravantivirus.com/scan/
http://www.bitdefender.com/scan/licence.php

Hi ,welcome to DaniWeb ,in WMPlayer ,go to tools .options file types and uncheck the file type of your downloaded file if it there ,i did a quick search for express scribe and dont think it going to be there but check anyway ,
also maybe this will help if espress scribe is in the list ,go to stat/set programs or defaults .if it not there then go to start/control panel /add and remove programs and on the left you will see set programs and defaults and click on nonmicrosoft ,and media player ,click the dropdown and see if express scribe is in the list .

good to you you figured it out ,good luck!!!

I have sygate firewall and avg antivirus ... and ad aware SE .... is that enough ??? I just hate the blue screen of death in sp2 ... but it works fine with sp1.

I would say that is enough ,it depend on a few things though ,like you internet connection is it on all the time or just when you are using it ,also depends on what you do on the net ,if you use instent messengers and axcept file from other users ,if you use P2P programs ,if you like downloading FREE programs to try ,ect ect .
In my signature there is a link software tools check it out ,I just check it and it has had a overhall so i will need to look around to tell you were to find the program i was going to mention .back later !:)

Back allready, check out downloads on the left and then spyware prevention I use and suggest ie-spyad and spywareblaster .ie spyad install info to the registry to block spyware from loading into the registry from some 3500 sites, ,and blaster install to the harddrive and is updateable and install blocked sites to internet explorers security/ restricted sites . and also firefox ,check it out .

info on the trojan that droped this file
http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=41046

i thought that if i could go into safe mode for windows xp home and just delete the file then it would be gone but now as you may have guessed i have lost three programs due to doing that and i was windering if there is a way for me to fix what i did. i have tried to undelete the file that is named ms0b920b.dll but i have had no success and the restore did nothing to help. i was just wondering if you would know a way to fix it.

Hi and Welcom to DaniWeb and thanks for post here in responce to the PM.
that file was put on you computer by a trojan .
What three programs did you loose i may be able to help you replace them if i knew , ,
also you should maybe run a free online virus scan .
won't pring back the missing programs but will help rid computer of viruses.

Run at least 2 of these !
http://housecall.trendmicro.com/
http://www.kaspersky.com/scanforvirus.html
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://www.ravantivirus.com/scan/
http://www.bitdefender.com/scan/licence.php

so how do i get this

should i format the floppy and go to bootdisk.com and get a new one?

yeah that would be a good idea .

Well, it happened again last night, and I check the status of the network connection, and everything was ok. I was still able to access the internet through other programs just not through a browser. It seems like the browser is sending out the http request, but I don't know if my firewall was blocking it, or it wasn't getting a reply back. I turned off my firewall (zonealarm) and the samething still happens. Any ideas?

no sorry ,strange for it to loose it connection ..have you run any online virus scans ,might help .

Run at least 2 of these !
http://housecall.trendmicro.com/
http://www.kaspersky.com/scanforvirus.html
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://www.ravantivirus.com/scan/
http://www.bitdefender.com/scan/licence.php

i cant get it to format its saying bad command or file name

that usually indicates that the format command is not on your boot floppy .

Logfile of HijackThis v1.99.1
Scan saved at 9:27:12 PM, on 3/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\STOPzilla!\SZServer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\STOPzilla!\Stopzilla.exe
C:\WINDOWS\System32\pd14.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\TEMP\q1272325.exe
C:\WINDOWS\TEMP\q1272325.exe
C:\WINDOWS\TEMP\q1272325.exe
C:\WINDOWS\TEMP\q1272325.exe
C:\WINDOWS\TEMP\q1272325.exe
C:\Program Files\STOPzilla!\SZOptions.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\phillip\LOCALS~1\Temp\Rar$EX00.875\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.msn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\System32\netdc.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ISTbar - {FAA356E4-D317-42a6-AB41-A3021C6E7D52} - C:\Program Files\ISTbar\istbarcm.dll
O4 - HKLM\..\Run: [STOPzilla] C:\Program Files\STOPzilla!\Stopzilla.exe /autostart
O4 - HKLM\..\Run: [Setup experation] C:\WINDOWS\svchost.exe
O4 - HKLM\..\Run: [Windows …

Now I have NO IDea Wher to find rthe file....Im notvery computer savyv

OK I compresed it and everything but i dont use outlook any way ic an save it and send it to yu

to find a file you need to go to start .search and /files and folders and type in the file name .it will show up the path to the file..

if you are using winxp ,,go to start /run and type in SFC /SCANNOW ,note the space between sfc and the /.
it may ask for you to but the windows disk in the cdrom drive

interesting ,if putting the windows disk in will stop the message then why not just do it .I would but then i do live dangerously when it comes to my computer .!does it say what files it doesn't reconize.

Hmmm, I'll definitely check next time it happens. How can I go about fixing this if this is the case?

Thanks

there is a window patch for it, if it applies to your system ,I don't rhink that whats going on with your though .I had the problem with my sisters computer ,but the patch didn't fix it ,i still haven't gotten it to work with a nic card ,but it works for here with here wireless card ,so i gave up trying to fix it !

Hi,check the spyware tools link in my signature for a good free virus tool ,AVG.
also the file amount difference is because one scan deeper into you file system just to be sure !!! yes its better to scan deeper and more files .

Remove Hotoffers

,,,,,,,,,,,,,,,,,,,,,,,,,,
Follow the above link to help remove hotoffers

Download the Pocket KillBox
Unzip the file to your desktop.
Run Pocket Killbox and paste the full file path of each of the below files in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter each file (see the files below).

C:\WINDOWS\System32\systr.dll

Reboot afterwards if the files are successfully deleted.

If all files are not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot only after the last file you enter.

I had a mind set that one could sign on with aol, and somehow modifiy it, meaning not use all it's features.
uh, yes, I meant aol
I want to continue to use it, but would like to keep it contained .....oh well
joal

Not sure with AOL but i useto subscribe to a dialup provider that used a software disk to install ,it loaded its settings and stuff and netscape to run ,i use to just go to dialup networking and create a new ,and put in there phone number and my password and use it without loading there software ,not sure if you can with AOL though

This info only after you get everything cleaned up, just incase you need a restore ,a bad restore is better than no restore ..
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
One of the best features of Windows ME or XP is the System Restore option, however if a virus infects a computer with this operating system the virus can be backed up in the System Restore folder. Therefore, clearing the restore points is necessary after a virus removal.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(winXP)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Uninstall via the add and remove programs
Instant Buzz Daemon first .

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
You might want to print out or copy & paste to notePad , these instructions as you will need to close this browser window to fix with hijackthis !

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

O4 - HKLM\..\Run: [rapfnts] c:\windows\system32\rapfnts.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [Instant Buzz Daemon] C:\Program Files\Instant Buzz\IBDaemon.exe

The next are optional but suggested fixes as they are rescorce hogs and not needed in startup.
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O9 - Extra button: Instant Buzz - {066040F0-5018-4E15-8AA0-81D36136D989} - C:\WINDOWS\System32\shdocvw.dll

The 016s' like this one, fix them all just to be safe , as the good ones will return when you visit that site again .

O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support2.charter.com/sdccomm...oad/tgctlcm.cab

…

The main difference is SP1 blocks out going attemps .and SP2 blocks them both ways ,
My opinon is if you have a good firewall and good Virus protection you don't need either SP1 or SP2 installed on you computer ,but if you want an updated winxp then SP2 is just that, a winxp OS upgrade ,and like any of the windows OS upgrades ,its best done on a fresh install ,that is why it has so many problems when people are installing it long after the orginal install of winxp.