Posts by caperjack

ALT+f4 will shut the darn thing down so we can all get some sleep

How does one stay on line and without using their software?

Im Assuming you mean AOL ! or do you mean the Windows OS Software program .

hi why did you have to uninstall nortons ,and reinstall it ??
Sounds like maybe you went about it the wrong way .!!

it means youve been browser hijacked ,
follow the instructions below .
,,,,,,,,,,,,,,,,
Remove hotoffers

,,,,,,,,,,,,,,,,,,,,,,,,,,
follow the direction in the above link :Then below

Download the Pocket KillBox
Unzip the file to your desktop.
Run Pocket Killbox and paste the full file path of each of the below files in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter each file (see the files below).

C:\WINDOWS\System32\systr.dll

Reboot afterwards if the files are successfully deleted.

If all files are not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot only after the last file you enter.

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. hijackthis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary …

do you have your networking icon showing down by the clock ,if not go to control panel and networking and check the status of you connection ,at the time this happens .
There is a issue with some network setups and sp2 .you might get a message that you connection is limited or what ever and you may have problems axcessing the internet !!

could just be that toshiba doesent want you to load another OS on there system .
i have read were people have problems with installing a new harddrive in a tobisha LTop that isn't a toshiba HD.

and if you have a newer version of nero it has a virtual drive also ,there will be an icon in control panel to axcess it ,not sure if this is the case with the oem version of nero !,
but you don't need to open the iso ,if you have burning software that can burn image files .like nero or alchol120% ,the 2 i use .

Welcome Pureme,!
yes spring has spring has sprung ,3cm of snow here in Easten Canada this morning !!soon the spring rains will come .

I would advise you to use the Control Panel / Add/Remove Programs to remove the LogitechDesktopMessenger program. It is responsible for all of the 018 entries. It has a bad reputation as a resource hog.

Go
Here and Get Trojan-Hunter Fully working trial! and run a full scan
,,,,,,,,,,,,,,,,,,,,,
To remove trojans there is a tool which needs to be downloaded and run.

1. Please download Stinger and save it to your desktop

2. Double-click on the stinger.exe file and open the tool

3. Choose your entire hard drive to scan.

4. Choose Scan Now

5. Stinger will fix anything that it finds

6. Click the File menu and select Save report to file

7. Post the log file results here in this thread.

STINGER

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Reboot to SAFE mode to delete files
How to start computer in safe mode

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan Please do an online scan, 2 would be better,

Micro World http://www.mwti.net/antivirus/free_utilities.asp
Trend Micro http://housecall.trendmicro.com/housecall/start_corp.asp

Make sure that you choose "fix" or "clean".

.
,,,,,,,,,,,,,,,,,,,,,,,,,,
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

OK But how do i zip that file? And Ill Compleete all these tomorw...Thanks for yur help ahead of time tho!

well you have winrar ,you right click on the file and choose compress and email or add to [filename] rar and sent the file it creates to the email address above thanks

I was doing a fresh install of xp pro sp2 on a computer yesterday it has a dvd player ,wmp didin't play dvds until i installed ,cyber links power dvd software that came with the dvd player .

Hi,Welcome to DaniWeb ,Please do this.
Download 'Hijack This!'. hijackthis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
You might want to print out or copy & paste to notePad , these instructions as you will need to close this browser window to fix with hijackthis !

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...//www.yahoo.com

F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\System32\netdc.exe

O4 - HKLM\..\Run: [Setup experation] C:\WINDOWS\svchost.exe

O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\System32\pd14.exe

O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\pd14.exe

O4 - Startup: winupdate32143234[1].exe

Now reboot into safe mode and delete the following files and folders if found .

C:\WINDOWS\System32\netdc.exe,,,,,,,,,,,,,delete file

C:\WINDOWS\svchost.exe,,,,,,,,,,,delete file, note just the one in the windows folder not in the system32 folder

C:\WINDOWS\System32\pd14.exe,,,,,,,,,,,delete file

winupdate32143234[1].exe ,,,Find this and zip it and email it first then delete it please .

to delete the above files and folder you will need to do the following
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log

Could you zip this file, winupdate32143234[1].exe and send it to this email address for them to have a look at it ,add a link to this thread to the email also thanks
submit@fbeej.dk.

first thing you must finish the winrar process, you are running these programs from within the zip program ,
C:\DOCUME~1\phillip\LOCALS~1\Temp\Rar$EX00.109\KillBox.exe

C:\DOCUME~1\phillip\LOCALS~1\Temp\Rar$EX00.937\HijackThis.exe

http://www.daniweb.com/techtalkforums/thread19959.html

,,,,,,,,,,,,,,,,,,,,,,,,,,
As above :D. then remove hotoffers with hijackthis.

Hi a few things to do , did you set this ,if not fix it if yes leave it .
O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
O15 - Trusted Zone: http://*.windowsupdate.com
also I missed this one in the last log
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

Ive tried going there to tools and internet options and pressed apply button and still no luck!!

This problem could occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Or HERE if that link fails to work or you don't have a zip program installed .

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE …

have you tried to boot to safe mode and do a sytem restore ,

Reboot to SAFE mode
How to start computer in safe mode

how to use WinMe
System Restore

Im recieving this homepage at startuphttp://search.yahoo.com/search?p=Internet+Explorer&fr=ieas Ive tried adaware, spybot and still no luck. Im using Internet explorer 6. Windows 98 se.

Have you tried to change it to something else ,in IE go to tools/internet options and make the changes there .

Hi ,that is the only thing that i see in you log that looks out of place ,I was going to ask if you knew what it was ,I can't find anythin in a google search about it ,I would run hijackthis again and fix it .then go to c:\windows\inf and delete it .
Reference here to the insrtaller.exe.
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076958
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Close all browser windows and run hijackthis and fix the following .

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [Installer] C:\Windows\Inf\Installer.exe

then delete installer.exe file C:\Windows\Inf\Installer.exe

reboot and post a new log if you wish

In wmp 10 go to tools/plugins ,/download plugins and it will take you to a microsoft site and it has dvd decoder plugin there might help .

Sorry all figured out now. it is the speakers

Thanks for coming back to tell us ,you fixed it .

Looking in my c:\windows\system32 folder, I see the following 2 dlls:

popup_bl.dll
searchdll.dll

Should these be there? Thanks very much for the help again.

----------------------------

you can delete them , i meant to tell you to delete the search one in my previsous post /

when in CMD type in , ipconfig /all, note the space between ipconfig and /all

Its sun java releated as you know ,what it means I have no idea!! :)
someone else posted the same file a few days ago and was instructed to reinstall java ,and it seemed to help
[thread=20258]Look Here[/thread]
Also Google HITS

I hope you have a Windows '98 boot disk. If not, you can download a boot disk maker here: http://www.bootdisk.com/bootdisk.htm

Use the boot disk to start up with CD-ROM support.

Have the Windows CD in the CD ROM drive. I think the CD-ROM drive is usually either D: or E:, but it depends on your computer. You can check to see if it's the right drive by using the 'dir' command (look for setup.exe). Once you find setup.exe, execute it and it will start up the Windows installation.

If I remember right, you can manage partitions in the beginning part of Windows Setup without using fdisk (I know you can in 2000, it's been a little while since I've redone '98). Just read what it says when it asks where you want Windows to install.

they need to format first as they all ready ran fdisk.

go in the bios and auto detect harddrive ,

then reboot with the win98 bootdisk and type in format c:
after that you will be able to just type in SETUP at the a:\ prompt with the win98 cd in the cdrom.

The only thing I find hard to believe is that you are considering buying a HP computer .

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
You might want to print out or copy & paste to notePad , these instructions as you will need to close this browser window to fix with hijackthis !

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotoffers.info/228/
R3 - URLSearchHook: transURL Class - {C7EDAB2E-D7F9-11D8-BA48-C79B0C409D70} - C:\WINDOWS\System32\SEARCH~1.DLL
O1 - Hosts: 69.50.173.4 lycos.com
O1 - Hosts: 69.50.173.4 www.lycos.com
O1 - Hosts: 69.50.173.4 altavista.com
O1 - Hosts: 69.50.173.4 www.altavista.com
O1 - Hosts: 69.50.173.4 amazon.com
O1 - Hosts: 69.50.173.4 www.amazon.com
O1 - Hosts: 69.50.173.4 aol.com
O1 - Hosts: 69.50.173.4 www.aol.com
O1 - Hosts: 69.50.173.4 earthlink.net
O1 - Hosts: 69.50.173.4 www.earthlink.net
O1 - Hosts: 69.50.173.4 ebay.com
O1 - Hosts: 69.50.173.4 www.ebay.com
O1 - Hosts: 69.50.173.4 go.com
O1 - Hosts: 69.50.173.4 www.go.com
O1 - Hosts: 69.50.173.4 google.com
O1 - Hosts: 69.50.173.4 www.google.com
O1 - Hosts: 69.50.173.4

Go
Here and Get Trojan-Hunter Fully working trial! and run a full scan
,,,,,,,,,,,,,,,,,,,,,
To remove trojans there is a tool which needs to be downloaded and run.

1. Please download Stinger and save it to your desktop

2. Double-click on the stinger.exe file and open the tool

3. Choose your entire hard drive to scan.

4. Choose Scan Now

5. Stinger will fix anything that it finds

6. Click the File menu and select Save report to file

7. Post the log file results here in this thread.

STINGER

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Reboot to SAFE mode to delete files
How to start computer in safe mode

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan Please do an online scan, 2 would be better,

Micro World http://www.mwti.net/antivirus/free_utilities.asp
Trend Micro http://housecall.trendmicro.com/housecall/start_corp.asp

Make sure that you choose "fix" or "clean".

.
,,,,,,,,,,,,,,,,,,,,,,,,,,
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
You might want to print out or copy & paste to notePad , these instructions as you will need to close this browser window to fix with hijackthis !

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cus...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

O4 - HKLM\..\Run: [GTQ8Sgg] C:\windows\temp\GTQ8Sgg.exe

O4 - HKLM\..\Run: [Info32x] c:\windows\system32\info32x.exe

O4 - HKLM\..\Run: [Dvx] C:\WINDOWS\System32\wsxsvc\wsxsvc.exe

O4 - HKLM\..\Run: [vmss] C:\WINDOWS\System32\vmss\vmss.exe

O4 - HKLM\..\Run: [sixtysix] C:\WINDOWS\sixtypopsix.exe

O4 - HKLM\..\Run: [Tpkyftp] C:\Program Files\Ppuj\Guho.exe

O4 - HKLM\..\Run: [Task Help] wualcts.exe

O4 - HKLM\..\Run: [Media Pass] C:\Program Files\Media Pass\MediaPassK.exe

O4 - HKLM\..\Run: [bkyQSC] C:\WINDOWS\bppvtq.exe

O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitedcd32.exe

O4 - HKLM\..\Run: [yoquudk] c:\windows\system32\yoquudk.exe

O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\

O4 - HKLM\..\RunServices: [Task Help] wualcts.exe

O4 - HKLM\..\RunServices: [System32] nah.exe

O4 - HKLM\..\RunOnce: [Task Help] wualcts.exe

O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll (file missing)

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll (file missing)

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program …

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

buy a 40 or 60 gig Harddrive and slave it to the one in computer now and move the folder to it .otherwise you will need to buy a DVD burner and a pile of disk and burn the files 4 gig at a time to dvd disks .and giging that you machine is dying it may be better to buy the HD

.
XP clean install .
http://www.theeldergeek.com/xp_home_install_-_graphic.htm

Hi ,a lot of nasties in you log that the programs suggested in my previsious post should have found and fixed ,did you check off to fix found items in ad-aware and spybot and trojanhunter .please run them again and make sure you check off items to fix.thanks

It is good, but does not detect nearly as much as norton 2k5 or Ad aware pro

I have all 3 of those programs running on my computer and they work well together

sorry, I have no solution for you to try .

thnx for your help

your welcome ,any time .

Caperjack,

I did as you suggested in your second post to this thread. But this morning the error message returned on cold start.

The three items that you told me to had HJT fix have not reappeared, but there are or course some new temp files.

Just so we're on the same page, I did not tell HJT to fix the proxy line in the log. Should I?

Thanks again for your assistance.
Lee Hassig

form what i find on google leave the proxi alone ,post a new hijack log if you wish .

Update:

Seems to have lots of great features. You can change all ur browser settings, monitor processes, ie add-ons. Also has real-time protection.

Please post updates on this tool if you run into anything.

it auto updates daily for me .

You need an updated version of Hijackthis which you can get from HERE

Then post a HJT log as a reply to this topic.

also please unzip hijackthis ,you are running it from within the zip program

Go
Here and Get Trojan-Hunter Fully working trial! and run a full scan
,,,,,,,,,,,,,,,,,,,,,
To remove trojans there is a tool which needs to be downloaded and run.

1. Please download Stinger and save it to your desktop

2. Double-click on the stinger.exe file and open the tool

3. Choose your entire hard drive to scan.

4. Choose Scan Now

5. Stinger will fix anything that it finds

6. Click the File menu and select Save report to file

7. Post the log file results here in this thread.

STINGER

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Reboot to SAFE mode to delete files
How to start computer in safe mode

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan Please do an online scan, 2 would be better,

Micro World http://www.mwti.net/antivirus/free_utilities.asp
Trend Micro http://housecall.trendmicro.com/housecall/start_corp.asp

Make sure that you choose "fix" or "clean".

.
,,,,,,,,,,,,,,,,,,,,,,,,,,
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

it would appear that I have a registry problem...Think I mave have to wipe the hard drive and start again, DOH!!!

errors like that are usually caused by device /drivers conflict .a reload may not help ,making sure you have the latest drives for devices like sound/video/modem/motherboard and such will help i think .

Shutdown errors
A link from that site

How does windows have a firewall without sp2? I couldn't find it!

in control panel .network connection right clik on the network icon and go properties /advanced .settings

Also you should not go online with a fesh install of xp with out first installing security patches for the blaster worm and such ,you should always aquire them before formating and copy them to disk to have to install after the reload . firewall is not going to block them !get this stuff at www.microsoft.com/downloads

you wouldn't happen to have this winupdate85093701[1].exe
still in you recycle bin would you or on you harddrive ,check and see if you do ,zip it up and mail it to ,submit@fbeej.dk

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
You might want to print out or copy & paste to notePad , these instructions as you will need to close this browser window to fix with hijackthis !

O1 - Hosts: 69.50.173.4 lycos.com
O1 - Hosts: 69.50.173.4 www.lycos.com
O1 - Hosts: 69.50.173.4 altavista.com
O1 - Hosts: 69.50.173.4 www.altavista.com
O1 - Hosts: 69.50.173.4 amazon.com
O1 - Hosts: 69.50.173.4 www.amazon.com
O1 - Hosts: 69.50.173.4 aol.com
O1 - Hosts: 69.50.173.4 www.aol.com
O1 - Hosts: 69.50.173.4 earthlink.net
O1 - Hosts: 69.50.173.4 www.earthlink.net
O1 - Hosts: 69.50.173.4 ebay.com
O1 - Hosts: 69.50.173.4 www.ebay.com
O1 - Hosts: 69.50.173.4 go.com
O1 - Hosts: 69.50.173.4 www.go.com
O1 - Hosts: 69.50.173.4 google.com
O1 - Hosts: 69.50.173.4 www.google.com
O1 - Hosts: 69.50.173.4 icq.com
O1 - Hosts: 69.50.173.4 www.icq.com
O1 - Hosts: 69.50.173.4

before any format you should always aquire the neede software and drivers first .hard to do i know if your computer isn't working right! some options if avaible in you area
http://www.microsoft.com/windowsxp/using/helpandsupport/ballew_04sept20.mspx

What would have fixed that? If I had posted a Hijackthis log? My system was clean (as far as I know) of viruses and spyware. Did the registry just get "corrupted" somehow?

I/m not positive but I would have uninstalled software for the modem/nic card and also searched the registry for anything releated to both .
This come from problem i have had with winmodems in the past .

My update: Hi! I had the same problem - after trying all the suggestions from this board and the DELL forums, I had to reformat and reinstall Windows. A pain, but it DID work.

so ,that makes me tihnk its was a software ,registry errors problem,