TheTechGuide Forum
General Category => Tech Clinic => Topic started by: jen3ca on October 13, 2006, 08:10:17 PM
-
Hey could you help me again? dads computer wont go on the internet, it connects and everything but the internet page comes up as "This page cannot be displayed". I did a system restore to two days before, it was still messing up on the day i restored it too but the network worked after i restored it. The direct internet connection has not worked for a couple of months and the network is not working now either. We are running a network from a xp machine to a win 98, using a cross over wire, everything is set up correctly and all the hardware is working fine. when i try to use highjack this an error comes up saying "unexpected error" i press ok and it closes. Even after i reinstall high jack it does this, please help
-
Reboot into safe mode and try running hijackthis
Post the log it submits
Probably won't matter as you don't usually post back anyways
-
I tryed rebooting the computer into safe mode and running highjack this in safemode but it still comes up the error, all the error says is "unexpected error" and a button to press ok. After i press ok it shuts high jack this down .
-
Is that all it says? "unexpected error"
Can you post the whole error message
What version of Hijackthis are you trying to run?
Can you redownload it from my signature below and try again
Could you also
==Download this file - Combofix.exe (http://\"http://download.bleepingcomputer.com/sUBs/combofix.exe\") and save it too desktop
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Post the log from combofix please
-
I have done what you have asked. I downloaded and reinstalled highjack this and it still comes up with the same error. ALL the error says is unexpected error if it said anything else in the error i would have told you. Also when I ran combo fix from the desktop it came up with an error saying, "Error!! cmd.exe is not present" thanks for the help.
-
Can you try running Combofix in safe mode please
See if you can get it to run
Does this computer have any file sharing programs installed?
Eg.. Limewire, kazaa
-
I just finished trying to get combo fix and highjack this to work in safe mode, neither one will work in safe mode, No there is no file sharring programs on this computer
-
Can you do the following again for me
Right click on Hijackthis.exe and rename too something like
scanit.exe
Try running scanit.exe (hijackthis) again
If that won't work, can you try downloading an older version of hijackthis from
This link, unzip it too a different folder you have hijackthis 1.99.1 to
http://www.merijn.org/files/hijackthis1982.zip (http://\"http://www.merijn.org/files/hijackthis1982.zip\")
Try running this version of Hijackthis
Also, can you go here
http://www.billsway.com/vbspage/ (http://\"http://www.billsway.com/vbspage/\")
Download and save
Find File Information
Unzip the contents too desktop
Double click to run
FindFileinfo.vbs
Input
* at the first prompt box
Then enter
cmd
in the second prompt box
Let it finish searching, can you post the contents back here
What scanners do you have on this computer
Eg.. What AntiVirus software
Any antispyware programs?
-
I have renamed the current version of highjack on the computer and tryed to run it but it didnt work. then i tryed downloading an older version of highjack this but i still got the "unexpected error" error and i cant get the find file information (3 mb) software onto the other computer because it is to big for a disk, i cant get to anyweb page on that computer and the network is not working.
-
Find File Info is only 1.3 kb in size
Very, very small
You can make your own script however
Right click on a blank spot of the desktop and select NEW>>Text document
Copy>>>PASTE the whole contents of the code box to it and save the changes
Don't include the word "code"
But everything else in the code box
' FileInfo.vbs Quickly search your drive for specified file name and return
' path, version, size and date information. Can search a specified drive, or
' or all drives. Use only the file name, not the extension. Requires WMI,
' which is included with Windows 2000 and Windows XP. For Windows 95, 98, ME
' and NT4, WMI can be downloaded at
' http://msdn.microsoft.com/downloads/sdks/wmi/download.asp
' © Bill James - [email protected] - Released 14 Nov 2002 - Revised 16 Nov 2002
Option Explicit
Dim fso, OutFile, sDrv, sFName, sReport, sFile, sTitle
sTitle = "FileInfo.vbs © Bill James"
Set fso = CreateObject("Scripting.FileSystemObject")
OutFile = "C:\searched.txt"
If fso.FileExists(OutFile) Then fso.DeleteFile(OutFile)
Set sReport = fso.OpenTextFile(OutFile, 8, True)
sDrv = InputBox("Enter drive letter to search (letter only)" & vbcrlf & _
vbcrlf & "(Enter * to search all local drive letters)", sTitle)
If sDrv = "" Then WScript.Quit
sFName = InputBox ("Enter file name to search for (no extension)", sTitle)
If sFName = "" Then WScript.Quit
If sDrv = "*" Then
Dim Drive
For Each Drive in fso.Drives
If Drive.DriveType = 2 Then
GetResults Drive, sFName
End If
Next
Else
GetResults sDrv & ":", sFName
End If
sReport.Close
Set sReport = Nothing
Dim f, ra, Results
Set f = fso.OpenTextFile(OutFile)
On Error Resume Next
ra = f.ReadAll
If Err Then
Results = 0
End If
On Error GoTo 0
f.Close
Set f = Nothing
Set fso = Nothing
If Results > 0 Then
Wscript.CreateObject("WScript.Shell").Run OutFile
Else
MsgBox "No matches found for " & chr(34) & sFName & chr(34) & " on " & sDrv,, sTitle
End If
Sub GetResults(drv, fname)
Dim sWQL, oFile, sAttrib
sWQL = "select * from cim_datafile where Drive='" & _
drv & "' AND FileName = '" & fname & "'"
For Each oFile In GetObject("winmgmts:").execquery(sWQL)
Results = Results + 1
sFile = oFile.Name
Set f = fso.GetFile(sFile)
sReport.WriteLine sFile & vbcrlf & "Version: " & _
fso.GetFileVersion(sFile) & vbcrlf & "Created: " & _
f.DateCreated & vbcrlf & "Modified: " & f.DateLastModified & _
vbcrlf & "Size: " & FormatNumber(f.Size, 0) & " bytes"
If oFile.Archive Then sAttrib = "Archive "
If oFile.Compressed Then sAttrib = sAttrib & "Compressed "
If oFile.Encrypted Then sAttrib = sAttrib & "Encrypted "
If oFile.Hidden Then sAttrib = sAttrib & "Hidden "
If oFile.System Then sAttrib = sAttrib & "System "
If NOT oFile.Writeable Then sAttrib = sAttrib & "ReadOnly "
If sAttrib <> "" Then sReport.WriteLine "Attributes: " & sAttrib & vbcrlf
sAttrib = ""
Next
End Sub
' Revisions
' 15 Nov 2002 - Added MsgBox if no search matches found.
' 16 Nov 2002 - Added file attributes to the report
X out and save the changes
Right click on the text document on desktop and rename it too
FileInfo.vbs
Then follow my instructions to run it earlier and post the contents
EDIT::
I assume you also have combofix.exe on the desktop when your running it
Don't try running it from a floppy or similiar
If it is on desktop and won't run
Do the following and let me know if you get any results
Ensure Combofix is on the desktop
Go to START>>RUN
Type the following in exactly as I have posted in bold
below and then hit OK
"%userprofile%\desktop\combofix.exe" /admin /f3m
Notice the spaces when required
Another EDIT
Combofix has been updated to fix some bugs
Can you delete your copy from desktop
Also delete this folder if found
c:\sUBs and then redownload it from here please
Combofix.exe (http://\"http://download.bleepingcomputer.com/sUBs/combofix.exe\")
-
i found the very very small download for the findfileinfo.vb script: c:\windows\desktop\fileinfo.vbs
Line: 60
Char:3
Error: Library not registered
Code: 800280D"
i also tried using the one i created and it came back with the same error. After doing that i deleted combofix.exe but i couldnt find the folder you told me to delete. i put the new version of combofix.exe onto the desktop and it still came back with the error "Error!! cmd.exe is not present" so then i ran the run command you told me to and it came back saying. cannot find "%userprofile%\desktop\combofix.exe" /admin /f3m (or one of its components) Make sure the path and file name are correct and that all required libraries are available. I figured this was because of the %userprofile% so i changed that to "C:\windows\desktop..." and left the rest of the run command the same. when i did this i got the error "ERROR!! cmd.exe is not present.
just ask if you need me to explain any of this over again (hopefully i havnt confussed you) thanks again for the help
-
Can you right click on FileInfo.vbs and choose EDIT
I suspect that you included the word CODE from the code box
You must delete that from the .vbs file
as I mentioned earlier
Copy>>>PASTE the whole contents of the code box to it and save the changes
Don't include the word "code"
Don't try running any of these tools from a floppy, etc...
Does this user account your using have Administrative privileges?
Is it the only user on the computer?
If you still can't get FileInfo.vbs to run
On the XP machine
Right click an empty spot on desktop and select NEW>>Text document
Name the file
find.bat
Allow the change of extension at the prompt
Right click on find.bat and choose EDIT
Type the following in bold below Exactly as I have posted
dir %Systemdrive%\cmd.exe /a h /s > files.txt
start notepad files.txt
Close find.bat and allow to save changes
Double click on find.bat, wait for it to finish it's scan and post back here the whole contents of the notepad file that opens
Also, you may need to update some needed windows files
Can you download this file from Microsoft
http://download.microsoft.com/download/vb6.../vbrun60sp5.exe (http://\"http://download.microsoft.com/download/vb60pro/Redist/sp5/WIN98Me/EN-US/vbrun60sp5.exe\")
Save the installer to desktop
Double click to install and follow the prompts
Does that help you out with fileinfo.vbs and Hijackthis?
-
i ran all the files from the desktop not the a:\ like you seem to think i did. I know a little about programming and trust me i didnt put the word CODE into the file, yes it does have administrative purposes. I ran the program you gave me and it said "to many parameter - h" So when it popped the .txt file up it showed nothing. The updates you gave me fixed highjack this but not combo fix.exe heres the high jack this log
Logfile of HijackThis v1.99.1
Scan saved at 5:28:28 PM, on 10/15/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HIGHJACK THIS\SCANIT.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ca/ (http://\"http://www.yahoo.ca/\")
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
-
I thought we were working on an XP machine, that is the biggest problem
Combofix isn't compatible with Win98
Are you sure that's the whole log from Hijackthis?
You seem to of cut off the whole bottom part of it
-
ok sorry i should have mentioned it was 98 but i thought i mentioned it in my first post anyway i am pretty sure that it is the whole log i will run anouther just to be sure
highjack this log
Logfile of HijackThis v1.99.1
Scan saved at 5:58:54 PM, on 10/15/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\CCLEANER\CCLEANER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HIGHJACK THIS\SCANIT.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ca/ (http://\"http://www.yahoo.ca/\")
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
that is the whole highjack this log
-
Can I see 2 other logs from Hijackthis
supply an uninstall list from Hijackthis
Open Hijackthis>>Open MISC TOOLS SECTION>>Open UNINSTALL MANAGER
Click the SAVE LIST... button
Save the list to your desktop then copy>>Paste back here the Whole contents
================================================
Supply a startuplist from Hijackthis
Open Hijackthis>>Open Misc tools section
Beside 'Generate a Staruplist'
Check the following
List all minor sections(full)
and
List empty sections(complete)
Afterwards click the button Generate a Staruplist
Click Yes to the prompt
A text file will open
Copy>>Paste back here the whole contents please
-
heres the two lists you wanted
Uninstall list
Ad-Aware SE Personal
Adobe Acrobat 5.0
avast! Antivirus
Camera Driver
Canon CanoCraft CS-P 3.8
Canon ScanGear Toolbox CS 2.2
CCleaner (remove only)
Conexant HCF V.90/56K Modem
Corel WordPerfect Suite 8
HijackThis 1.99.1
Intel® PRO Network Connections Drivers
Internet Explorer Q916281
J2SE Runtime Environment 5.0 Update 6
LiveUpdate
Messenger Plus! 3
Microsoft .NET Framework 1.1
Microsoft Data Access Components KB870669
Microsoft Internet Explorer 6 SP1 and Internet Tools
Microsoft VGX Q833989
Microsoft Windows Critical Update Notification
Mozilla Firefox (1.5.0.7)
MRU-Blaster v1.5 (Database 3/28/2004)
MSN Messenger 7.0
Network Play System (Patching)
Outlook Express Q837009
Spybot - Search & Destroy 1.4
Windows 98 KB891711 Update
Windows 98 KB896358 Update
Windows 98 KB908519 Update
Windows 98 KB918547 Update
Windows 98 Q823559 Update
Windows 98 Q840315 Update
Windows 98 Q888113 Update
Windows 98 Q890175 Update
Windows Media Player system update (9 Series)
WinZip
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Toolbar
startup list
StartupList report, 10/15/06, 8:37:52 PM
StartupList version: 1.52.2
Started from : C:\HIGHJACK THIS\SCANIT.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HIGHJACK THIS\SCANIT.EXE
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
IrMon = IrMon.exe
avast! Web Scanner = C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
ICSDCLT = C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
winmodem = WINMODEM.101\wmexe.exe
KB891711 = C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
KB918547 = C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
avast! = C:\Program Files\Alwil Software\Avast4\ashServ.exe
MessengerPlus3 = "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ccleaner = "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = C:\WINDOWS\NOTEPAD.EXE %1
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------
C:\WINDOWS\WININIT.INI listing:
(Created 15/10/2006, 20:36:18)
[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - (no file) - {02478D38-C3F9-4EFB-9B51-7695ECA05670}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Tune-up Application Start.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
--------------------------------------------------
End of report, 4,417 bytes
Report generated in 0.760 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
-
I remember awhile back you had this same problem, probably with the same computer
Are you willing to try again
Try a direct connection to the modem
Here's what you did before
You removed ICS from add/remove programs components
im back online on the other computer that i have been working on
i got back online by uninstalling the ics then uninstalled and then reinstalled the modem
after that i ran the winsock2fix and now my computer is back online
Try the link to Winsockfix (http://\"http://www.tacktech.com/display.cfm?ttid=257\")
-
thank you for the help, it is now working again but it is extremely slow anyway of fixing this?
-
Can I ask the following
Did you have Norton's AV installed
Do you still need LiveUpdate installed in Add/remove programs
If not remove it please
Also, when you installed
CCleaner, did it install the Yahoo Toolbar,
did you knowing install the Yahoo toobar?
If not uninstall it>>I've found some have had problems with it, so I'm just checking
If you remove any of the above, reboot your computer please
What is slow? the computer or the internet?
By the way, that startup list you posted by Hijackthis was one ran with only using the default options
Can you try this again
Open Hijackthis>>Open Misc tools section
Beside 'Generate a Staruplist'
Check the following
List all minor sections(full)
and
List empty sections(complete)
AFTERWARDS click the button Generate a Staruplist
Click Yes to the prompt
A text file will open
Copy>>Paste back here the whole contents please
Are you controlling any entries on startup with msconfig?
If you are can you enable Everything on startup, reboot and post a fresh hijackthis log
Is Avast running properly?
I noticed that I don't see the running processes I should see
-
i had the network working last night but now its not working i did everything you told me to above and it quit working i did nothing that should have made it quit running. in msconfig it was set at selective startup no idea why so i switched it back to normal setup, i uninstalled live update since we dont use it anymore and tryed uninstall yahoo toolbar it told me that it couldn't uninstall it because it needed a log.txt file that was missing or some stupid thing, it still disappeared off the add/remove programs list anyway i did what you told me to to get the startup list and here is a new one.
StartupList report, 10/15/06, 8:37:52 PM
StartupList version: 1.52.2
Started from : C:\HIGHJACK THIS\SCANIT.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\HIGHJACK THIS\SCANIT.EXE
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
IrMon = IrMon.exe
avast! Web Scanner = C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
QuickTime Task = "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
ICSDCLT = C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe
winmodem = WINMODEM.101\wmexe.exe
KB891711 = C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
KB918547 = C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
avast! = C:\Program Files\Alwil Software\Avast4\ashServ.exe
MessengerPlus3 = "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
SSDPSRV = C:\WINDOWS\SYSTEM\ssdpsrv.exe
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ccleaner = "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
--------------------------------------------------
File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command
(Default) = C:\WINDOWS\NOTEPAD.EXE %1
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv
--------------------------------------------------
C:\WINDOWS\WININIT.INI listing:
(Created 15/10/2006, 20:36:18)
[Rename]
NUL=C:\WINDOWS\TEMPOR~1\CONTENT.IE5\INDEX.DAT
NUL=C:\WINDOWS\COOKIES\INDEX.DAT
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - (no file) - {02478D38-C3F9-4EFB-9B51-7695ECA05670}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
--------------------------------------------------
Enumerating Task Scheduler jobs:
Tune-up Application Start.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL
--------------------------------------------------
End of report, 4,417 bytes
Report generated in 0.760 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
Avast isn't working because its not registered i told them to register it but they just let it run out and now i cant register the stupid thing because there internet isnt working
-
the network is once again working but direct internet connection isnt, i got avast working as well i was able to get it activated
-
The startup list still shows as using the default options
Not to worry about that right now
If you sure that everything is enabled under Startup in msconfig and have rebooted the computer
Can I see a fresh hijackhthis log please
It could of been Avast causing problems with the Internet, I'm not sure
But it does have Network and Web Shield that may cause problems if not registered
-
heres the new highjack this log
Logfile of HijackThis v1.99.1
Scan saved at 9:32:51 PM, on 10/17/06
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHWEBSV.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\MRU-BLASTER\SCHEDULER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\SETUP\AVAST.SETUP
C:\HIGHJACK THIS\SCANIT.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ca/ (http://\"http://www.yahoo.ca/\")
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [IrMon] IrMon.exe
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\AVAST4\ASHWEBSV.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ICSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKCU\..\Run: [ccleaner] "C:\PROGRAM FILES\CCLEANER\CCLEANER.exe" /AUTO
O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
everything is enabled under msconfig and the computer has been restarted
-
Everything looks good
Besides this leftover entry
With all windows closed including this one
Run a Scan only with Hijackthis and tick this entry
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
Click FIX CHECKED afterwards, Ok the prompts
-
but the direct internet connection still isnt working
-
I haven't had dialup in years
You had it running properly after removing ics and rebooting the computer?
It appears you did at one time
I assume that once you remove ICS, you rebooted
Then run Winsock and reboot again
Is that what you did?
You can manually try and remove dialup networking
NOTE: These troubleshooting tips may prompt you for your Windows 95/98 CD.
Please have this CD ready before trying these tips.
Reinstalling Network Protocols/Adapters
It is possible for your computer's Dial-up Networking settings to become corrupted. The following step will guide you through re-installation. If you use VPN (Virtual Private Networking), the following steps will also remove the VPN functionality.
1. Go Start, Settings, Control Panel
2. Double-click Add/Remove Programs.
3. Click the Windows Setup tab.
4. Find the Communications group, and click Details
5. Uncheck the checkbox to the left of "Dial-Up Networking".
6. Click OK. (Click OK to any dialog boxes that may pop up)
7. Click Apply.
8. Re-check the checkbox to the left of "Dial-Up Networking" (If you need to reinstall VPN, please check the appropriate item in the list now)
9. Restart when prompted.