Author Topic: Virus ? (Read 65563 times)

Dummy · « **on:** December 28, 2005, 11:36:31 AM »

This problem has persisted for awhile. I have a HP Pavillion with Norton antivirus. The problen is that some how some has put me on a network of computers and they stop the downloads of some programs. I did what I thought was a full hard drive format however the problem persists. HP sent a new hard drive and still the same problem. I have enough computer skills to make me dangerous, but have been playing with the dos progam. Most of the programs are loaded in HIMEM with I did not do. ALso when I do a system restore it shows I have alot of new progams added rather than everything new. Any help is appreciated.

Tadracket · « **Reply #1 on:** December 28, 2005, 11:57:23 AM »

What are you trying to accomplish? Do you want off the network? Do you want to dl programs you can't? On a personal note: if you have just enough skills to make you dangerous, you might want to play somewhere other than DOS. Just a suggestion. Give me some more info.

Dummy · « **Reply #2 on:** December 28, 2005, 12:05:32 PM »

yes i want off the network. I did complete destructive recovery this morning to no avail. I'm sure that it is in the restore partition of the disk and possibly memory resident.

Tadracket · « **Reply #3 on:** December 28, 2005, 12:09:15 PM »

Are you at work or on a home computer?

Dummy · « **Reply #4 on:** December 28, 2005, 12:10:09 PM »

This is a home computer,

Tadracket · « **Reply #5 on:** December 28, 2005, 12:17:31 PM »

That is a strange one. We have firewalls here at work that lock people off certain websites and programs that lock certain executables but for someone to install this on your home computer to keep you from running some programs makes no sense to me. What programs are being blocked? Maybe it is an ISp thing. Are you a known file sharer? Who is you isp?

Dummy · « **Reply #6 on:** December 28, 2005, 12:20:02 PM »

I understand the statement of playing in dos as it can sure mess things up, but this is where I found some stange things. I would love to just wipe out everything and start over. I have lost all important information already, and replace the hard drive. I've pulled the pugged and almost cussed once

I've pulled the battery to reset bios, I,ve did serveral dos progams to clean the hard drive 1 that I found on computerhope and it's still there.

Dummy · « **Reply #7 on:** December 28, 2005, 12:24:58 PM »

No I do not share normally and have never done so in the past. I use this computer for a home business. Charter is my isp. The strange thing is that if I go to cmd and type ipconfig/all everything looks normal until I go online then I have a DHCP (I don't normally have 1)

Dummy · « **Reply #8 on:** December 28, 2005, 12:29:44 PM »

Also when I do a system restore from disks it hangs up on driv\apps.log not recoverable along with serveral others. I retry and usually get through to get back on line.

Tadracket · « **Reply #9 on:** December 28, 2005, 12:51:31 PM »

What programs are you trying to install that it won't let you?

Dummy · « **Reply #10 on:** December 28, 2005, 12:59:31 PM »

Any program from the internet usually will be missing part of the progam I can load from home with no problem, the Norton anti-virus progam, of course is redirected to the host computer so I cannot be sure if I download updates. It finds nothing anyway.

Tadracket · « **Reply #11 on:** December 28, 2005, 01:12:20 PM »

Maybe there is enough info here for someone to offer ideas 'cause I am at a loss. Never seen anything like this before. Hope you get it remedied.

Dummy · « **Reply #12 on:** December 28, 2005, 01:15:44 PM »

Thanks, I do too. I appreaciate all the help, and again amazied at all people are able to accomplish with a computer.

Fed · « **Reply #13 on:** December 28, 2005, 03:13:14 PM »

What is your Operating System?
Do you have a full version Operating System Disk?
Are you using your 1st Hard drive or the one that HP sent you?

Dummy · « **Reply #14 on:** December 28, 2005, 04:28:21 PM »

I'm running XP Home with the new hard drive and with in 1 min of accessing the internet I developed the same condition.

Dummy · « **Reply #15 on:** December 28, 2005, 05:00:34 PM »

Sorry I forgot to add all I have is the system restore disks HP sent. These are factory disks not my downloads.

Fed · « **Reply #16 on:** December 28, 2005, 05:38:40 PM »

I don't think you can do a clean install with restore disks, I may be wrong, I've never owned any.
Someone? Anyone?

GX1_Man · « **Reply #17 on:** December 28, 2005, 06:02:55 PM »

Depends on the manufacturer and what they were made to do. Not even consistent between manufacturer's (i.e. some Compaqs yes, others no).

J0K3R · « **Reply #18 on:** December 28, 2005, 08:43:38 PM »

Get rid of Nortons,, i'm serious man

Dell4700 · « **Reply #19 on:** December 28, 2005, 10:33:27 PM »

Is the PC still under warranty? Fixing the PC yourself may void some or all of your warranty (not recommended)?

Otherwise, please provide the following information:

- your PC Model Number (HP Pavillion is not enough info)
- your PC hardware/firmware configuration (BIOS, drives, video card, other peripherals, etc.) (new hard drive or old hard drive is not enough info)
- normal current software configuration (common programs, antivirus/anti-malware, firewall, browser, etc.) (Norton is not enough info)
- what was the normal operating configuration when you first purchased the PC? What operating system came with it?
- more background info on what happened or what you think happened. Include any changes you may have made at the time things began going south (new hardware/software, etc.)
- you describe problems while online? Do you have problems when not online?
- what specific programs are you unable to download? What specific web sites give you this problem?

Try to give as much info as you can to avoid guesswork on our part. If you don't understand any of the above or you don't know how to get the info, please let us know and we'll help.

Dell

Dummy · « **Reply #20 on:** December 29, 2005, 12:45:47 PM »

OS Name Microsoft Windows XP Home Edition
Version 5.1.2600 Service Pack 1 Build 2600
OS Manufacturer Microsoft Corporation
System Name YOUR-XHTR8HVC4P
System Manufacturer HP Pavilion 061
System Model DM181A-ABA a305w
System Type X86-based PC
Processor x86 Family 15 Model 2 Stepping 9 GenuineIntel ~2691 Mhz
BIOS Version/Date 3.24, 10/14/2003
SMBIOS Version 2.31
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\System32
Boot Device \Device\HarddiskVolume1
Hardware Abstraction Layer Version = "5.1.2600.1106 (xpsp1.020828-1920)"
User Name YOUR-XHTR8HVC4P\Owner
Time Zone Central Standard Time
Total Physical Memory 256.00 MB
Available Physical Memory 120.98 MB
Total Virtual Memory 853.33 MB
Available Virtual Memory 628.63 MB
Page File Space 606.35 MB
Page File C:\pagefile.sys
Memory Address 0xA0000-0xBFFFF PCI bus
Memory Address 0xA0000-0xBFFFF Intel(R) 82845G/GL/GE/PE/GV Graphics Controller
Channel 4 Direct memory access controller
Channel 3 ECP Printer Port (LPT1) OK
Channel 2 Standard floppy disk controller

82845G/GL/GE/PE/GV Graphics Controller OK
&REV_10\4&2C53C0AE&0&10F0
Last Reset 1/1/2002 4:24 AM
Index 1
Service Name RTL8139
IP Address 24.176.117.20
IP Subnet 255.255.248.0
Default IP Gateway 24.176.112.1
DHCP Enabled Yes
DHCP Server 68.114.38.178
DHCP Lease Expires 1/3/2002 4:32 AM
DHCP Lease Obtained 1/1/2002 4:32 AM
MAC Address 00:40:2B:69:84:47
I/O Port 0x00002000-0x000020FF
Memory Address 0xE8100000-0xE81000FF
IRQ Channel IRQ 17
Driver c:\windows\system32\drivers\r8139n51.sys (5.505.1004.2002 built by: WinDDK, 45.88 KB (46,976 bytes), 8/23/2003 8:41 AM)

Name [00000002] RAS Async Adapter
Adapter Type Not Available
Installed Yes
PNP Device ID Not Available
Index 2
Name [00000003] Packet Scheduler Miniport
Adapter Type Ethernet 802.3
Product Type Packet Scheduler Miniport
Installed Yes
PNP Device ID ROOT\MS_PSCHEDMP\0000
Last Reset 1/1/2002 4:24 AM
MAC Address 00:40:2B:69:84:47
Driver c:\windows\system32\drivers\psched.sys (5.1.2600.1106 (xpsp1.020828-1920), 64.50 KB (66,048 bytes), 1/1/2002 1:25 AM)

Name [00000004] WAN Miniport (L2TP)
Adapter Type Not Available
Product Type WAN Miniport (L2TP)
Installed Yes
PNP Device ID ROOT\MS_L2TPMINIPORT\0000
Name [00000005] WAN Miniport (PPTP)
Adapter Type Wide Area Network (WAN)
Product Type WAN Miniport (PPTP)
Installed Yes
PNP Device ID ROOT\MS_PPTPMINIPORT\0000
MAC Address 50:50:54:50:30:30
Driver c:\windows\system32\drivers\raspptp.sys (5.1.2600.1106 (xpsp1.020828-1920), 45.25 KB (46,336 bytes), 1/1/2002 1:25 AM)

Name [00000006] WAN Miniport (PPPOE)
Adapter Type Wide Area Network (WAN)
Product Type WAN Miniport (PPPOE)
Installed Yes
PNP Device ID ROOT\MS_PPPOEMINIPORT\0000
MAC Address 33:50:6F:45:30:30
Driver c:\windows\system32\drivers\raspppoe.sys (5.1.2600.0 (xpclient.010817-1148), 38.00 KB (38,912 bytes), 1/1/2002 1:25 AM)

Name [00000007] Direct Parallel
Adapter Type Not Available
Product Type Direct Parallel
Installed Yes
PNP Device ID ROOT\MS_PTIMINIPORT\0000
MAC Address Not Available
Driver c:\windows\system32\drivers\raspti.sys (5.1.2600.0 (xpclient.010817-1148), 16.13 KB (16,512 bytes), 1/1/2002 1:25 AM)

Name [00000008] WAN Miniport (IP)
Adapter Type Not Available
Product Type WAN Miniport (IP)
Installed Yes
PNP Device ID ROOT\MS_NDISWANIP\0000
Last Reset 1/1/2002 4:24 AM
Index 8
Service Name NdisWan
Driver c:\windows\system32\drivers\ndiswan.sys (5.1.2600.1106 (xpsp1.020828-1920), 85.50 KB (87,552 bytes), 1/1/2002 1:25 AM)

Name [00000009] Packet Scheduler Miniport
Adapter Type Ethernet 802.3
Product Type Packet Scheduler Miniport
Installed Yes
PNP Device ID ROOT\MS_PSCHEDMP\0001
MAC Address DA:DA:20:52:41:53
Driver c:\windows\system32\drivers\psched.sys (5.1.2600.1106 (xpsp1.020828-1920), 64.50 KB (66,048 bytes), 1/1/2002 1:25 AM)
Driver c:\windows\system32\drivers\serial.sys (5.1.2600.1106 (xpsp1.020828-1920), 61.00 KB (62,464 bytes), 1/1/2002 1:25 AM)
[Parallel]
Name LPT1
PNP Device ID ACPI\PNP0401\1
I/O Port 0x00000378-0x0000037F
I/O Port 0x00000778-0x0000077F
DMA Channel Channel 3
Driver c:\windows\system32\drivers\parport.sys (5.1.2600.1106 (xpsp1.020828-1920), 74.25 KB (76,032 bytes), 8/29/2002 3:27 AM)
[Drives]
Item Value
Drive A:
Description 3 1/2 Inch Floppy Drive
Drive C:
Description Local Fixed Disk
Compressed No
File System NTFS
Size 31.70 GB (34,039,107,584 bytes)
Free Space 27.70 GB (29,747,302,400 bytes)
Volume Name HP_PAVILION
Volume Serial Number B43FDB55
Drive E:
Description CD-ROM Disc
[Disks]
Item Value
Description Disk drive
Manufacturer (Standard disk drives)
Model ST340015A
Bytes/Sector 512
Media Loaded Yes
Media Type Fixed hard disk
Partitions 1
SCSI Bus 0
SCSI Logical Unit 0
SCSI Port 0
SCSI Target ID 0
Sectors/Track 63
Size 37.27 GB (40,015,503,360 bytes)
Total Cylinders 5,169
Total Sectors 78,155,280
Total Tracks 1,240,560
Tracks/Cylinder 240
Partition Disk #0, Partition #0
Partition Size 31.70 GB (34,039,111,680 bytes)
Partition Starting Offset 5,968,650,240 bytes
Item Value
Name Intel(r) 82801DB Ultra ATA Storage Controller-24CB
Manufacturer Intel

Dummy · « **Reply #21 on:** December 29, 2005, 01:06:36 PM »

Hope this helps
The problem started months ago but I wasn't aware of it until recently. I'm almost positive I opened an e-mail attachment that started the problem. I am working on a Biogas project which some people wanted to invest in, and of course this. I do however have a nicely forged cashiers check for $9,800. No, I didnt lose any money

Since I started nocticing some e-mail I sent several times did not go through I started browsing in my computer and 1) I don't know much 2) I knew it was'nt right. I called HP am they sent a new hard drive, I installed it but nothing really changed. Countless phone calls later they told me if I could access the internet "Good Luck". I started looking in dos and noticed several drivers and programs there. When I did a system recovery normally everything is new, however now when I do a recovery when I go to start it shows alot of new programs installed (highlited).

dl65 · « **Reply #22 on:** December 29, 2005, 01:15:27 PM »

Dummy ....How about running a scan with hijackthis and posting it here ....it may reveal something ......
http://www.majorgeeks.com/download3155.html
After you run the scan .....save it to your desktop ......and then copy it and then paste it into the Compter Hope thread that you have going ........if its too large to get it in one post ........post it in 2 or more . Be sure to post the entire log including the info on your system and the running processes .

dl65

Dummy · « **Reply #23 on:** December 29, 2005, 01:41:53 PM »

Logfile of HijackThis v1.99.1
Scan saved at 6:52:56 AM, on 1/1/2002
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

PLEASE NOTE THE TIME AND DATE ARE INCORRECT
I DID NOT RESET TIME OR DATE WHEN I PULLED THE BATTERY ON BIOS

Dummy · « **Reply #24 on:** December 29, 2005, 01:59:34 PM »

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>dir /a
Volume in drive C is HP_PAVILION
Volume Serial Number is B43F-DB55

Directory of C:\

08/23/2003 06:53 AM 0 AUTOEXEC.BAT
01/01/2002 03:09 AM 196 BOOT.BAK
01/01/2002 04:28 AM 266 boot.ini
01/01/2002 03:18 AM <DIR> cmdcons
08/29/2002 06:00 AM 245,920 cmldr
01/01/2002 04:13 AM <DIR> Config.Msi
08/23/2003 06:53 AM 0 CONFIG.SYS
08/23/2003 06:56 AM <DIR> Documents and Settings
01/01/2002 04:24 AM 259,047,424 hiberfil.sys
01/01/2002 03:58 AM <DIR> hp
01/01/2002 03:26 AM <DIR> I386
08/23/2003 06:53 AM 0 IO.SYS
08/23/2003 06:53 AM 0 MSDOS.SYS
08/29/2002 06:00 AM 47,580 NTDETECT.COM
08/29/2002 06:00 AM 233,632 ntldr
01/01/2002 04:24 AM 390,070,272 pagefile.sys
01/01/2002 06:46 AM <DIR> Program Files
01/01/2002 03:19 AM <DIR> RECYCLER
01/01/2002 03:14 AM <DIR> System Volume Information
08/23/2003 07:11 AM <DIR> system.sav
01/01/2002 04:13 AM <DIR> WINDOWS
11 File(s) 649,645,290 bytes
10 Dir(s) 29,745,631,232 bytes free

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>MEM /D

Address Name Size Type
------- -------- ------ ------
000000 000400 Interrupt Vector
000400 000100 ROM Communication Area
000500 000200 DOS Communication Area

000700 IO 000370 System Data
CON System Device Driver
AUX System Device Driver
PRN System Device Driver
CLOCK$ System Device Driver
COM1 System Device Driver
LPT1 System Device Driver
LPT2 System Device Driver
LPT3 System Device Driver
COM2 System Device Driver
COM3 System Device Driver
COM4 System Device Driver

000A70 MSDOS 001630 System Data

0020A0 IO 001FF0 System Data
KBD 000CE0 System Program
HIMEM 0004E0 DEVICE=
XMSXXXX0 Installed Device Driver
000490 FILES=
000090 FCBS=
0000E0 LASTDRIVE=
0007D0 STACKS=
0040A0 COMMAND 000A20 Program
004AD0 MSDOS 000070 -- Free --
004B50 COMMAND 000440 Environment
004FA0 MEM 000380 Environment
005330 MEM 0174E0 Program
01C820 MSDOS 0837C0 -- Free --
09FFF0 SYSTEM 02C000 System Program

0CC000 MSDOS 000360 -- Free --
0CC370 MSCDEXNT 0001D0 Program
0CC550 REDIR 000A70 Program
0CCFD0 DOSX 0087A0 Program
0D5780 DOSX 000080 Data
0D5810 MSDOS 00E7D0 -- Free --
0E3FF0 SYSTEM 001000 System Program

0E5000 IO 003100 System Data
MOUSE 0030F0 System Program
0E8110 MSDOS 007EE0 -- Free --
This is my MS DOS INFORMATION

dl65 · « **Reply #25 on:** December 29, 2005, 02:08:12 PM »

Dummy.... ok ......here's what I'm seeing .......
For some reason you do not have the latest M/S updates installed .....and in particular SP2 ......... Is there some reason you havent upgraded to SP2 ?
Before you start ....turn off the system restore feature of XP.
Now open up hijackthis and run the scan ......when its done ...go down to the lower right corner and click on CONFIG ..... then when the new window opens ....Down in the 4 boxes that have the Default page URLS ........change them all to http://www.msn.com ( in all 4 places ) ...now click BACK ( lower right corner)

Now then in your hijack log mark for removal the following :

All R1 and R0 entries

O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Then click FIX CHECKED ......

When its finished ....reboot and see how things are .......
then rerun hijackthis again and let's have a look at it .

dl65

Dummy · « **Reply #26 on:** December 29, 2005, 02:32:16 PM »

C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

To answer the question service pack 2 only reason is until I get off the "network" it really does no good. 1) All of the things get changed back to whatever "they" want
I have a service pack 2 disk from Microsoft and downloaded all the updates yesterday, last night I had to do another system restore in order to get back on the internet. Now I click explorer until I see the "green bar" then turn my modem on till I get a response then turn it off while I post to keep some acess to the net. I had downloaded the Hijack this and saved it to disk otherwise I probally would not beem able to get it.

dl65 · « **Reply #27 on:** December 29, 2005, 02:54:15 PM »

Dummy.... Are you still connecting to the net on that odd net work ?

Do you have msn messenger installed by any chance ?
I ask because if you ask for remote assistance , I may be able to clear up your issue .

dl65

Dummy · « **Reply #28 on:** December 29, 2005, 03:01:24 PM »

As far as I know yes

dl65 · « **Reply #29 on:** December 29, 2005, 03:06:03 PM »

Dummy.....

Quote

As far as I know yes

is that the response to the network or msn messenger ?

dl65

Dummy · « **Reply #30 on:** December 29, 2005, 03:14:14 PM »

messenger

Dummy · « **Reply #31 on:** December 29, 2005, 03:16:42 PM »

I tried to open messenger it does not work

dl65 · « **Reply #32 on:** December 29, 2005, 03:17:09 PM »

Dummy....ok ...what about the network your connecting on .......is it still the odd one ?

dl65

Dummy · « **Reply #33 on:** December 29, 2005, 03:17:32 PM »

will remote desktop work it at least opened

dl65 · « **Reply #34 on:** December 29, 2005, 03:20:45 PM »

Dummy... I'll private message ..... you my username for hotmail and you can add me to your list then ask me to connect to you

dl65

Dummy · « **Reply #35 on:** December 29, 2005, 03:43:06 PM »

Sorry I cannot get it to work

dl65 · « **Reply #36 on:** December 29, 2005, 03:46:25 PM »

Dummy..... Did you turn off your system restore before you ran the hijackthis scan as I mentioned ?

dl65

dl65 · « **Reply #37 on:** December 29, 2005, 03:47:50 PM »

Dummy ...can you go into control panel and click on Internet connections and tell me what is being displayed ?
When you go into control panel ...make sure its set to display the "CLASSIC " view

dl65

Dummy · « **Reply #38 on:** December 29, 2005, 03:57:54 PM »

Yes system restore is off

Contol panel shows local area connection enabled
with a right click shows all 4 with a check mark Microsoft Clients etc.
However if I clear them I cannot acess the internet

dl65 · « **Reply #39 on:** December 29, 2005, 04:00:35 PM »

Dummy....

Quote

ALso when I do a system restore it shows I have alot of new progams added rather than everything new. Any help is appreciated.

Did you install all the programs ...that show up in system restore ?

When you did the format , was it a clean install ...or did you attempt a repair ?

If it was a clean install and you did a clean install of win xp .......then installed your AV ....and then connected to your home dsl modem .......... went online and got the XP updates there is no way could you could possibly be connected to some " Odd network"
dl65

Dummy · « **Reply #40 on:** December 29, 2005, 04:09:26 PM »

This is how restore was done
1) System Restore 1 disk was inserted into cd rive
2) When it asked for which method I did what HP calls a manufactuers cleaning by pressing CRTL and Backspace
this brings up a selection of clearing all of the hard drive I clear all partitions and erase the disk
then the only option is "r" for recovery. I assure you that I have tried all the various methods.

Dummy · « **Reply #41 on:** December 29, 2005, 04:10:28 PM »

I only have system restore disks (2 sets) from HP

dl65 · « **Reply #42 on:** December 29, 2005, 04:11:20 PM »

Dummy ...... does it look like this ?
http://server2.uploadit.org/files/jochrobo-network.JPG

dl65

Dummy · « **Reply #43 on:** December 29, 2005, 04:13:43 PM »

Curious question if programs are loaded into dos along with drivers could not that be the problem?

Dummy · « **Reply #44 on:** December 29, 2005, 04:15:03 PM »

yes that's it

dl65 · « **Reply #45 on:** December 29, 2005, 04:15:10 PM »

Dummy ....... It's possible , but why would you be loading programs in dos ?

dl65

Dummy · « **Reply #46 on:** December 29, 2005, 04:18:28 PM »

that's just it I didn't if you look at one of the earlier posts you will see them

dl65 · « **Reply #47 on:** December 29, 2005, 04:22:16 PM »

Dummy ...ok then go into the contol panel / add or remove programs and remove all the programs you didnt install .......dont remove any microsoft programs .

dl65

dl65 · « **Reply #48 on:** December 29, 2005, 04:26:54 PM »

Dummy .....I'm thinking I'm losing my eyesight ...I dont see a list of programs that appeared ...as opposed to you installing them ........would you please list them here as I really dont see them.

dl65

Dummy · « **Reply #49 on:** December 29, 2005, 04:27:26 PM »

Sorry I have uninstalled most all the programs however they were the progams loaded from factory Adobe is still there and only 2 that I loaded Hijack this and crap cleaner

Dummy · « **Reply #50 on:** December 29, 2005, 04:34:55 PM »

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>mem /D

Address Name Size Type
------- -------- ------ ------
000000 000400 Interrupt Vector
000400 000100 ROM Communication Area
000500 000200 DOS Communication Area

000700 IO 000370 System Data
CON System Device Driver
AUX System Device Driver
PRN System Device Driver
CLOCK$ System Device Driver
COM1 System Device Driver
LPT1 System Device Driver
LPT2 System Device Driver
LPT3 System Device Driver
COM2 System Device Driver
COM3 System Device Driver
COM4 System Device Driver

000A70 MSDOS 001630 System Data

0020A0 IO 001FF0 System Data
KBD 000CE0 System Program
HIMEM 0004E0 DEVICE=
XMSXXXX0 Installed Device Driver
000490 FILES=
000090 FCBS=
0000E0 LASTDRIVE=
0007D0 STACKS=
0040A0 COMMAND 000A20 Program
004AD0 MSDOS 000070 -- Free --
004B50 COMMAND 000440 Environment
004FA0 MEM 000380 Environment
005330 MEM 0174E0 Program
01C820 MSDOS 0837C0 -- Free --
09FFF0 SYSTEM 02C000 System Program

0CC000 MSDOS 000360 -- Free --
0CC370 MSCDEXNT 0001D0 Program
0CC550 REDIR 000A70 Program
0CCFD0 DOSX 0087A0 Program
0D5780 DOSX 000080 Data
0D5810 MSDOS 00E7D0 -- Free --
0E3FF0 SYSTEM 001000 System Program

0E5000 IO 003100 System Data
MOUSE 0030F0 System Program
0E8110 MSDOS 007EE0 -- Free --

655360 bytes total conventional memory
655360 bytes available to MS-DOS
634032 largest executable program size

1048576 bytes total contiguous extended memory
0 bytes available contiguous extended memory
941056 bytes available XMS memory
MS-DOS resident in High Memory Area

I sure don't understand it either but honestly if I do a complete Destructive recovery most of the progams will show as being "new" I strongly suspect that it's in the very first part of the hard drive and is not being deleted

dl65 · « **Reply #51 on:** December 29, 2005, 04:35:02 PM »

Dummy ..... Is your pc in your home and is it the only one there ? What type of disks did you use when you formatted ? Win XP or some propietory thing from HP .....

dl65

Dummy · « **Reply #52 on:** December 29, 2005, 04:36:41 PM »

Yes my pc is at home and yes they are factory disks from HP sent with the new hard drive

dl65 · « **Reply #53 on:** December 29, 2005, 04:37:42 PM »

Dummy....Do you have a partition on the HD .......?
When you formatted ....didnt you remove the partitions and then do the reinstall ?

dl65

Dummy · « **Reply #54 on:** December 29, 2005, 04:40:51 PM »

yes i have at one time used fdisk, several times doing a manufacturer but it always saids the partition is non-existant or corruted I do delete them or at least press the button it says

dl65 · « **Reply #55 on:** December 29, 2005, 04:43:50 PM »

Dummy ....could you post your directory of Windows ?

dl65

dl65 · « **Reply #56 on:** December 29, 2005, 04:45:29 PM »

Dummy ...when you run Fdisk ....and display partitions ...does it show one or 2 ?

dl65

Dummy · « **Reply #57 on:** December 29, 2005, 04:46:05 PM »

Yes I will however I don't know how

Dummy · « **Reply #58 on:** December 29, 2005, 04:47:09 PM »

it shows 0 partitions however now I cannot run fdisk as my boot disks got corrupted

dl65 · « **Reply #59 on:** December 29, 2005, 04:49:01 PM »

Dummy .....It's my opinion for what it's worth ....that you should consider getting another boot disk , and doing a full format ...and then reinstall win XP .......... I see no future in what your trying now...........
And this time please let windows install the drivers .......dont attempt to install driver from dos .

dl65

dl65 · « **Reply #60 on:** December 29, 2005, 04:52:28 PM »

Dummy ......Is the partition that shows up the same size as the hard drive or substantialy smaller?
BTW ..you can get a win98x boot disk at bootdisk.com

dl65

Dummy · « **Reply #61 on:** December 29, 2005, 04:58:11 PM »

Sir I have not been installing drivers and know very little about DOS what I have learned was reading and mostly just typing help as for doing a clean install HP will not allow it or I'm not doing it right I have 6 floppies from microsoft and it will always stop on the 4th disk with an error. when I do a system restore the C:\I386|drvapps.log and several others will say they are not recoverable when I retry it will take them but what I have learned from dealing in the registry it always has alot of keys that should not be there.

Dummy · « **Reply #62 on:** December 29, 2005, 05:04:07 PM »

Funny thing is for instance if I look at defrag right after I do a restore it shows 2 partitions for C: when I format D and clear the partition it still shows 2 for a little while and then becomes 1 I know it does not make sense but neither does alot of things with this computer. I downloaded a program from Systimarials on the desktop last night and later it disappered in thin air

dl65 · « **Reply #63 on:** December 29, 2005, 05:18:57 PM »

Dummy ....do you have the 25 character M/S product key code ? It should be on a sticker mounted on the outside of the case somewhere .

dl65

Dummy · « **Reply #64 on:** December 29, 2005, 05:21:33 PM »

Yes Sir

dl65 · « **Reply #65 on:** December 29, 2005, 05:25:17 PM »

Dummy ....LOL .....you can dispense with the sir ......LOL
Ok then do you know anyone that you can borrow a original copy of M/S Win XP from and then do a proper clean innstall using that original disk and your product code .

dl65

Dummy · « **Reply #66 on:** December 29, 2005, 05:49:24 PM »

LOL Sir is a habit from the south and I have already searched the neighborhood either they don't have one or don't want to loan it out. I'm fairly "new" "old" here I was born here but recently moved back. I am really fustrated with this but am not ready to give up I still believe

I lost control of the mouse and had to reboot I strongly suspect the problem is in the progams in DOS simply from the past experience with doing system restores.

Dummy · « **Reply #67 on:** December 29, 2005, 06:06:37 PM »

Boot Boot Bus Extender 1 ACPI Microsoft ACPI Driver
Boot Boot Bus Extender 2 PCI PCI Bus Driver
Boot Boot Bus Extender 3 isapnp PnP ISA/EISA Bus Driver
Boot System Bus Extender 4 IntelIde
Boot System Bus Extender 8 MountMgr
Boot System Bus Extender 9 Ftdisk Volume Manager Driver
Boot System Bus Extender 5 PartMgr
Boot System Bus Extender n/a* VolSnap
Boot SCSI miniport 25 atapi Standard IDE/ESDI Hard Disk Controller
Boot SCSI Class 2 Disk Disk Driver
Boot Base 1 KSecDD
Boot NDIS Wrapper n/a* NDIS NDIS System Driver
Boot PnP Filter* 4* agp440 Intel AGP Bus Filter
Boot Network* 2* Mup Mup
Boot PnP Filter* 6* nv_agp NVIDIA nForce AGP Bus Filter
Boot PnP Filter* 3* SISAGP SiS AGP Filter
Boot PnP Filter* 5* viaagp1 VIA AGP Filter
System System Bus Extender 14 lbrtfdc
System Primary disk 4 Sfloppy
System SCSI Class 45* i2omgmt
System SCSI CDROM Class 1 AFS2K AFS2k
System SCSI CDROM Class 2 Cdrom CD-ROM Driver
System Filter 5 Changer
System Filter 6 Cdaudio
System Boot file system n/a* Fs_Rec
System Base 1 Null
System Base 2 Beep
System Keyboard Port 4 i8042prt i8042 Keyboard and PS/2 Mouse Port Driver
System Pointer Class 1 Mouclass Mouse Class Driver
System Keyboard Class 1 Kbdclass Keyboard Class Driver
System Video Save 1 VgaSave
System Video Save n/a* mnmdd
System Video Save n/a* RDPCDD
System File system n/a* Msfs
System File system n/a* Npfs
System Streams Drivers 1 RasAcd Remote Access Auto Connection Driver
System PNP_TDI 4 IPSec IPSEC driver
System PNP_TDI 3 Tcpip TCP/IP Protocol Driver
System PNP_TDI 5 NetBT NetBT
System NetBIOSGroup 1 NetBIOS NetBIOS Interface
System Extended base 1 Serial Serial port driver
System Extended Base 3 Processor Processor Driver
System Extended Base 5 AmdK7 AMD K7 Processor Driver
System PCI Configuration 1* PCIDump
System n/a* n/a* Fips
System Pnp Filter* 2* Imapi CD-Burning Filter Driver
System Network* 5* MRxSmb MRXSMB
System Network* 4* Rdbss Rdbss
System Pnp Filter* 1* redbook Digital CD Audio Playback Filter Driver
System n/a* n/a* SiSkp
System n/a* n/a* TermDD Terminal Device Driver
Automatic Event log n/a* Eventlog Event Log
Automatic COM Infrastructure n/a* RpcSs Remote Procedure Call (RPC)
Automatic UIGroup n/a* Themes Themes
Automatic LocalValidation n/a* SamSs Security Accounts Manager
Automatic PlugPlay n/a* PlugPlay Plug and Play
Automatic TDI n/a* AFD AFD Networking Support Environment
Automatic TDI n/a* Dhcp DHCP Client
Automatic TDI n/a* Dnscache DNS Client
Automatic TDI n/a* LmHosts TCP/IP NetBIOS Helper
Automatic TDI n/a* WZCSVC Wireless Zero Configuration
Automatic ShellSvcGroup n/a* ShellHWDetection Shell Hardware Detection
Automatic SchedulerGroup n/a* Schedule Task Scheduler
Automatic SpoolerGroup n/a* Spooler Print Spooler
Automatic AudioGroup n/a* AudioSrv Windows Audio
Automatic NetworkProvider n/a* lanmanworkstation Workstation
Automatic NetworkProvider n/a* WebClient WebClient
Automatic Extended base 2 ParVdm
Automatic n/a* n/a* Browser Computer Browser
Automatic n/a* n/a* CryptSvc Cryptographic Services
Automatic n/a* n/a* ERSvc Error Reporting Service
Automatic n/a* n/a* helpsvc Help and Support
Automatic n/a* n/a* lanmanserver Server
Automatic n/a* n/a* NVSvc NVIDIA Driver Helper Service
Automatic n/a* n/a* PolicyAgent IPSEC Services
Automatic n/a* n/a* ProtectedStorage Protected Storage
Automatic n/a* n/a* seclogon Secondary Logon
Automatic Network* n/a* SENS System Event Notification
Automatic n/a* n/a* srservice System Restore Service
Automatic n/a* n/a* TrkWks Distributed Link Tracking Client
Automatic n/a* n/a* uploadmgr Upload Manager
Automatic * n/a* W32Time Windows Time
Automatic n/a* n/a* winmgmt Windows Management Instrumentation
Automatic n/a* n/a* wuauserv Automatic Updates
This is a program called load order from Sysinternals Freeware shows want is loaded at boot in which order don't know just thought it might help.

Computer Hope Forum

News:

Author Topic: Virus ? (Read 65563 times)

Dummy

Tadracket

Dummy

Tadracket

Dummy

Tadracket

Dummy

Dummy

Dummy

Tadracket

Dummy

Tadracket

Dummy

Fed

Dummy

Dummy

Fed

GX1_Man

J0K3R

Dell4700

Dummy

Dummy

dl65

Dummy

Dummy

dl65

Dummy

dl65

Dummy

dl65

Dummy

Dummy

dl65

Dummy

dl65

Dummy

dl65

dl65

Dummy

dl65

Dummy

Dummy

dl65

Dummy

Dummy

dl65

Dummy

dl65

dl65

Dummy

Dummy

dl65

Dummy

dl65

Dummy

dl65

dl65

Dummy

Dummy

dl65

dl65

Dummy

Dummy

dl65

Dummy

dl65

Dummy

Dummy