Author Topic: Getting rid of annoying dialing sound (Read 24345 times)

dianeliz · « **on:** October 04, 2008, 07:51:17 PM »

Hi! Has anyone else encountered an annoying and constant dialing sound that suddenly starts up one day and is there whenever you turn your speakers on? Unfortunately, I don't remember when exactly it started, so I have no idea what I may have done to cause it. However, on another forum, I went through the whole virus & malware checking, and the experts said I have no problem there. One of them suggested I try posting the question here.

This computer, by the way, has never had dial-up, and the internet option for connections is "never dial a connection". I have Windows XP, and the system is a Powerspec from Micro Center. I'm not sure where I'd find the model number. I also have no idea what brand the sound card is, something pretty standard I'd guess.

If you want them, here are the links to the prior forums on this topic:
http://www.computerhope.com/forum/index.php?topic=66366.new;topicseen#new & http://www.computerhope.com/forum/index.php?topic=66108.new;topicseen#new

Thanks for any ideas!

Diane

Broni · « **Reply #1 on:** October 05, 2008, 01:07:08 AM »

Download, and install Everest: http://www.majorgeeks.com/download4181.html
Open it, click Computer, then Summary.
In upper menu, go Report>Quick Report-Summary
Save it in text file, and paste it in your next post.
Don't include anything under line Debug - PCI

dianeliz · « **Reply #2 on:** October 06, 2008, 06:31:44 PM »

Hi Broni! I think the program may have changed since you last used it. When I installed it, it automatically ran a scan and told me that there are 203(!) errors, but there didn't seem to be any way to generate a report. (It did offer to fix things if I registered, but I figured I'd better consult you first.) So, I closed this version and re-opened the program. There was link for 'computer', but not for summary. Any idea how I would get to this summary?

Thanks!

patio · « **Reply #3 on:** October 06, 2008, 06:54:34 PM »

You missed the Everest DLoad link and probably clicked a Sponsor link for something else...Everest reports Hardware...it doesn't do scans.

Broni · « **Reply #4 on:** October 06, 2008, 07:58:31 PM »

patio must be right...

dianeliz · « **Reply #5 on:** October 06, 2008, 08:08:37 PM »

Ah, thanks! Here it is:

--------[ EVEREST Home Edition (c) 2003-2005 Lavalys, Inc. ]------------------------------------------------------------

Version EVEREST v2.20.405
Homepage http://www.lavalys.com/
Report Type Quick Report
Computer YOUR-546AA5645A (Diane's Work Computer)
Generator Diane
Operating System Microsoft Windows XP Professional 5.1.2600 (WinXP Retail)
Date 2008-10-06
Time 19:06

--------[ Summary ]-----------------------------------------------------------------------------------------------------

Computer:
Operating System Microsoft Windows XP Professional
OS Service Pack Service Pack 2
DirectX 4.09.00.0904 (DirectX 9.0c)
Computer Name YOUR-546AA5645A (Diane's Work Computer)
User Name Diane

Motherboard:
CPU Type Intel Pentium 4, 3066 MHz (23 x 133)
Motherboard Name Unknown
Motherboard Chipset VIA P4M800 Pro
System Memory 448 MB
BIOS Type Award (11/04/05)
Communication Port Communications Port (COM1)
Communication Port ECP Printer Port (LPT1)

Display:
Video Adapter VIA/S3G UniChrome Pro IGP (64 MB)
3D Accelerator VIA/S3 UniChrome Pro

Multimedia:
Audio Adapter VIA AC'97 Enhanced Audio Controller

Storage:
IDE Controller VIA Bus Master IDE Controller
SCSI/RAID Controller VIA SATA RAID Controller
Disk Drive ST3250823A (250 GB, 7200 RPM, Ultra-ATA/100)
Disk Drive Generic USB SD Reader USB Device
Disk Drive Generic USB CF Reader USB Device
Disk Drive Generic USB SM Reader USB Device
Disk Drive Generic USB MS Reader USB Device
Optical Drive SONY DVD RW DW-Q30A
SMART Hard Disks Status OK

Partitions:
C: (NTFS) 238472 MB (226603 MB free)

Input:
Keyboard Standard 101/102-Key or Microsoft Natural PS/2 Keyboard
Mouse PS/2 Compatible Mouse

Network:
Network Adapter Realtek RTL8139/810x Family Fast Ethernet NIC (192.168.1.101)

Peripherals:
Printer Auto Auto Auto HP DeskJet 930C/932C/935C on KEN on YOUR-546AA5645A on KEN
Printer Auto Auto HP DeskJet 930C/932C/935C on YOUR-546AA5645A on KEN
Printer Auto Auto Printer for PS files only on YOUR-546AA5645A on KEN
Printer Auto HP DeskJet 930C/932C/935C on KEN
Printer Canon MP780 FAX
Printer Canon MP780 Series Printer
Printer eFax 4.1
Printer Epson LQ-1070 ESC/P 2
Printer HP DeskJet 930C/932C/935C
Printer Microsoft Office Live Meeting Document Writer
Printer Printer for PS files only
Printer WebEx Document Loader
USB1 Controller VIA VT83C572 PCI-USB Controller
USB1 Controller VIA VT83C572 PCI-USB Controller
USB1 Controller VIA VT83C572 PCI-USB Controller
USB1 Controller VIA VT83C572 PCI-USB Controller
USB2 Controller VIA USB 2.0 Enhanced Host Controller
USB Device USB Human Interface Device
USB Device USB Mass Storage Device

--------[ Debug - PCI ]-------------------------------------------------------------------------------------------------

Broni · « **Reply #6 on:** October 06, 2008, 08:39:40 PM »

Get new sound driver here: http://www.viaarena.com/default.aspx?PageID=420&OSID=1&CatID=1010&SubCatID=104

dianeliz · « **Reply #7 on:** October 07, 2008, 04:22:16 PM »

I did, and re-booted my system, but nothing seems to have changed. I still have the dialing sound. Should I do something else now?

Broni · « **Reply #8 on:** October 07, 2008, 04:48:54 PM »

I've been totally shooting in the dark, because I've never heard about such a problem before (I mean, except for, when computer is infected, but your computer was checked already.
Just to make sure, I want you to run one more scan...

Download gmer.zip: http://www.gmer.net/files.php
Unzip the file, and double click on gmer.exe, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Post the log to your next reply.

patio · « **Reply #9 on:** October 07, 2008, 05:19:16 PM »

Is there a PCI card modem installed in this machine ? ?
If so and you don't use it pull it.

Broni · « **Reply #10 on:** October 07, 2008, 05:24:10 PM »

Ha...

dianeliz · « **Reply #11 on:** October 08, 2008, 07:52:18 PM »

Hi all! I'm afraid I have no idea what a PCI card modem is, what it looks like, if I have one, and how I would pull it if I did. Sorry.

I finally figured out how to attach the file to these posts. There will still be 2 or 3 pieces, but if I cut & pasted from the log, I would need 20 posts!

SCREAM! I've just spent forever splitting my file into 3 files under 256K, and it still won't let me post them. Is it possible you don't need the whole log?

If not, what is the true maximum size?

Thanks for your patience!

dianeliz · « **Reply #12 on:** October 08, 2008, 07:54:58 PM »

Part 2, I hope

[Saving space - attachment deleted by admin]

dianeliz · « **Reply #13 on:** October 08, 2008, 08:06:44 PM »

SCREAM AGAIN! I got part 2, but the others wouldn't go through. Now, I split part 3 into 2 parts, and I'm trying a new part 3 far smaller than part 2, and I keep getting the message, "The upload folder is full. Please try a smaller file and/or contact an administrator." (The part 2 that went through is 145KB. The one that is failing on me now is only 84KB.)

I also keep getting another annoying error message when I try to fix things: "You already submitted this post! You might have accidently double clicked, or tried to refresh."

Broni · « **Reply #14 on:** October 08, 2008, 08:09:46 PM »

Nothing here. It's clean.
Try patio's suggestion.
Look at the back of your computer. You're looking for phone jack type port:

If you see phone jack in AREA 1, your modem is on-board, and you can't do anything.
If you see phone jack in AREA 2, you have modem card, which can be removed (few screws to remove computer side panel, and one screw to remove modem itself.

NOTE. Don't mistake phone jack with ethernet jack, which is little bit bigger, and where your broadband connection cable is connected (both jacks are shown on the above picture.

Broni · « **Reply #15 on:** October 08, 2008, 08:10:49 PM »

Oh, that was 1st part only...
I'll PM you with my email address. You can send it there.

dianeliz · « **Reply #16 on:** October 09, 2008, 04:56:18 PM »

Hi again! I do not have a phone jack at all. In fact, area 2 is all "boarded" up; there's nothing there at all, though I gather I could complicate my computer in the future if I should choose to. :-)

patio · « **Reply #17 on:** October 09, 2008, 05:07:37 PM »

Quote from: dianeliz on October 09, 2008, 04:56:18 PM

Hi again! I do not have a phone jack at all. In fact, area 2 is all "boarded" up; there's nothing there at all, though I gather I could complicate my computer in the future if I should choose to. :-)

Yes...that's exactly what Area2 is for....

BTW Welcome Aboard and we'll get you fixed up.

Broni · « **Reply #18 on:** October 09, 2008, 05:15:17 PM »

I received your GMER log. I'll check it out in a few.

Broni · « **Reply #19 on:** October 09, 2008, 05:22:22 PM »

Unfortunately (fortunately?), nothing suspicious in GMER log.
We must keep looking for some other solutions.
Possible to try another pair of speakers?

dianeliz · « **Reply #20 on:** October 09, 2008, 05:43:32 PM »

Interesting thought. I just 'borrowed' the speakers from my husband's system, but I still get the dialing sound.

You know, I don't know if this will help, but I don't think I ever described the dialing sound. If you're old enough to remember phones with rotary dials, that's what it sounds like, the sound the phone would make as you dialed each number and the dial rotated back to the starting position.

Another thought. Could there be some setting somewhere on my machine that makes some part of the machine think there's a dial-up modem which it keeps trying to activate? I don't know what or where it could be, but perhaps this perhaps triggers an idea?

Broni · « **Reply #21 on:** October 09, 2008, 06:00:38 PM »

Yes, I'm old enough

Check in Device Manager, what is listed under "Modems".
Also, see, if same sound can be heard in Safe Mode.

dianeliz · « **Reply #22 on:** October 18, 2008, 07:29:09 PM »

Hi again! Sorry for the long delay. I do appreciate your patience.

There is no modem listed at all under device manager.

There is no dialing sound in safe mode. That got me all enthused, so I went into msconfig and one-by-one started removing programs from my startup. Unfortunately, even when I got down to only the system programs, I was still getting the dialing sound. :-( So, I put them all back. At least we know it's some program, not a hardware glitch, right? What else, besides the startup programs, doesn't 'go' in safe mode?

Thanks!
Diane

Broni · « **Reply #23 on:** October 18, 2008, 07:32:19 PM »

Download HijackThis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
Click on Download HijackThis Installer
Post HijackTHis log.

I want to see, what's running there.

dianeliz · « **Reply #24 on:** October 18, 2008, 07:42:04 PM »

That was easy since I did this before. :-)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:41:10 PM, on 18-Oct-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\DrvMon.exe
C:\WINDOWS\sabserv.exe
C:\Program Files\Alarm95\Alarm95.exe
C:\Program Files\MemTurbo30\MemTurbo.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\WINDOWS\system32\CfgSrvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINDOWS\system32\CfgSrvc.exe
C:\WINDOWS\SDMan.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPSMON\UPSMON_Service.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Java\jre1.5.0_11\bin\javaw.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\spider.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://24.248.216.205/exchange/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/landingpages/cd.asp?affid=307&lpname=vso&cid=8152&appurl=http://us.mcafee.com/apps/AppCommon/updreg.asp?app=http://us.mcafee.com/apps/vso/en-us/redir.asp?affid=307&installtype=force&lpname=vso&systempopup=true (obfuscated)
O1 - Hosts: 127.0.0.34 ofep34.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.23 ofep23.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.36 fos.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.8 ofep08.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.21 ofep21.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.32 ofep32.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.44 access.certd.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.36 frt.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.28 ofep28.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.30 ofep30.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.6 ofep06.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.41 access.tstsa.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.26 ofep26.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.4 ofep04.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.35 ofep35.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.24 ofep24.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.37 lb1.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.39 tsts.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.39 access.tsts.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.33 ofep33.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.9 ofep09.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.22 ofep22.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.29 ofep29.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.40 cert.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.31 ofep31.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.7 ofep07.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.40 access.cert.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.20 ofep20.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.43 access.certc.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.42 access.tstsb.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.27 ofep27.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.5 ofep05.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.36 decs.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.25 ofep25.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.38 lb2.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.3 ofep03.sabre.com # Nortel SSL-VPN
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPub.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VrSchedule] C:\Program Files\PCSecurityShield\ShieldAntivirus\Vrres.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\PCSecurityShield\ShieldAntivirus\vrmonnt.exe Main
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe
O4 - Startup: Alarm 95.lnk = C:\Program Files\Alarm95\Alarm95.exe
O4 - Startup: CleanupNortelVPN.bat
O4 - Startup: MemTurbo.lnk = C:\Program Files\MemTurbo30\MemTurbo.exe
O4 - Startup: Microsoft Office Fast Start.lnk = C:\MSOffice\Office\FASTBOOT.EXE
O4 - Startup: Microsoft Office Find Fast Indexer.lnk = C:\MSOffice\Office\FINDFAST.EXE
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Sabre Server.lnk = C:\WINDOWS\sabserv.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\scieplugin.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.agentware.net
O15 - Trusted Zone: *.jacquielawson.com
O15 - Trusted Zone: *.sabre.com
O15 - Trusted Zone: *.vacationstudio.net
O15 - Trusted Zone: *.virtuallythere.com
O16 - DPF: {03A89EFD-E023-7700-A22D-45F77558EB4C} (ILINCInstall77 Class) - http://learnlinc.sabre.com/download/ilinci77.dll
O16 - DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} (TMinReq Class) - https://my.sabre.com/jars/TMinReqX.dll
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://tnz.webex.com/client/T25L/training/ieatgpc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
O23 - Service: Config Service Helper (CfgSrvc) - Unknown owner - C:\WINDOWS\system32\CfgSrvc.exe
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: EarthLink Firewall Process Path Service (ElnkFWPPService) - Unknown owner - C:\PROGRA~1\EARTHL~1\PROTEC~1\EFWPPS~1.EXE (file missing)
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HSSP Configuration Module (HsspConfig) - Unknown owner - C:\WINDOWS\system32\CfgSrvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sabre Device Manager (SDMan) - Unknown owner - C:\WINDOWS\SDMan.EXE
O23 - Service: UPSMONService - Unknown owner - C:\Program Files\UPSMON\UPSMON_Service.Exe

--
End of file - 12948 bytes

Broni · « **Reply #25 on:** October 18, 2008, 07:48:46 PM »

Did you modify your "hosts" file on purpose?
I'd like to see also, HJT log from Safe Mode, so I can compare.

I'm leaving for the movies right now, so I'll take a look at your reply, and at your logs later tonight, or tomorrow morning.

dianeliz · « **Reply #26 on:** October 18, 2008, 08:29:09 PM »

I hope you enjoyed the movie! My husband and I watch movies on Saturday night too.

What is a "hosts" file?

Here is the safe mode log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:23:04 PM, on 18-Oct-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://24.248.216.205/exchange/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/landingpages/cd.asp?affid=307&lpname=vso&cid=8152&appurl=http://us.mcafee.com/apps/AppCommon/updreg.asp?app=http://us.mcafee.com/apps/vso/en-us/redir.asp?affid=307&installtype=force&lpname=vso&systempopup=true (obfuscated)
O1 - Hosts: 127.0.0.34 ofep34.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.23 ofep23.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.36 fos.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.8 ofep08.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.21 ofep21.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.32 ofep32.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.44 access.certd.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.36 frt.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.28 ofep28.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.30 ofep30.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.6 ofep06.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.41 access.tstsa.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.26 ofep26.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.4 ofep04.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.35 ofep35.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.24 ofep24.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.37 lb1.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.39 tsts.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.39 access.tsts.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.33 ofep33.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.9 ofep09.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.22 ofep22.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.29 ofep29.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.40 cert.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.31 ofep31.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.7 ofep07.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.40 access.cert.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.20 ofep20.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.43 access.certc.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.42 access.tstsb.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.27 ofep27.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.5 ofep05.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.36 decs.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.25 ofep25.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.38 lb2.sabre.com # Nortel SSL-VPN
O1 - Hosts: 127.0.0.3 ofep03.sabre.com # Nortel SSL-VPN
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPub.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VrSchedule] C:\Program Files\PCSecurityShield\ShieldAntivirus\Vrres.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\PCSecurityShield\ShieldAntivirus\vrmonnt.exe Main
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe
O4 - Startup: Alarm 95.lnk = C:\Program Files\Alarm95\Alarm95.exe
O4 - Startup: CleanupNortelVPN.bat
O4 - Startup: MemTurbo.lnk = C:\Program Files\MemTurbo30\MemTurbo.exe
O4 - Startup: Microsoft Office Fast Start.lnk = C:\MSOffice\Office\FASTBOOT.EXE
O4 - Startup: Microsoft Office Find Fast Indexer.lnk = C:\MSOffice\Office\FINDFAST.EXE
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Sabre Server.lnk = C:\WINDOWS\sabserv.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\scieplugin.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.agentware.net
O15 - Trusted Zone: *.jacquielawson.com
O15 - Trusted Zone: *.sabre.com
O15 - Trusted Zone: *.vacationstudio.net
O15 - Trusted Zone: *.virtuallythere.com
O16 - DPF: {03A89EFD-E023-7700-A22D-45F77558EB4C} (ILINCInstall77 Class) - http://learnlinc.sabre.com/download/ilinci77.dll
O16 - DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} (TMinReq Class) - https://my.sabre.com/jars/TMinReqX.dll
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://tnz.webex.com/client/T25L/training/ieatgpc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
O23 - Service: Config Service Helper (CfgSrvc) - Unknown owner - C:\WINDOWS\system32\CfgSrvc.exe
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: EarthLink Firewall Process Path Service (ElnkFWPPService) - Unknown owner - C:\PROGRA~1\EARTHL~1\PROTEC~1\EFWPPS~1.EXE (file missing)
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HSSP Configuration Module (HsspConfig) - Unknown owner - C:\WINDOWS\system32\CfgSrvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sabre Device Manager (SDMan) - Unknown owner - C:\WINDOWS\SDMan.EXE
O23 - Service: UPSMONService - Unknown owner - C:\Program Files\UPSMON\UPSMON_Service.Exe

--
End of file - 11767 bytes

Aegis · « **Reply #27 on:** October 18, 2008, 10:23:59 PM »

Quote

You know, I don't know if this will help, but I don't think I ever described the dialing sound. If you're old enough to remember phones with rotary dials, that's what it sounds like, the sound the phone would make as you dialed each number and the dial rotated back to the starting position.

Yes, that's called dial pulse. Makes me wonder if the modem is set to call out via dial pulse instead of touch-tone. Back in the day, there were Hayes modem compatible settings to control such things. I wonder if there are settings via the modem's software?

Broni · « **Reply #28 on:** October 19, 2008, 11:31:58 AM »

Quote

What is a "hosts" file?

Since you don't know, most likely, you didn't modify it.

In that case...
Download HostsXpert ( http://www.majorgeeks.com/Hoster_d4626.html ) and then follow the steps below:

* Unzip HostsXpert.zip
* It will create a folder named HostsXpert in whatever folder you extract it to.
* Run HostsXpert.exe by double clicking on it.
* click Restore MS Hosts File and then click OK.
* Click the X to exit the program

Restart computer.
1. Post fresh HJT log from Normal Mode.
2. Post fresh HJT log from Safe Mode.
3. Post fresh HJT log from Safe Mode with Networking. While here, see if you have dialing sound in Safe Mode with Networking.

dianeliz · « **Reply #29 on:** October 20, 2008, 12:22:24 PM »

Not on purpose, anyway. :-)

There is no dialing sound in safe mode with networking either.

I think I'll try attaching the 3 logs...

[Saving space - attachment deleted by admin]

Broni · « **Reply #30 on:** October 20, 2008, 12:46:39 PM »

Very good...let me check them.

Broni · « **Reply #31 on:** October 20, 2008, 12:49:25 PM »

You didn't run HostsXpert
Why?

dianeliz · « **Reply #32 on:** October 20, 2008, 12:55:13 PM »

Yes, I did, just as you said. What was it supposed to do?

Broni · « **Reply #33 on:** October 20, 2008, 01:19:03 PM »

It was supposed to reset your "hosts" file to its default, so there are no O1 entries in HJT log.
When you clicked on "Restore MS Hosts File", in right pane the whole text should be reduced to:

Quote

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost

Try again.

I'm pretty sure, your "hosts" file is a culprit, but we have to proceed carefully.

Also, do you have any knowledge of Nortel VPN Gateway?

dianeliz · « **Reply #34 on:** October 20, 2008, 01:40:42 PM »

I just tried it again and got what you said. I don't remember seeing this before, but since I didn't know what to expect, I didn't realize I did anything wrong. This time, after the mshosts thing, it asked me to press "ok", and then my virus checker got all discombobulated. So, obviously, it did nothing before; I don't know why.

Anyway, I'll shut down all my programs and do all those hijack logs again.

Oh, and no, I have no knowledge of "Nortel VPN Gateway".

Broni · « **Reply #35 on:** October 20, 2008, 01:49:33 PM »

OK. Restart computer, and post HJT from Normal Mode only, for now.

dianeliz · « **Reply #36 on:** October 20, 2008, 02:02:10 PM »

Got all 3, so feel free to ignore the ones you don't need. (I just read your reply.)

[Saving space - attachment deleted by admin]

Broni · « **Reply #37 on:** October 20, 2008, 02:05:14 PM »

It looks much better.
I'll analyze it further in a moment, but couple of questions, first.
Did you restart?
Do you still have dialing sound present?

Saviour · « **Reply #38 on:** October 20, 2008, 02:25:32 PM »

I believe this may be interference related. It could be your speakers/speaker wires aren't shielded...and are picking up some type of electronic interference...either from the home...or an outside influence.

Have you tried relocating the computer to another area of the home...or maybe even checking your speaker connections and placement?

Make sure your speaker wires are not overlapping electrical cords...or if you're using a surge protector...try another one.

I think you'll want to eliminate the interference, first, before you delve too much further into it being malware or any other type of hardware issue.

Broni · « **Reply #39 on:** October 20, 2008, 02:32:06 PM »

I don't think so, Steve. The sound is not present in Safe Mode, or Safe Mode with Networking.
I'm pretty confident, I can see some entries, which may be responsible for dialing sound, but we can't rush anything here.
I need to hear from dianeliz, first.

Saviour · « **Reply #40 on:** October 20, 2008, 03:45:36 PM »

You got it, Broni...backing on outta here.

Broni · « **Reply #41 on:** October 20, 2008, 04:03:35 PM »

Hey, no problem, Steve. I HOPE, I got it

Saviour · « **Reply #42 on:** October 20, 2008, 04:06:03 PM »

*Steve sits patiently with fingers crossed...

dianeliz · « **Reply #43 on:** October 20, 2008, 05:41:33 PM »

Boy, you guys are so much faster at replying than I am. :-) I guess it's because I'm working (yes, at home). Anyway, I moved my 2 speakers next to each other, but it had no effect. I still have that dialing sound, and the mshosts thing didn't seem to help.

Yes, I rebooted before each hijack this.

I'm happy to start disabling programs on a temporary basis to see what works. You don't think this could have been a microsoft update, do you? Of course, if it were that simple, thousands of people would be having the same problem.

This is a long shot since I got my Vonage computer phone in March 2007, and this problem just started this year, though I don't remember exactly when. Could there be any connection there?

Thank you SOOO much for your amazing patience & perseverance!

patio · « **Reply #44 on:** October 20, 2008, 05:55:28 PM »

Quote

This is a long shot since I got my Vonage computer phone in March 2007,

Ahaaaaa! !
Find out if they will swap it out for a test...

Broni · « **Reply #45 on:** October 20, 2008, 06:05:54 PM »

Good question...

On the other hand, I want you to remove few items from HJT log. I compared all three logs, and came up with every possible culprit, so let's try that.
If that doesn't work, we'll move to Vonage computer phone issue.

Open HJT, and checkmark:
- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search
- R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://24.248.216.205/exchange/
- R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://us.mcafee.com/root/landingpages/cd.asp?affid=307&lpname=vso&cid=8152&appurl=http://us.mcafee.com/apps/AppCommon/updreg.asp?app=http://us.mcafee.com/apps/vso/en-us/redir.asp?affid=307&installtype=force&lpname=vso&systempopup=true (obfuscated)
- O23 - Service: EarthLink Firewall Process Path Service (ElnkFWPPService) - Unknown owner - C:\PROGRA~1\EARTHL~1\PROTEC~1\EFWPPS~1.EXE (file missing)
Click "Fix checked".
Restart computer.
Post fresh HJT log.

dianeliz · « **Reply #46 on:** October 20, 2008, 06:23:11 PM »

I wish I could tell you that the dialing sound is gone, but alas, no. Here's the log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:19:21 PM, on 20-Oct-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\system32\DrvMon.exe
C:\WINDOWS\sabserv.exe
C:\Program Files\Alarm95\Alarm95.exe
C:\Program Files\MemTurbo30\MemTurbo.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\WINDOWS\system32\CfgSrvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINDOWS\system32\CfgSrvc.exe
C:\WINDOWS\SDMan.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPSMON\UPSMON_Service.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPub.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VrSchedule] C:\Program Files\PCSecurityShield\ShieldAntivirus\Vrres.exe
O4 - HKLM\..\Run: [Vrmon] C:\Program Files\PCSecurityShield\ShieldAntivirus\vrmonnt.exe Main
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINDOWS\system32\DrvMon.exe
O4 - Startup: Alarm 95.lnk = C:\Program Files\Alarm95\Alarm95.exe
O4 - Startup: MemTurbo.lnk = C:\Program Files\MemTurbo30\MemTurbo.exe
O4 - Startup: Microsoft Office Fast Start.lnk = C:\MSOffice\Office\FASTBOOT.EXE
O4 - Startup: Microsoft Office Find Fast Indexer.lnk = C:\MSOffice\Office\FINDFAST.EXE
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Sabre Server.lnk = C:\WINDOWS\sabserv.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\scieplugin.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.agentware.net
O15 - Trusted Zone: *.jacquielawson.com
O15 - Trusted Zone: *.sabre.com
O15 - Trusted Zone: *.vacationstudio.net
O15 - Trusted Zone: *.virtuallythere.com
O16 - DPF: {03A89EFD-E023-7700-A22D-45F77558EB4C} (ILINCInstall77 Class) - http://learnlinc.sabre.com/download/ilinci77.dll
O16 - DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} (TMinReq Class) - https://my.sabre.com/jars/TMinReqX.dll
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://tnz.webex.com/client/T25L/training/ieatgpc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
O23 - Service: Config Service Helper (CfgSrvc) - Unknown owner - C:\WINDOWS\system32\CfgSrvc.exe
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: EarthLink Firewall Process Path Service (ElnkFWPPService) - Unknown owner - C:\PROGRA~1\EARTHL~1\PROTEC~1\EFWPPS~1.EXE (file missing)
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\480\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HSSP Configuration Module (HsspConfig) - Unknown owner - C:\WINDOWS\system32\CfgSrvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sabre Device Manager (SDMan) - Unknown owner - C:\WINDOWS\SDMan.EXE
O23 - Service: UPSMONService - Unknown owner - C:\Program Files\UPSMON\UPSMON_Service.Exe

--
End of file - 10187 bytes

Broni · « **Reply #47 on:** October 20, 2008, 06:42:51 PM »

One more try....

Go Start>Run (Start Search in Vista), type in:
msconfig
Click OK (hit Enter in Vista).

Click on Startup tab.
Click Disable all

Click Services tab.
Put checkmark in Hide all Microsoft services
Click Disable all.

Click OK.
Restart computer in Normal Mode.

dianeliz · « **Reply #48 on:** October 20, 2008, 07:00:24 PM »

You would think that would do it, but I still have the dialing sound. :-( For what it's worth, I got a permission denied error, but the only item still checked is avp.exe in PCshield. I'll run another hijackthis.exe, just in case.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:59:03 PM, on 20-Oct-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink ScamBlocker V3 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPub.dll
O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\EarthLink TotalAccess\Accelerator\prpl_IePopupBlocker.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVP] "C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\npjpi150_11.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\scieplugin.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.agentware.net
O15 - Trusted Zone: *.jacquielawson.com
O15 - Trusted Zone: *.sabre.com
O15 - Trusted Zone: *.vacationstudio.net
O15 - Trusted Zone: *.virtuallythere.com
O16 - DPF: {03A89EFD-E023-7700-A22D-45F77558EB4C} (ILINCInstall77 Class) - http://learnlinc.sabre.com/download/ilinci77.dll
O16 - DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} (TMinReq Class) - https://my.sabre.com/jars/TMinReqX.dll
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://tnz.webex.com/client/T25L/training/ieatgpc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\480\G2AWinLogon.dll
O23 - Service: The Shield Deluxe 2008 (AVP) - PCSecurityShield - C:\Program Files\PCSecurityShield\The Shield Deluxe 2008\avp.exe

--
End of file - 7054 bytes

Broni · « **Reply #49 on:** October 20, 2008, 07:37:26 PM »

I think, I have to admit defeat. At least for now, unless something else comes up to my mind.
I am clueless...

dianeliz · « **Reply #50 on:** October 21, 2008, 11:19:47 AM »

Hi Broni! You're hardly clueless. I was the one who was clueless. You helped me eliminate viruses & malware. And you pointed me in the right direction to solve the problem, and believe it or not, solve it I did.

Basically, I just went one step further, figuring if all the non-Microsoft items were innocent, why not look at the Microsoft ones. So, first, I unchecked most of the allowable microsoft links, did a re-boot, and, voila, no dialing sound. So, I started adding them back, a few at a time, re-booting after each addition. It's a Microsoft process called "telephony". How obvious is that ... in hindsight? :-)

I also currently have my print spooler process disabled because I found it was causing beeps which I hadn't noticed before.

So, now you have the information for Computer Hope and for any future inquiries. Do you think it's worth my trying to report this to Microsoft? It's obviously a bug they introduced in one of their "upgrades".

THANK YOU SOOOO MUCH for all your patient and persistent help on this!!!!!

Diane

Broni · « **Reply #51 on:** October 21, 2008, 05:02:21 PM »

WOW! Nice job, Diane

I surely bookmarked this thread.

dianeliz · « **Reply #52 on:** October 21, 2008, 05:28:54 PM »

Um, actually, I may have been a bit hasty. With the print spooler turned off, of course, I was unable to print, but when I turned it back on, the dialing sound was back. :-( "Hmmm," I thought, "I have to print." So, I went into help, and did a search on print spooler. Sure enough, there was a "properties" option. And mine was set to "beep" when I had an error in printing to a remote printer. Mind you, this error occurred months ago! Anyway, when I turned that beeping property off, the dialing sound went away again. So, the telephony thing may not be a problem after all. However, I'm leaving it off just in case.

When I have time, I probably need to research my remote printer issue, but I won't clutter up this forum.

Thanks again!

Broni · « **Reply #53 on:** October 21, 2008, 05:33:20 PM »

I really appreciate your very valuable investigation.
I've never heard about this kind of solution for dialing sound problem, so this thread is definitely another gem to my collection of solutions.
Great job!

Aegis · « **Reply #54 on:** October 21, 2008, 10:27:52 PM »

Well, we're always up for a solution, but that's just goofy -- here's my guess (I'm using the WAG technique): Something in Microsoft's (RPC) Remote Procedure Call dependencies is invoking the Telephony Application Programming Interface (TAPI) which allows the operating system to use telephone services -- even though it's a print service that's actually being used.

I wonder, if I heard the dial pulses, if I could figure out the numbers being "dialed"?

patio · « **Reply #55 on:** October 22, 2008, 03:13:32 PM »

I believe it's the printer "phoning home" for updates...it's possible it was once on a dial-up network and set up this way.
I'd smash the printer with a sledgehammer before doing that to the computer...

But this episode belongs in the Hall of Fame for sure ! !

Saviour · « **Reply #56 on:** October 22, 2008, 04:05:56 PM »

Definitely one for the record books...

Aegis · « **Reply #57 on:** October 22, 2008, 10:33:37 PM »

Darn -- Patio's explanation makes more sense than mine...but, uh, mine sounds better!

Computer Hope Forum

News:

Author Topic: Getting rid of annoying dialing sound (Read 24345 times)

dianeliz

Broni

dianeliz

patio

Broni

dianeliz

Broni

dianeliz

Broni

patio

Broni

dianeliz

dianeliz

dianeliz

Broni

Broni

dianeliz

patio

Broni

Broni

dianeliz

Broni

dianeliz

Broni

dianeliz

Broni

dianeliz

Aegis

Broni

dianeliz

Broni

Broni

dianeliz

Broni

dianeliz

Broni

dianeliz

Broni

Saviour

Broni

Saviour

Broni

Saviour

dianeliz

patio

Broni

dianeliz

Broni

dianeliz

Broni

dianeliz

Broni

dianeliz

Broni

Aegis

patio

Saviour

Aegis