![]() |
|
|
#1 |
|
Senior Member
Join Date: Jan 2006
Posts: 201
|
Bear, I sometimes browse a site called KhonKaen.com (try it, it's an interesting slice o' life about living there, where I'd lived shortly before moving to Bangkok) and I had trouble with the reply box. The moderator suggested it was from the site's cookies, and further suggested I run a program called CCLeaner, to remove cookies. I did that and it somehow wiped out my 'link' with the Internet. I've deleted and reinstalled my ISP (JiNet) several times, but it seems my IE cannot 'see' the dialed-up connection. The Ji-Net works fine, and tells me that it hooks up as normal, etc. But when I try to open an IE-window to a site (such as this one) it says 'Cannot find server'. How do I link the two again?
That's why I haven't been on recently...this happened once before, when I ran a partitions-cleaning program to remove old code and supposedly make my system run up- to-snuff once again. It wiped out my connection too, but I was able to reconnect it. I can't remember the exact fix I did that worked, since I was shooting blind and trying everything I could think of. What are the steps to make the IE 'see' the web-connection? Thanx. BTW, I'm up north again, at my wife's family's place, for a wedding. I'm using an internet-cafe for this message. I hope you and yours had a good holiday!! beer: ![]() |
|
|
|
|
|
#2 |
|
Admin
Join Date: Dec 2004
Posts: 1,129
|
Glad to have you show up here, Rocker. I tried sending you a PM over "there" when things went pear shaped, but I don't think you look at those often.
![]() Is the software from your ISP an actual program (a dialer, as in you open it to get onto the net), or just something that helps with the settings and you open IE normally? If it's a program, have you tried uninstalling then reinstalling instead of just installing over the top of the existing one? If it's not a dialer program, maybe you should note the settings and create a new connection through the network setup dialog in the control panel. (see attached) If all else fails, I'd like to see a HJT log, if you can manage to get that for me. It's possible that you had something on there that was intercepting the connection for it's own use, and when you wiped things out, it can't connect now. ![]()
__________________
. Quality Web Hosting and Design: Woollybear Web Please keep help and support questions in the public forums. Tech questions submitted by PM will not be answered. |
|
|
|
|
|
#3 |
|
Senior Member
Join Date: Jan 2006
Posts: 201
|
Bear, yes, it's an actual dialer. It comes with a CD to install the program, and then I just buy 'time-cards' which each have a user-name and password, and give so many minutes for so many Baht. I saved the first CD when I bought it, and have just been buying cards since, but when this happened, I used the Add/Remove function-screen in Windows to remove the program, then reinstalled it. I also tried to use the Windows dial-up connection-wizard, (to which you'd shown the thumbnails) and plugged the other program's username/password into it but still, no connection.
I will try and do a HJT log, save it to disc and return here (Internet cafe in a mall) in a day or two and post it. Plus, I forgot to mention that I'd also downloaded a virus-removal program and run it as well. THAT could have wiped the connection. I opened it this morning, and looked at the log of deleted files in which it'd found a virus or a 'signature' of a back-door virus. I'd told it to delete these (I believe there were about 8) and I thought it may be possible that one of the deleted files was essential for the IE connection. I'll try to copy the list of files which it deleted and we can check to see if one is necessary for the IE. I got both the CCleaner program and the anti-virus program from a site called filehippo.com. You're right about not reading PM's. When I'm waiting for help and logging in to look for an answer, I usually go right to the thread in which I'd posted a question, being somewhat single-minded at times, (and forgetful at others, bad combination). I usually forget to check for PM's, since I get so few. Not good site-etiquette, I'm sure, and I'm sorry I missed your heads-up. I hope this site treats you better than the old, and I'm also extremely glad you're still around to help us poor 'puter screwer-uppers. Sa-wat-dee-bee-mai-kahp!! (Happy New Year!!) ![]() |
|
|
|
|
|
#4 | |||
|
Admin
Join Date: Dec 2004
Posts: 1,129
|
Quote:
Have you tried disabling all those helper applications before installing the dialer? Quote:
Quote:
![]()
__________________
. Quality Web Hosting and Design: Woollybear Web Please keep help and support questions in the public forums. Tech questions submitted by PM will not be answered. |
|||
|
|
|
|
|
#5 | ||
|
Senior Member
Join Date: Jan 2006
Posts: 201
|
Bear, when I reinstall the ISP-dialer-program, it installs just fine, and works fine as well, dialing-up the programmed phone number and connecting, everything OK. It's after that, when I try to open the IE that it can't see the installed dialer-program.
Here's my HJT log: Logfile of HijackThis v1.99.1 Scan saved at 9:25:34 AM, on 1/11/2006 Platform: Windows XP SP2, v.2082 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2082) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AVPersonal\AVGUARD.EXE C:\Program Files\AVPersonal\AVWUPSRV.EXE C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\rundll32.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\AVPersonal\AVGNT.EXE C:\Program Files\JI-Net\JI-Net Accelerator\3.52.0105.14\IACLiM.exe D:\Net Software\HiJackThis\HijackThis.exe O2 - BHO: eCATRegistrar Class - {02336F51-24CA-4422-AB63-18841ADF35E6} - C:\Program Files\JI-Net\JI-Net Accelerator\3.52.0105.14\eCATBHO.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: JI-Net Accelerator - {4BC3AC04-3E56-411D-B465-4FEA06654611} - C:\Program Files\JI-Net\JI-Net Accelerator\3.52.0105.14\ThinClientToolbar.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\system32\hgqhp.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [load32] C:\WINDOWS\system32\winldra.exe O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [IAClient] C:\Program Files\JI-Net\JI-Net Accelerator\3.52.0105.14\IACLiM.exe O4 - Global Startup: IDW Logging Tool.lnk = C:\WINDOWS\system32\idwlog.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0191ABF4-9421-435E-9FFD-CD827A2A82D8} (SBITAX7Ctrl Class) - http://directplugin.com/tl7000.dll O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/180s...bridge-c32.cab O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe ************************************************** ******** Bear, this information below shows up when I open my Anti-virus program and select “Report”. I’m not sure if it’s a summary of the viruses it deleted or if it’s information about the type of files the AV program itself uses to scan the computer. But I’m including it so that if it can help, you have it. Platform: Windows NT Workstation Windows version: 5.1 Build 2600 (Service Pack 2, v.2082) Username: David Processor: Pentium Working memory: 622064 KB free Creation date of the report file: Wednesday, January 11, 2006 09:30 AntiVir®/XP (2000 + NT) PersonalEdition Classic Build 1114 of 04.11.2005 Mainprogram 6.32.00.51 of 03.11.2005 VDF file 6.32.14.13 (0) of 05.11.2005 Scanning for 244065 virus strains and unwanted programs. Licensed for: AntiVir Personal Edition Serial number: 0000149991-WURGE-0001 Version information: AVWIN.DLL : 6.32.00.51 561192 04.11.2005 07:50:54 AVEWIN32.DLL : 6.32.0.57 954880 14.10.2005 15:08:24 AVGNT.EXE : 6.32.00.02 180327 03.11.2005 17:06:56 AVGUARD.EXE : 6.32.00.12 208424 03.11.2005 17:06:58 GUARDMSG.DLL : 6.30.00.02 94248 01.02.2005 10:24:12 AVGCMSG.DLL : 6.32.00.01 295029 03.11.2005 17:06:58 AVGNTDW.SYS : 6.31.00.01 32896 29.04.2005 08:07:16 AVPACK32.DLL : 6.32.00.02 319528 03.11.2005 16:57:42 AVGETVER.DLL : 6.30.00.00 24576 28.01.2005 17:10:20 AVSHLEXT.DLL : 6.30.00.01 40960 28.01.2005 17:10:22 AVSched32.EXE : 6.32.00.01 110632 20.09.2005 14:16:26 AVSched32.DLL : 6.30.00.00 122880 01.02.2005 10:24:12 AVREG.DLL : 6.31.00.05 41000 07.09.2005 16:34:50 AVRep.DLL : 6.32.00.140 1466408 03.11.2005 14:48:08 INETUPD.EXE : 6.32.00.53 262203 04.11.2005 07:49:30 INETUPD.DLL : 6.32.00.53 143360 04.11.2005 07:49:30 CTL3D32.DLL : 2.31.000 27136 04.09.2002 05:34:00 MFC42.DLL : 6.02.4035.0 1036288 18.02.2004 19:02:28 MSVCRT.DLL : 7.0.2600.2082 (xpsp.040216-1810) MSVCRT.DLL : 7.0.2600.2082 342528 18.02.2004 19:02:34 CTL3DV2.DLL : No information Lastly, I opened the CCleaner cookies-removal program and looked to see if it had generated a record of files removed, but I found none. Two other things: although I downloaded and reinstalled the Sygate Personal firewall, everytime I turn-on the 'puter, I get a message window that says the firewall has encountered a problem and needs to close. There are also a few viruses which my old virus-program (McAfee) picks-up and displays ion the window but when I tell it to clean or delete the files, it is unable to do so. They must be new. I'm going to run my new AV program again tonight (it takes about two hours to do the whole system), and see if it gets them. Quote:
Quote:
I suspected that from the name (wbhelp.com) but didn't want to presume. I'll pop back in here tomorrow. I'd mentioned once before, long ago, that this mall is swarming with beautiful local...ummm...talent, and the scenery alone makes for an interesting excursion,( let alone for the kind assistance you continue to provide). This shop is next to the one I'd used the other time, though, the one with virus-loaded 'puters. This one seems to have a broadband connection because the screens load awfully fast. Talk to you soon. As always, thanx a million. |
||
|
|
|
|
|
#6 | |
|
Admin
Join Date: Dec 2004
Posts: 1,129
|
Very informative post! I love it when people include lots of info to help track things down. Here's what I found in the HJT log:
Quote:
Once you've repaired these items using HJT, please restart the computer, and run a new scan. Post the fresh log here.
__________________
. Quality Web Hosting and Design: Woollybear Web Please keep help and support questions in the public forums. Tech questions submitted by PM will not be answered. |
|
|
|
|
|
|
#7 |
|
Senior Member
Join Date: Jan 2006
Posts: 201
|
Bear, thanx for analyzing my HJT log. However, this morning, my 'puter threw a major tantrum, and would not let me access any files. VERY strange, as yesterday, it was working fine, other than the missing IE connection. I kept being able to log into my account, then nothing opened, even the Task Manager wouldn't work, and I couldn't even access the 'Start' button to turn it off properly. I kept getting virus-message windows that I couldn't shut-down, or acknowedge. I managed (barely) to avoid reaching for the ol' sledgehammer, but I had to keep turning off the power and restarting the damn system, and it remained unresponsive. I even got a (I believe) bogus message telling me my hard-drive was running out of room. No way, unless, turning off the system (by switching off the power-strip everything is plugged into) somehow uses up exponential quantities of temporary memory. Finally, I told the system to boot-up from the CD drive, put my Windows CD in there, and just reinstalled windows on top of the existing version. I then ran another HJT log, and it only showed 9 items, all looking 'valid'.
My 'puter has a 40gb hard-drive partitioned into two, labeled 'C' and 'D' (original, eh? ), and about 520 MB of RAM (the original 256 plus an additional 256 memory-chip). I have always tried to keep the operating system on the 'C' partition and all other files (school documents, music files/programs, downloaded software, etc. ) on the 'D' section. When I reinstalled Windows this morning, I put it back into it's customary place in the 'C' drive. The Windows installer program said it would reformat the partition, and after installation, everything opened OK, including the files on the 'D' section.But, if you would 'bear' with me, some questions: 1. Can viruses and other back-door-type programs 'survive' a reformatting of the drive's partition? 2. Where can I get to the option to boot-up in 'safe-mode'? I was looking this morning, (between shaking my fist and employing every expletive know to modern man) doing the DEL key upon boot-up, and going into 'Advanced BIOS Features', (I think, it may be 'Functions'), where one can select the priority boot-device, etc, but I still couldn't get to the option of booting-up in safe mode. What are the steps? I bothered you with this question once before, but this time I swear I'll note-pad it and save the answer!! 3. In that screen (Advanced BIOS Features) aren't the items labelled HDD-1, HDD-2, etc. the hard-drives? If I installed Windows on the 'C' section of my hard-drive, shouldn't I set the boot-up priority 1 device to the HDD-1? I'm going home soon (I'm at the mall again) to: reinstall MS Office, and try and re-establish the Internet connection again. (Good thing I don't have much hair left, or I'd be tearing out what remained!) If it works, I'll get on later and let you know, and post a fresh HJT log from home. If it doesn't, I'll come back here tomorrow, post the HJT, we can see if everything is indeed kosher, and go from there. I'm especially glad you found why the Sygate Firewall wasn't running correctly. That was driving me nuts. A friend had originally told me about Sygate, and was at my house one night, and downloaded it for me. It worked fine for a while, but after I ran into problems a few months ago,(with a partition-cleaning program), and had to reinstall Windows again, it didn't work correctly after that. He must have disabled the Security Center when he installed the Sygate, and I didn't know that should be done. PS When I reinstalled Windows this morning I DID disable the security center, (I think), even without knowing that it was causing conflict with the Sygate, as I was anticipating reinstalling the Sygate (which I'd saved on the 'D' drive) later today. PPS Ya know, you ol' bruin you, all the beers (or jars of honey) I owe you are REALLY starting to pile up. If you don't get over here and slurp some with me, I just may have to start drinking them myself. PPPS I asked at the old site (while I was too distracted to notice your leaving-notice) for you to send me your RL mailing address again so I could send you a Xmas card. How about e-mailing it to me again, (<< edit >>...I think I forgot my gmail account password) and I'll send you a cool Thailand t-shirt? It's the least I can do. (I could tuck a small donation in the box as well, to help with your den's electric bill!) Again, thanx a million, Bear. ![]() |
|
|
|
|
|
#8 | ||||||||
|
Admin
Join Date: Dec 2004
Posts: 1,129
|
Quote:
Although it's likely coincidental, since you were essentially unprotected after the first infection, you were probably infected with another one. Frightening environment you have there. Quote:
Quote:
Maybe it's the exchange rate to Thailand? Quote:
Quote:
Usually, it's pressing the F8 key repeatedly as the machine is powering up. It can be a little tricky to hit exactly right. Quote:
It's better to make some other drive (CD, Floppy) the first boot device, and let Windows discover the next one on it's own, in most cases. In the absence of user input, it will typically try floppy (if there is one) then HDD at letter C. Quote:
Quote:
I'm removing your email from the post, to keep it from being harvested by spammers. No point helping them, eh? [EDIT] PS: Ironically, you don't have enough posts to use the PM feature here yet, so email it is.
__________________
. Quality Web Hosting and Design: Woollybear Web Please keep help and support questions in the public forums. Tech questions submitted by PM will not be answered. |
||||||||
|
|
|
|
|
#9 | ||||||||||||||||
|
Senior Member
Join Date: Jan 2006
Posts: 201
|
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
Quote:
BTW, I ran another HJT log yesterday after going home and here's what it looks like: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\msiexec.exe D:\Net Software\HiJackThis\HijackThis.exe O2 - BHO: eCATRegistrar Class - {02336F51-24CA-4422-AB63-18841ADF35E6} - C:\Program Files\JI-Net\JI-Net Accelerator\3.52.0105.14\eCATBHO.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: JI-Net Accelerator - {4BC3AC04-3E56-411D-B465-4FEA06654611} - C:\Program Files\JI-Net\JI-Net Accelerator\3.52.0105.14\ThinClientToolbar.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [IAClient] C:\Program Files\JI-Net\JI-Net Accelerator\3.52.0105.14\IACLiM.exe O4 - Global Startup: IDW Logging Tool.lnk = C:\WINDOWS\system32\idwlog.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{6A95C219-DA03-4BCD-B7DD-1415BB553921}: NameServer = 203.147.0.3 203.147.0.2 I still get the message when opening up the system that Sygate has encountered a problem and must close, but when I check the Windows Security center, (where I'd 'told' it that I was using another firewall, and disabled the Windows one) it tells me that the firewall is on, and when I bring up the Sygate icon, it also says it's on. Since I'm still not able to connect to the web, I can't really tell... I remembered once before I solved a problem by going into the Internet options and selecting the 'Advanced' tab, then restoring the default settings. So simple, I should have remembered that and tried it sooner...but sighhhh story of my life... I'll try that later (I'm now at the mall again). Talk to ya soon! As always, thanx, Bear!! ![]() |
||||||||||||||||
|
|
|
|
|
#10 | ||
|
Admin
Join Date: Dec 2004
Posts: 1,129
|
Quote:
When you set up a hard drive for running an operating system (OS), you set that partition as the 'primary' partition, making it 'bootable'. Additional partitions are usually for storage and are called 'logical' partitions, and they don't contain the system files in order to start the system. (there are more than just the ones I mention, but it's complicated enough, no?) It *is* possible to create a second (or more) bootable partition for "dual booting", in case you want to be able to switch between operating systems. To switch from one OS to another typically requires a "bootloader", a program that watches on startup and prompts the user to choose the OS they want. Complicated stuff.
__________________
. Quality Web Hosting and Design: Woollybear Web Please keep help and support questions in the public forums. Tech questions submitted by PM will not be answered. |
||
|
|
|
![]() |
| Thread Tools | |
| Display Modes | |
|
|