View Full Version : Help! Interntet stops in few minutes
roro
June 2nd 04, 11:50 PM
Hi, if anyone can help, i will really appreciate it!
All of a sudden my internet explorer stops working after
about 10 minutes. The internet connection is there, like
the messenger programs, downloads, etc. are all normal. I
will be able to access websites for about 10 minutes, and
slowly, the graphics will not appear, then in the end, it
will give the "page cannot be displayed" notice. But the
weird thing is that the INTERNET CONNECTION IS THERE.
Anyone else had this problem? Please help! Thank you!
Noel Paton
June 3rd 04, 07:14 AM
You may have a virus/spyware hijack
download the Stinger from here and run it to make sure that A-V-disabling
viruses are not present on your PC
http://download.nai.com/products/mcafee-avert/stinger.exe
- update your virus scanner and run a full system scan of all files.
Reboot to Safe Mode and run CWShredder - to remove variants of the
CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html
Use CWShredder, the removal tool:
http://www.merijn.org/files/cwshredder.zip
http://www.merijn.org/files/CWShredder.exe
http://www.spywareinfo.com/downloads/tools/CWShredder.exe
http://www.zerosrealm.com/downloads/CWShredder.zip
download AdAware from www.lavasoftusa.com, install, update, and run it to
remove spyware, adware,
and other such nasties from your system.
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"roro" > wrote in message
...
> Hi, if anyone can help, i will really appreciate it!
>
> All of a sudden my internet explorer stops working after
> about 10 minutes. The internet connection is there, like
> the messenger programs, downloads, etc. are all normal. I
> will be able to access websites for about 10 minutes, and
> slowly, the graphics will not appear, then in the end, it
> will give the "page cannot be displayed" notice. But the
> weird thing is that the INTERNET CONNECTION IS THERE.
> Anyone else had this problem? Please help! Thank you!
Noel,
I've had that problem as well, and have tried your sites
but how can I update it if I cant get into Exploer? It
won't update for me. Have you any suggestions? It says it
found stuff but to remove it I need to register but I
can't do that as I can't get into Explorer??
Regards
Sue
>-----Original Message-----
>You may have a virus/spyware hijack
>
>download the Stinger from here and run it to make sure
that A-V-disabling
>viruses are not present on your PC
>http://download.nai.com/products/mcafee-avert/stinger.exe
>
>- update your virus scanner and run a full system scan of
all files.
>
>Reboot to Safe Mode and run CWShredder - to remove
variants of the
>CoolWebSearch hijacker.
>http://www.merijn.org/cwschronicles.html
>
>Use CWShredder, the removal tool:
>http://www.merijn.org/files/cwshredder.zip
>http://www.merijn.org/files/CWShredder.exe
>http://www.spywareinfo.com/downloads/tools/CWShredder.exe
>http://www.zerosrealm.com/downloads/CWShredder.zip
>
>download AdAware from www.lavasoftusa.com, install,
update, and run it to
>remove spyware, adware,
>and other such nasties from your system.
>
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>"roro" > wrote in
message
...
>> Hi, if anyone can help, i will really appreciate it!
>>
>> All of a sudden my internet explorer stops working after
>> about 10 minutes. The internet connection is there, like
>> the messenger programs, downloads, etc. are all normal.
I
>> will be able to access websites for about 10 minutes,
and
>> slowly, the graphics will not appear, then in the end,
it
>> will give the "page cannot be displayed" notice. But the
>> weird thing is that the INTERNET CONNECTION IS THERE.
>> Anyone else had this problem? Please help! Thank you!
>
>
>.
>
Rick T
June 4th 04, 07:23 PM
Sue wrote:
> Noel,
>
> I've had that problem as well, and have tried your sites
> but how can I update it if I cant get into Exploer? It
> won't update for me. Have you any suggestions? It says it
> found stuff but to remove it I need to register but I
> can't do that as I can't get into Explorer??
Hi, Susan...
What program is telling you to register beforehand? I'd suggest using
another one.
Since you are posting from the Microsoft web-interface to these groups,
you do have Internet Explorer handy somewhere. Can you download the
programs that *Noel* suggested on the computer you're on now, burn them
onto a CD then transfer them over to the ailing computer ?
Or have I missed something...?
Rick
>
> Regards
>
> Sue
>
>
>>-----Original Message-----
>>You may have a virus/spyware hijack
>>
>>download the Stinger from here and run it to make sure
>
> that A-V-disabling
>
>>viruses are not present on your PC
>>http://download.nai.com/products/mcafee-avert/stinger.exe
>>
>>- update your virus scanner and run a full system scan of
>
> all files.
>
>>Reboot to Safe Mode and run CWShredder - to remove
>
> variants of the
>
>>CoolWebSearch hijacker.
>>http://www.merijn.org/cwschronicles.html
>>
>>Use CWShredder, the removal tool:
>>http://www.merijn.org/files/cwshredder.zip
>>http://www.merijn.org/files/CWShredder.exe
>>http://www.spywareinfo.com/downloads/tools/CWShredder.exe
>>http://www.zerosrealm.com/downloads/CWShredder.zip
>>
>>download AdAware from www.lavasoftusa.com, install,
>
> update, and run it to
>
>>remove spyware, adware,
>>and other such nasties from your system.
>>
>>
>>--
>>Noel Paton (MS-MVP 2002-2004, Win9x)
>>
>>Nil Carborundum Illegitemi
>>http://www.btinternet.com/~winnoel/millsrpch.htm
>>
>>Please read http://dts-l.org/goodpost.htm on how to post
>
> messages to NG's
>
>>or
>>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>
> 27pmvp.asp
>
>>"roro" > wrote in
>
> message
>
...
>>
>>>Hi, if anyone can help, i will really appreciate it!
>>>
>>>All of a sudden my internet explorer stops working after
>>>about 10 minutes. The internet connection is there, like
>>>the messenger programs, downloads, etc. are all normal.
>
> I
>
>>>will be able to access websites for about 10 minutes,
>
> and
>
>>>slowly, the graphics will not appear, then in the end,
>
> it
>
>>>will give the "page cannot be displayed" notice. But the
>>>weird thing is that the INTERNET CONNECTION IS THERE.
>>>Anyone else had this problem? Please help! Thank you!
>>
>>
>>.
>>
Noel Paton
June 4th 04, 07:54 PM
Thanks, Rick!
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Rick T" > wrote in message
...
> Sue wrote:
>
> > Noel,
> >
> > I've had that problem as well, and have tried your sites
> > but how can I update it if I cant get into Exploer? It
> > won't update for me. Have you any suggestions? It says it
> > found stuff but to remove it I need to register but I
> > can't do that as I can't get into Explorer??
>
> Hi, Susan...
>
> What program is telling you to register beforehand? I'd suggest using
> another one.
>
> Since you are posting from the Microsoft web-interface to these groups,
> you do have Internet Explorer handy somewhere. Can you download the
> programs that *Noel* suggested on the computer you're on now, burn them
> onto a CD then transfer them over to the ailing computer ?
>
> Or have I missed something...?
>
>
> Rick
>
>
> >
> > Regards
> >
When I run Spyware Cop it says that it finds stuff but to
remove them I have to register and I cannot as IE doesnt
work for me. I have the same problem with Shreddar, it
says it found stuff but to remove them I must update and
when I try to it says error connecting when trying to
update. I have tried this several times and I have gotten
the same thing every time. Any suggestions for me??
>-----Original Message-----
>Thanks, Rick!
>
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>"Rick T" > wrote in message
...
>> Sue wrote:
>>
>> > Noel,
>> >
>> > I've had that problem as well, and have tried your
sites
>> > but how can I update it if I cant get into Exploer? It
>> > won't update for me. Have you any suggestions? It
says it
>> > found stuff but to remove it I need to register but I
>> > can't do that as I can't get into Explorer??
>>
>> Hi, Susan...
>>
>> What program is telling you to register beforehand? I'd
suggest using
>> another one.
>>
>> Since you are posting from the Microsoft web-interface
to these groups,
>> you do have Internet Explorer handy somewhere. Can you
download the
>> programs that *Noel* suggested on the computer you're
on now, burn them
>> onto a CD then transfer them over to the ailing
computer ?
>>
>> Or have I missed something...?
>>
>>
>> Rick
>>
>>
>> >
>> > Regards
>> >
>
>
>.
>
Noel Paton
June 9th 04, 06:27 PM
Sue
Run CWShredder in Safe Mode
you can run it straight off a floppy disk created on another machine - no
need to update if it's less than a week old.
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Sue" > wrote in message
...
> When I run Spyware Cop it says that it finds stuff but to
> remove them I have to register and I cannot as IE doesnt
> work for me. I have the same problem with Shreddar, it
> says it found stuff but to remove them I must update and
> when I try to it says error connecting when trying to
> update. I have tried this several times and I have gotten
> the same thing every time. Any suggestions for me??
> >-----Original Message-----
> >Thanks, Rick!
> >
> >
> >--
> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> >Nil Carborundum Illegitemi
> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> >Please read http://dts-l.org/goodpost.htm on how to post
> messages to NG's
> >or
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> 27pmvp.asp
> >"Rick T" > wrote in message
> ...
> >> Sue wrote:
> >>
> >> > Noel,
> >> >
> >> > I've had that problem as well, and have tried your
> sites
> >> > but how can I update it if I cant get into Exploer? It
> >> > won't update for me. Have you any suggestions? It
> says it
> >> > found stuff but to remove it I need to register but I
> >> > can't do that as I can't get into Explorer??
> >>
> >> Hi, Susan...
> >>
> >> What program is telling you to register beforehand? I'd
> suggest using
> >> another one.
> >>
> >> Since you are posting from the Microsoft web-interface
> to these groups,
> >> you do have Internet Explorer handy somewhere. Can you
> download the
> >> programs that *Noel* suggested on the computer you're
> on now, burn them
> >> onto a CD then transfer them over to the ailing
> computer ?
> >>
> >> Or have I missed something...?
> >>
> >>
> >> Rick
> >>
> >>
> >> >
> >> > Regards
> >> >
> >
> >
> >.
> >
Sue
June 10th 04, 08:28 PM
Hi!
I ran Shreddar again, not in safe mode though as I dont
know how! After running it it said my computer was clean.
So I ran SypBeware which found 18 infected and then to
remove them I have to register which once again I cant as
I dont have IE working! Incidently how much does it cost
to register? I have a log from HiJack this, is that any
good?!. I am on the verge of reinstalling my OS as Ive
spent the past three weeks trying to sort this out and Im
getting nowhere!
Regards
Sue
>-----Original Message-----
>Sue
>Run CWShredder in Safe Mode
>you can run it straight off a floppy disk created on
another machine - no
>need to update if it's less than a week old.
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>"Sue" > wrote in
message
...
>> When I run Spyware Cop it says that it finds stuff but
to
>> remove them I have to register and I cannot as IE doesnt
>> work for me. I have the same problem with Shreddar, it
>> says it found stuff but to remove them I must update and
>> when I try to it says error connecting when trying to
>> update. I have tried this several times and I have
gotten
>> the same thing every time. Any suggestions for me??
>> >-----Original Message-----
>> >Thanks, Rick!
>> >
>> >
>> >--
>> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >
>> >Nil Carborundum Illegitemi
>> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >
>> >Please read http://dts-l.org/goodpost.htm on how to
post
>> messages to NG's
>> >or
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> 27pmvp.asp
>> >"Rick T" > wrote in message
>> ...
>> >> Sue wrote:
>> >>
>> >> > Noel,
>> >> >
>> >> > I've had that problem as well, and have tried your
>> sites
>> >> > but how can I update it if I cant get into
Exploer? It
>> >> > won't update for me. Have you any suggestions? It
>> says it
>> >> > found stuff but to remove it I need to register
but I
>> >> > can't do that as I can't get into Explorer??
>> >>
>> >> Hi, Susan...
>> >>
>> >> What program is telling you to register beforehand?
I'd
>> suggest using
>> >> another one.
>> >>
>> >> Since you are posting from the Microsoft web-
interface
>> to these groups,
>> >> you do have Internet Explorer handy somewhere. Can
you
>> download the
>> >> programs that *Noel* suggested on the computer you're
>> on now, burn them
>> >> onto a CD then transfer them over to the ailing
>> computer ?
>> >>
>> >> Or have I missed something...?
>> >>
>> >>
>> >> Rick
>> >>
>> >>
>> >> >
>> >> > Regards
>> >> >
>> >
>> >
>> >.
>> >
>
>
>.
>
Noel Paton
June 10th 04, 10:22 PM
I really do recommend that you UNINSTALL SpyBeware - it's not a well-known
product, and if you have to pay for it, it's probably not worth the money!!
Use Ad-Aware instead - www.lavasoftusa.com (download it on another PC - it's
around 6MB - copy to a CD, and install to your PC)
It's free, has a very good reputation, and you can remove anything it finds,
safely!
By all means, post your HiJackThis log here - I'm no expert, but there are
others who are, and they read these groups.
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Sue" > wrote in message
...
> Hi!
> I ran Shreddar again, not in safe mode though as I dont
> know how! After running it it said my computer was clean.
> So I ran SypBeware which found 18 infected and then to
> remove them I have to register which once again I cant as
> I dont have IE working! Incidently how much does it cost
> to register? I have a log from HiJack this, is that any
> good?!. I am on the verge of reinstalling my OS as Ive
> spent the past three weeks trying to sort this out and Im
> getting nowhere!
> Regards
> Sue
> >-----Original Message-----
> >Sue
> >Run CWShredder in Safe Mode
> >you can run it straight off a floppy disk created on
> another machine - no
> >need to update if it's less than a week old.
> >
> >--
> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> >Nil Carborundum Illegitemi
> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> >Please read http://dts-l.org/goodpost.htm on how to post
> messages to NG's
> >or
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> 27pmvp.asp
> >"Sue" > wrote in
> message
> ...
> >> When I run Spyware Cop it says that it finds stuff but
> to
> >> remove them I have to register and I cannot as IE doesnt
> >> work for me. I have the same problem with Shreddar, it
> >> says it found stuff but to remove them I must update and
> >> when I try to it says error connecting when trying to
> >> update. I have tried this several times and I have
> gotten
> >> the same thing every time. Any suggestions for me??
> >> >-----Original Message-----
> >> >Thanks, Rick!
> >> >
> >> >
> >> >--
> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
> >> >
> >> >Nil Carborundum Illegitemi
> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
> >> >
> >> >Please read http://dts-l.org/goodpost.htm on how to
> post
> >> messages to NG's
> >> >or
> >>
> >http://www.microsoft.com/presspass/features/2001/Mar01/Mar
> >> 27pmvp.asp
> >> >"Rick T" > wrote in message
> >> ...
> >> >> Sue wrote:
> >> >>
> >> >> > Noel,
> >> >> >
> >> >> > I've had that problem as well, and have tried your
> >> sites
> >> >> > but how can I update it if I cant get into
> Exploer? It
> >> >> > won't update for me. Have you any suggestions? It
> >> says it
> >> >> > found stuff but to remove it I need to register
> but I
> >> >> > can't do that as I can't get into Explorer??
> >> >>
> >> >> Hi, Susan...
> >> >>
> >> >> What program is telling you to register beforehand?
> I'd
> >> suggest using
> >> >> another one.
> >> >>
> >> >> Since you are posting from the Microsoft web-
> interface
> >> to these groups,
> >> >> you do have Internet Explorer handy somewhere. Can
> you
> >> download the
> >> >> programs that *Noel* suggested on the computer you're
> >> on now, burn them
> >> >> onto a CD then transfer them over to the ailing
> >> computer ?
> >> >>
> >> >> Or have I missed something...?
> >> >>
> >> >>
> >> >> Rick
> >> >>
> >> >>
> >> >> >
> >> >> > Regards
> >> >> >
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >
Sue
June 11th 04, 06:42 PM
Hi Again!
So I uninstalled SpyBeware as you recommended.
Now, I ran ad-aware and it came back squeeky clean! I ran
Shreddar the other night and it came back clean. So I ran
SpyCop tonight and it came back with bugs but to remove
them I have to register and that I cannot do because of
IE. I tried updating it before I scanned but it
says "error connecting to SpyCop server".
So will I just reinstall the OS and stop bugging you or
have a another solution??!!!
A VERY frustrated Irish Gal!
Sue
>-----Original Message-----
>I really do recommend that you UNINSTALL SpyBeware - it's
not a well-known
>product, and if you have to pay for it, it's probably not
worth the money!!
>
>Use Ad-Aware instead - www.lavasoftusa.com (download it
on another PC - it's
>around 6MB - copy to a CD, and install to your PC)
>It's free, has a very good reputation, and you can remove
anything it finds,
>safely!
>
>By all means, post your HiJackThis log here - I'm no
expert, but there are
>others who are, and they read these groups.
>
>
>--
>Noel Paton (MS-MVP 2002-2004, Win9x)
>
>Nil Carborundum Illegitemi
>http://www.btinternet.com/~winnoel/millsrpch.htm
>
>Please read http://dts-l.org/goodpost.htm on how to post
messages to NG's
>or
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
27pmvp.asp
>"Sue" > wrote in
message
...
>> Hi!
>> I ran Shreddar again, not in safe mode though as I dont
>> know how! After running it it said my computer was
clean.
>> So I ran SypBeware which found 18 infected and then to
>> remove them I have to register which once again I cant
as
>> I dont have IE working! Incidently how much does it cost
>> to register? I have a log from HiJack this, is that any
>> good?!. I am on the verge of reinstalling my OS as Ive
>> spent the past three weeks trying to sort this out and
Im
>> getting nowhere!
>> Regards
>> Sue
>> >-----Original Message-----
>> >Sue
>> >Run CWShredder in Safe Mode
>> >you can run it straight off a floppy disk created on
>> another machine - no
>> >need to update if it's less than a week old.
>> >
>> >--
>> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >
>> >Nil Carborundum Illegitemi
>> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >
>> >Please read http://dts-l.org/goodpost.htm on how to
post
>> messages to NG's
>> >or
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> 27pmvp.asp
>> >"Sue" > wrote in
>> message
>> ...
>> >> When I run Spyware Cop it says that it finds stuff
but
>> to
>> >> remove them I have to register and I cannot as IE
doesnt
>> >> work for me. I have the same problem with Shreddar,
it
>> >> says it found stuff but to remove them I must update
and
>> >> when I try to it says error connecting when trying to
>> >> update. I have tried this several times and I have
>> gotten
>> >> the same thing every time. Any suggestions for me??
>> >> >-----Original Message-----
>> >> >Thanks, Rick!
>> >> >
>> >> >
>> >> >--
>> >> >Noel Paton (MS-MVP 2002-2004, Win9x)
>> >> >
>> >> >Nil Carborundum Illegitemi
>> >> >http://www.btinternet.com/~winnoel/millsrpch.htm
>> >> >
>> >> >Please read http://dts-l.org/goodpost.htm on how to
>> post
>> >> messages to NG's
>> >> >or
>> >>
>>
>http://www.microsoft.com/presspass/features/2001/Mar01/Mar
>> >> 27pmvp.asp
>> >> >"Rick T" > wrote in
message
>> >> ...
>> >> >> Sue wrote:
>> >> >>
>> >> >> > Noel,
>> >> >> >
>> >> >> > I've had that problem as well, and have tried
your
>> >> sites
>> >> >> > but how can I update it if I cant get into
>> Exploer? It
>> >> >> > won't update for me. Have you any suggestions?
It
>> >> says it
>> >> >> > found stuff but to remove it I need to register
>> but I
>> >> >> > can't do that as I can't get into Explorer??
>> >> >>
>> >> >> Hi, Susan...
>> >> >>
>> >> >> What program is telling you to register
beforehand?
>> I'd
>> >> suggest using
>> >> >> another one.
>> >> >>
>> >> >> Since you are posting from the Microsoft web-
>> interface
>> >> to these groups,
>> >> >> you do have Internet Explorer handy somewhere. Can
>> you
>> >> download the
>> >> >> programs that *Noel* suggested on the computer
you're
>> >> on now, burn them
>> >> >> onto a CD then transfer them over to the ailing
>> >> computer ?
>> >> >>
>> >> >> Or have I missed something...?
>> >> >>
>> >> >>
>> >> >> Rick
>> >> >>
>> >> >>
>> >> >> >
>> >> >> > Regards
>> >> >> >
>> >> >
>> >> >
>> >> >.
>> >> >
>> >
>> >
>> >.
>> >
>
>
>.
>
Sue
June 11th 04, 06:45 PM
Oh and here is that log file I mentioned earlier! I think
I'm meant to put that on the HiJackThis website, but I've
not had the time to do that but I will do it...
sometime... these damn 56k modem connections... they're
soooo slow!!
Logfile of HijackThis v1.97.7
Scan saved at 20:15:13, on 10/06/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\SSDPSRV.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\ADAPTEC
SHARED\CREATECD\CREATECD50.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5
\DIRECTCD\DIRECTCD.EXE
C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\TRAYMON.EXE
C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-
LC\SYMLCSVC.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
SHARED\WKCALREM.EXE
C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER
SOFTWARE\PTS.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TEMP\TD_0005.DIR\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page = http://home.iol.ie
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL = http://home.iol.ie
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
Page = http://home.iol.ie
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL = http://home.iol.ie
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings,ProxyServer = proxy.iolfree.ie:8080
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0
\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-
298DDF1699E1} - C:\Program Files\Common Files\Symantec
Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-
FADC6B084872} - C:\Program Files\Norton Internet
Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-
A37C9A5676A7} - C:\Program Files\Common Files\Symantec
Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
7859DF00B1D6} - C:\Program Files\Norton Internet
Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-
00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry]
C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth]
C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common
Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program
Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program
Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft
Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program
Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection]
C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32
\Drivers\dcfssvc.exe
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program
Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
start
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton
Internet Security\UrlLstCk.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [SSDPSRV]
C:\WINDOWS\SYSTEM\ssdpsrv.exe
O4 - HKLM\..\RunServices: [*StateMgr]
C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor]
C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program
Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program
Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program
Files\Common Files\Symantec Shared\Script
Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1
\SYMANT~1\CCPROXY.EXE
O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1
\SYMANT~1\SNDSRVC.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: MICROSOFT WORKS CALENDAR REMINDERS.LNK =
C:\Program Files\Common Files\Microsoft Shared\Works
Shared\wkcalrem.exe
O4 - Startup: KODAK PICTURE TRANSFER SOFTWARE.LNK =
C:\Program Files\Kodak\KODAK Picture Transfer
Software\pts.exe
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Researcher (HKLM)
O9 - Extra button: Dell Home (HKCU)
O9 - Extra button: Mail (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1
\Plugins\NPDocBox.dll
O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1
\PLUGINS\npqtplugin.dll
O14 - IERESET.INF: START_PAGE_URL=http://kk-
intranet/sharepoint/
O15 - Trusted Zone: http://*.kk-intranet
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
(Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swf
lash.cab
O16 - DPF: Ulster Bank AnyTime -
https://anytime1.ulsterbank.com/asp/AnyTime.cab
Rick T
June 11th 04, 06:58 PM
Sue wrote:
> Hi Again!
> So I uninstalled SpyBeware as you recommended.
> Now, I ran ad-aware and it came back squeeky clean! I ran
> Shreddar the other night and it came back clean. So I ran
> SpyCop tonight and it came back with bugs but to remove
> them I have to register and that I cannot do because of
> IE. I tried updating it before I scanned but it
> says "error connecting to SpyCop server".
> So will I just reinstall the OS and stop bugging you or
> have a another solution??!!!
> A VERY frustrated Irish Gal!
> Sue
Since I don't like to type any more than I have to, I'm going to
cut'n'paste from a reply I made to another poster, who was also
wondering about a product which required "registration" ($$$)...
Rick
--------------------------------------------------------------------
webster72n wrote:
> Now that I did it, I am going to give the results to you, Rick; there
were:
> 3 errors Missing DLL/OCX/COMClasses w. 'High' priority.
No idea... probably ghosts of some of the pests you rid yourself of a
couple weeks ago; low priority. If it turns out to be something you
need, it'll let you know when you try to run it.
> 5 errors Missing Shortcut or Invalid Path Medium
stuff you've uninstalled which hasn't completely, or things you've
deleted, or have fallen off your WMP/etc. MostRecentUsed Files... *no*
priority would be a little more accurate.
> 1 error Connected Drives Missing Low
sorta weird but if there's nothing wrong, <shrug>... perhaps a USB drive
or the CDR/DVD part of the CD drive, maybe a virtual network drive.
>
> What I don't understand is, why any of the other applications didn't
detect
> those things.
> Maybe they are not that important, but three ot them are supposed to
be of
> high priority.
If you aren't getting any errors, I certainly wouldn't worry about any
of them; looks like standard system hiccups.
> What is your take on that?
A half decent registry-cleaner will get rid of most if not all the
problem listings. Couple largeish threads on that a few weeks ago.
Noel Paton
June 11th 04, 08:18 PM
You're not the only one who has to live with 56K connection - so do I!
You never mentioned that you were running a firewall! - turn NIS off and see
if that helps!!
Looking down the list, the following items strike me as 'unusual'
Running Processes
C:\WINDOWS\SYSTEM\RPCSS.EXE
- see http://cexx.org/rpc.htm
BHO's, etc
O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
This is UPnP - not related to Windows Plug and Play, it's very unlikely that
you need it, and it should be uninstalled from Add/Remove Programs|Windows
Setup|Communications|Universal Plug and Play
It looks as if you have Norton set to scan your email - don't bother!!
Norton is bad enough on its own, without the additional overhead and bugs
involved in their email scanner.
O14 - IERESET.INF: START_PAGE_URL=http://kk-
> intranet/sharepoint/
> O15 - Trusted Zone: http://*.kk-intranet
are you aware of the fact that you have the above as a trusted site?? - in
theory, it shouldn't be necessary, if it's on an intranet. The only
references I can find to such a site are in German and relate to warez
sites - always a source of infections of all kinds!
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Sue" > wrote in message
...
> Oh and here is that log file I mentioned earlier! I think
> I'm meant to put that on the HiJackThis website, but I've
> not had the time to do that but I will do it...
> sometime... these damn 56k modem connections... they're
> soooo slow!!
>
> Logfile of HijackThis v1.97.7
> Scan saved at 20:15:13, on 10/06/2004
> Platform: Windows ME (Win9x 4.90.3000)
> MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
>
> Running processes:
> C:\WINDOWS\SYSTEM\KERNEL32.DLL
> C:\WINDOWS\SYSTEM\MSGSRV32.EXE
> C:\WINDOWS\SYSTEM\mmtask.tsk
> C:\WINDOWS\SYSTEM\MPREXE.EXE
> C:\WINDOWS\SYSTEM\MSTASK.EXE
> C:\WINDOWS\SYSTEM\SSDPSRV.EXE
> C:\WINDOWS\SYSTEM\STIMON.EXE
> C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
> C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
> C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
> C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
> C:\WINDOWS\EXPLORER.EXE
> C:\WINDOWS\TASKMON.EXE
> C:\WINDOWS\SYSTEM\SYSTRAY.EXE
> C:\PROGRAM FILES\COMMON FILES\ADAPTEC
> SHARED\CREATECD\CREATECD50.EXE
> C:\WINDOWS\SYSTEM\WMIEXE.EXE
> C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
> C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5
> \DIRECTCD\DIRECTCD.EXE
> C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
> C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
> C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
> C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\TRAYMON.EXE
> C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
> C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
> C:\WINDOWS\SYSTEM\LEXBCES.EXE
> C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-
> LC\SYMLCSVC.EXE
> C:\WINDOWS\SYSTEM\RPCSS.EXE
> C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
> SHARED\WKCALREM.EXE
> C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER
> SOFTWARE\PTS.EXE
> C:\WINDOWS\SYSTEM\LEXPPS.EXE
> C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
> C:\WINDOWS\SYSTEM\RNAAPP.EXE
> C:\WINDOWS\SYSTEM\TAPISRV.EXE
> C:\WINDOWS\TEMP\TD_0005.DIR\HIJACKTHIS.EXE
>
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
> Page = http://home.iol.ie
> R1 - HKCU\Software\Microsoft\Internet
> Explorer\Main,Default_Page_URL = http://home.iol.ie
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
> Page = http://home.iol.ie
> R1 - HKLM\Software\Microsoft\Internet
> Explorer\Main,Default_Page_URL = http://home.iol.ie
> R1 -
> HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
> Settings,ProxyServer = proxy.iolfree.ie:8080
> O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
> 784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0
> \READER\ACTIVEX\ACROIEHELPER.OCX
> O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-
> 298DDF1699E1} - C:\Program Files\Common Files\Symantec
> Shared\AdBlocking\NISShExt.dll
> O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-
> FADC6B084872} - C:\Program Files\Norton Internet
> Security\Norton AntiVirus\NavShExt.dll
> O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-
> A37C9A5676A7} - C:\Program Files\Common Files\Symantec
> Shared\AdBlocking\NISShExt.dll
> O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
> 7859DF00B1D6} - C:\Program Files\Norton Internet
> Security\Norton AntiVirus\NavShExt.dll
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-
> 00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
> O4 - HKLM\..\Run: [ScanRegistry]
> C:\WINDOWS\scanregw.exe /autorun
> O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
> O4 - HKLM\..\Run: [PCHealth]
> C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
> O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
> O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
> powrprof.dll,LoadCurrentPwrScheme
> O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common
> Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
> O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program
> Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
> O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program
> Files\Netropa\Multimedia Keyboard\MMKeybd.exe
> O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft
> Works\wkfud.exe
> O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program
> Files\Microsoft Works\WksSb.exe /AllUsers
> O4 - HKLM\..\Run: [Microsoft Works Update Detection]
> C:\Program Files\Microsoft Works\WkDetect.exe
> O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32
> \Drivers\dcfssvc.exe
> O4 - HKLM\..\Run: [LexStart] Lexstart.exe
> O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
> Files\Symantec Shared\ccApp.exe"
> O4 - HKLM\..\Run: [Symantec Core LC] C:\Program
> Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
> start
> O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton
> Internet Security\UrlLstCk.exe
> O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
> powrprof.dll,LoadCurrentPwrScheme
> O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
> O4 - HKLM\..\RunServices: [SSDPSRV]
> C:\WINDOWS\SYSTEM\ssdpsrv.exe
> O4 - HKLM\..\RunServices: [*StateMgr]
> C:\WINDOWS\System\Restore\StateMgr.exe
> O4 - HKLM\..\RunServices: [StillImageMonitor]
> C:\WINDOWS\SYSTEM\STIMON.EXE
> O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program
> Files\Common Files\Symantec Shared\ccEvtMgr.exe"
> O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program
> Files\Common Files\Symantec Shared\ccSetMgr.exe"
> O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program
> Files\Common Files\Symantec Shared\Script
> Blocking\SBServ.exe" -reg
> O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1
> \SYMANT~1\CCPROXY.EXE
> O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1
> \SYMANT~1\SNDSRVC.EXE
> O4 - Startup: Microsoft Office.lnk = C:\Program
> Files\Microsoft Office\Office\OSA9.EXE
> O4 - Startup: MICROSOFT WORKS CALENDAR REMINDERS.LNK =
> C:\Program Files\Common Files\Microsoft Shared\Works
> Shared\wkcalrem.exe
> O4 - Startup: KODAK PICTURE TRANSFER SOFTWARE.LNK =
> C:\Program Files\Kodak\KODAK Picture Transfer
> Software\pts.exe
> O9 - Extra button: Messenger (HKLM)
> O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
> O9 - Extra button: Researcher (HKLM)
> O9 - Extra button: Dell Home (HKCU)
> O9 - Extra button: Mail (HKCU)
> O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1
> \Plugins\NPDocBox.dll
> O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1
> \PLUGINS\npqtplugin.dll
> O14 - IERESET.INF: START_PAGE_URL=http://kk-
> intranet/sharepoint/
> O15 - Trusted Zone: http://*.kk-intranet
> O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
> (Shockwave Flash Object) -
> http://download.macromedia.com/pub/shockwave/cabs/flash/swf
> lash.cab
> O16 - DPF: Ulster Bank AnyTime -
> https://anytime1.ulsterbank.com/asp/AnyTime.cab
>
>
Shane
June 12th 04, 03:54 PM
Can't you get Tiscali/Wanadoo ADSL there, Noel?
Shane
"Noel Paton" > wrote in message
...
> You're not the only one who has to live with 56K connection - so do I!
>
> You never mentioned that you were running a firewall! - turn NIS off and
see
> if that helps!!
>
> Looking down the list, the following items strike me as 'unusual'
>
> Running Processes
> C:\WINDOWS\SYSTEM\RPCSS.EXE
> - see http://cexx.org/rpc.htm
>
> BHO's, etc
> O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
> This is UPnP - not related to Windows Plug and Play, it's very unlikely
that
> you need it, and it should be uninstalled from Add/Remove Programs|Windows
> Setup|Communications|Universal Plug and Play
>
> It looks as if you have Norton set to scan your email - don't bother!!
> Norton is bad enough on its own, without the additional overhead and bugs
> involved in their email scanner.
>
> O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > intranet/sharepoint/
> > O15 - Trusted Zone: http://*.kk-intranet
> are you aware of the fact that you have the above as a trusted site?? - in
> theory, it shouldn't be necessary, if it's on an intranet. The only
> references I can find to such a site are in German and relate to warez
> sites - always a source of infections of all kinds!
>
>
>
>
> --
> Noel Paton (MS-MVP 2002-2004, Win9x)
>
> Nil Carborundum Illegitemi
> http://www.btinternet.com/~winnoel/millsrpch.htm
>
> Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
> or
> http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> "Sue" > wrote in message
> ...
> > Oh and here is that log file I mentioned earlier! I think
> > I'm meant to put that on the HiJackThis website, but I've
> > not had the time to do that but I will do it...
> > sometime... these damn 56k modem connections... they're
> > soooo slow!!
> >
> > Logfile of HijackThis v1.97.7
> > Scan saved at 20:15:13, on 10/06/2004
> > Platform: Windows ME (Win9x 4.90.3000)
> > MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> >
> > Running processes:
> > C:\WINDOWS\SYSTEM\KERNEL32.DLL
> > C:\WINDOWS\SYSTEM\MSGSRV32.EXE
> > C:\WINDOWS\SYSTEM\mmtask.tsk
> > C:\WINDOWS\SYSTEM\MPREXE.EXE
> > C:\WINDOWS\SYSTEM\MSTASK.EXE
> > C:\WINDOWS\SYSTEM\SSDPSRV.EXE
> > C:\WINDOWS\SYSTEM\STIMON.EXE
> > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
> > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
> > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
> > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
> > C:\WINDOWS\EXPLORER.EXE
> > C:\WINDOWS\TASKMON.EXE
> > C:\WINDOWS\SYSTEM\SYSTRAY.EXE
> > C:\PROGRAM FILES\COMMON FILES\ADAPTEC
> > SHARED\CREATECD\CREATECD50.EXE
> > C:\WINDOWS\SYSTEM\WMIEXE.EXE
> > C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
> > C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5
> > \DIRECTCD\DIRECTCD.EXE
> > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
> > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
> > C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
> > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\TRAYMON.EXE
> > C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
> > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
> > C:\WINDOWS\SYSTEM\LEXBCES.EXE
> > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-
> > LC\SYMLCSVC.EXE
> > C:\WINDOWS\SYSTEM\RPCSS.EXE
> > C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
> > SHARED\WKCALREM.EXE
> > C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER
> > SOFTWARE\PTS.EXE
> > C:\WINDOWS\SYSTEM\LEXPPS.EXE
> > C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
> > C:\WINDOWS\SYSTEM\RNAAPP.EXE
> > C:\WINDOWS\SYSTEM\TAPISRV.EXE
> > C:\WINDOWS\TEMP\TD_0005.DIR\HIJACKTHIS.EXE
> >
> > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
> > Page = http://home.iol.ie
> > R1 - HKCU\Software\Microsoft\Internet
> > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
> > Page = http://home.iol.ie
> > R1 - HKLM\Software\Microsoft\Internet
> > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > R1 -
> > HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
> > Settings,ProxyServer = proxy.iolfree.ie:8080
> > O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
> > 784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0
> > \READER\ACTIVEX\ACROIEHELPER.OCX
> > O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-
> > 298DDF1699E1} - C:\Program Files\Common Files\Symantec
> > Shared\AdBlocking\NISShExt.dll
> > O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-
> > FADC6B084872} - C:\Program Files\Norton Internet
> > Security\Norton AntiVirus\NavShExt.dll
> > O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-
> > A37C9A5676A7} - C:\Program Files\Common Files\Symantec
> > Shared\AdBlocking\NISShExt.dll
> > O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
> > 7859DF00B1D6} - C:\Program Files\Norton Internet
> > Security\Norton AntiVirus\NavShExt.dll
> > O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-
> > 00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
> > O4 - HKLM\..\Run: [ScanRegistry]
> > C:\WINDOWS\scanregw.exe /autorun
> > O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
> > O4 - HKLM\..\Run: [PCHealth]
> > C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
> > O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
> > O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
> > powrprof.dll,LoadCurrentPwrScheme
> > O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common
> > Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
> > O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program
> > Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
> > O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program
> > Files\Netropa\Multimedia Keyboard\MMKeybd.exe
> > O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft
> > Works\wkfud.exe
> > O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program
> > Files\Microsoft Works\WksSb.exe /AllUsers
> > O4 - HKLM\..\Run: [Microsoft Works Update Detection]
> > C:\Program Files\Microsoft Works\WkDetect.exe
> > O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32
> > \Drivers\dcfssvc.exe
> > O4 - HKLM\..\Run: [LexStart] Lexstart.exe
> > O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
> > Files\Symantec Shared\ccApp.exe"
> > O4 - HKLM\..\Run: [Symantec Core LC] C:\Program
> > Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
> > start
> > O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton
> > Internet Security\UrlLstCk.exe
> > O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
> > powrprof.dll,LoadCurrentPwrScheme
> > O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
> > O4 - HKLM\..\RunServices: [SSDPSRV]
> > C:\WINDOWS\SYSTEM\ssdpsrv.exe
> > O4 - HKLM\..\RunServices: [*StateMgr]
> > C:\WINDOWS\System\Restore\StateMgr.exe
> > O4 - HKLM\..\RunServices: [StillImageMonitor]
> > C:\WINDOWS\SYSTEM\STIMON.EXE
> > O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program
> > Files\Common Files\Symantec Shared\ccEvtMgr.exe"
> > O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program
> > Files\Common Files\Symantec Shared\ccSetMgr.exe"
> > O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program
> > Files\Common Files\Symantec Shared\Script
> > Blocking\SBServ.exe" -reg
> > O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1
> > \SYMANT~1\CCPROXY.EXE
> > O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1
> > \SYMANT~1\SNDSRVC.EXE
> > O4 - Startup: Microsoft Office.lnk = C:\Program
> > Files\Microsoft Office\Office\OSA9.EXE
> > O4 - Startup: MICROSOFT WORKS CALENDAR REMINDERS.LNK =
> > C:\Program Files\Common Files\Microsoft Shared\Works
> > Shared\wkcalrem.exe
> > O4 - Startup: KODAK PICTURE TRANSFER SOFTWARE.LNK =
> > C:\Program Files\Kodak\KODAK Picture Transfer
> > Software\pts.exe
> > O9 - Extra button: Messenger (HKLM)
> > O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
> > O9 - Extra button: Researcher (HKLM)
> > O9 - Extra button: Dell Home (HKCU)
> > O9 - Extra button: Mail (HKCU)
> > O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1
> > \Plugins\NPDocBox.dll
> > O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1
> > \PLUGINS\npqtplugin.dll
> > O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > intranet/sharepoint/
> > O15 - Trusted Zone: http://*.kk-intranet
> > O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
> > (Shockwave Flash Object) -
> > http://download.macromedia.com/pub/shockwave/cabs/flash/swf
> > lash.cab
> > O16 - DPF: Ulster Bank AnyTime -
> > https://anytime1.ulsterbank.com/asp/AnyTime.cab
> >
> >
>
>
Noel Paton
June 12th 04, 04:07 PM
Can't get F- all here, Shane.
No BB
No cable
even the mobile phone goes dead as I walk in the door!
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Shane" > wrote in message
...
> Can't you get Tiscali/Wanadoo ADSL there, Noel?
>
> Shane
>
>
> "Noel Paton" > wrote in message
> ...
> > You're not the only one who has to live with 56K connection - so do I!
> >
> > You never mentioned that you were running a firewall! - turn NIS off and
> see
> > if that helps!!
> >
> > Looking down the list, the following items strike me as 'unusual'
> >
> > Running Processes
> > C:\WINDOWS\SYSTEM\RPCSS.EXE
> > - see http://cexx.org/rpc.htm
> >
> > BHO's, etc
> > O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
> > This is UPnP - not related to Windows Plug and Play, it's very unlikely
> that
> > you need it, and it should be uninstalled from Add/Remove
Programs|Windows
> > Setup|Communications|Universal Plug and Play
> >
> > It looks as if you have Norton set to scan your email - don't bother!!
> > Norton is bad enough on its own, without the additional overhead and
bugs
> > involved in their email scanner.
> >
> > O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > > intranet/sharepoint/
> > > O15 - Trusted Zone: http://*.kk-intranet
> > are you aware of the fact that you have the above as a trusted site?? -
in
> > theory, it shouldn't be necessary, if it's on an intranet. The only
> > references I can find to such a site are in German and relate to warez
> > sites - always a source of infections of all kinds!
> >
> >
> >
> >
> > --
> > Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> > Nil Carborundum Illegitemi
> > http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> > Please read http://dts-l.org/goodpost.htm on how to post messages to
NG's
> > or
> > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > "Sue" > wrote in message
> > ...
> > > Oh and here is that log file I mentioned earlier! I think
> > > I'm meant to put that on the HiJackThis website, but I've
> > > not had the time to do that but I will do it...
> > > sometime... these damn 56k modem connections... they're
> > > soooo slow!!
> > >
> > > Logfile of HijackThis v1.97.7
> > > Scan saved at 20:15:13, on 10/06/2004
> > > Platform: Windows ME (Win9x 4.90.3000)
> > > MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> > >
> > > Running processes:
> > > C:\WINDOWS\SYSTEM\KERNEL32.DLL
> > > C:\WINDOWS\SYSTEM\MSGSRV32.EXE
> > > C:\WINDOWS\SYSTEM\mmtask.tsk
> > > C:\WINDOWS\SYSTEM\MPREXE.EXE
> > > C:\WINDOWS\SYSTEM\MSTASK.EXE
> > > C:\WINDOWS\SYSTEM\SSDPSRV.EXE
> > > C:\WINDOWS\SYSTEM\STIMON.EXE
> > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
> > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
> > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
> > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
> > > C:\WINDOWS\EXPLORER.EXE
> > > C:\WINDOWS\TASKMON.EXE
> > > C:\WINDOWS\SYSTEM\SYSTRAY.EXE
> > > C:\PROGRAM FILES\COMMON FILES\ADAPTEC
> > > SHARED\CREATECD\CREATECD50.EXE
> > > C:\WINDOWS\SYSTEM\WMIEXE.EXE
> > > C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
> > > C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5
> > > \DIRECTCD\DIRECTCD.EXE
> > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
> > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
> > > C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
> > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\TRAYMON.EXE
> > > C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
> > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
> > > C:\WINDOWS\SYSTEM\LEXBCES.EXE
> > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-
> > > LC\SYMLCSVC.EXE
> > > C:\WINDOWS\SYSTEM\RPCSS.EXE
> > > C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
> > > SHARED\WKCALREM.EXE
> > > C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER
> > > SOFTWARE\PTS.EXE
> > > C:\WINDOWS\SYSTEM\LEXPPS.EXE
> > > C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
> > > C:\WINDOWS\SYSTEM\RNAAPP.EXE
> > > C:\WINDOWS\SYSTEM\TAPISRV.EXE
> > > C:\WINDOWS\TEMP\TD_0005.DIR\HIJACKTHIS.EXE
> > >
> > > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
> > > Page = http://home.iol.ie
> > > R1 - HKCU\Software\Microsoft\Internet
> > > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > > R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
> > > Page = http://home.iol.ie
> > > R1 - HKLM\Software\Microsoft\Internet
> > > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > > R1 -
> > > HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
> > > Settings,ProxyServer = proxy.iolfree.ie:8080
> > > O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
> > > 784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0
> > > \READER\ACTIVEX\ACROIEHELPER.OCX
> > > O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-
> > > 298DDF1699E1} - C:\Program Files\Common Files\Symantec
> > > Shared\AdBlocking\NISShExt.dll
> > > O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-
> > > FADC6B084872} - C:\Program Files\Norton Internet
> > > Security\Norton AntiVirus\NavShExt.dll
> > > O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-
> > > A37C9A5676A7} - C:\Program Files\Common Files\Symantec
> > > Shared\AdBlocking\NISShExt.dll
> > > O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
> > > 7859DF00B1D6} - C:\Program Files\Norton Internet
> > > Security\Norton AntiVirus\NavShExt.dll
> > > O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-
> > > 00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
> > > O4 - HKLM\..\Run: [ScanRegistry]
> > > C:\WINDOWS\scanregw.exe /autorun
> > > O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
> > > O4 - HKLM\..\Run: [PCHealth]
> > > C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
> > > O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
> > > O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
> > > powrprof.dll,LoadCurrentPwrScheme
> > > O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common
> > > Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
> > > O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program
> > > Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
> > > O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program
> > > Files\Netropa\Multimedia Keyboard\MMKeybd.exe
> > > O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft
> > > Works\wkfud.exe
> > > O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program
> > > Files\Microsoft Works\WksSb.exe /AllUsers
> > > O4 - HKLM\..\Run: [Microsoft Works Update Detection]
> > > C:\Program Files\Microsoft Works\WkDetect.exe
> > > O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32
> > > \Drivers\dcfssvc.exe
> > > O4 - HKLM\..\Run: [LexStart] Lexstart.exe
> > > O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
> > > Files\Symantec Shared\ccApp.exe"
> > > O4 - HKLM\..\Run: [Symantec Core LC] C:\Program
> > > Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
> > > start
> > > O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton
> > > Internet Security\UrlLstCk.exe
> > > O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
> > > powrprof.dll,LoadCurrentPwrScheme
> > > O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
> > > O4 - HKLM\..\RunServices: [SSDPSRV]
> > > C:\WINDOWS\SYSTEM\ssdpsrv.exe
> > > O4 - HKLM\..\RunServices: [*StateMgr]
> > > C:\WINDOWS\System\Restore\StateMgr.exe
> > > O4 - HKLM\..\RunServices: [StillImageMonitor]
> > > C:\WINDOWS\SYSTEM\STIMON.EXE
> > > O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program
> > > Files\Common Files\Symantec Shared\ccEvtMgr.exe"
> > > O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program
> > > Files\Common Files\Symantec Shared\ccSetMgr.exe"
> > > O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program
> > > Files\Common Files\Symantec Shared\Script
> > > Blocking\SBServ.exe" -reg
> > > O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1
> > > \SYMANT~1\CCPROXY.EXE
> > > O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1
> > > \SYMANT~1\SNDSRVC.EXE
> > > O4 - Startup: Microsoft Office.lnk = C:\Program
> > > Files\Microsoft Office\Office\OSA9.EXE
> > > O4 - Startup: MICROSOFT WORKS CALENDAR REMINDERS.LNK =
> > > C:\Program Files\Common Files\Microsoft Shared\Works
> > > Shared\wkcalrem.exe
> > > O4 - Startup: KODAK PICTURE TRANSFER SOFTWARE.LNK =
> > > C:\Program Files\Kodak\KODAK Picture Transfer
> > > Software\pts.exe
> > > O9 - Extra button: Messenger (HKLM)
> > > O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
> > > O9 - Extra button: Researcher (HKLM)
> > > O9 - Extra button: Dell Home (HKCU)
> > > O9 - Extra button: Mail (HKCU)
> > > O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1
> > > \Plugins\NPDocBox.dll
> > > O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1
> > > \PLUGINS\npqtplugin.dll
> > > O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > > intranet/sharepoint/
> > > O15 - Trusted Zone: http://*.kk-intranet
> > > O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
> > > (Shockwave Flash Object) -
> > > http://download.macromedia.com/pub/shockwave/cabs/flash/swf
> > > lash.cab
> > > O16 - DPF: Ulster Bank AnyTime -
> > > https://anytime1.ulsterbank.com/asp/AnyTime.cab
> > >
> > >
> >
> >
>
>
Mike M
June 12th 04, 05:21 PM
> even the mobile phone goes dead as I walk in the door!
Surely that's a good thing? :-)
--
Mike Maltby MS-MVP
Noel Paton > wrote:
> Can't get F- all here, Shane.
> No BB
> No cable
> even the mobile phone goes dead as I walk in the door!
Shane
June 12th 04, 06:26 PM
Sounds like you're in a Radon hotspot, Noel!
That'd explain a great deal! ;-)
Shane
"Noel Paton" > wrote in message
...
> Can't get F- all here, Shane.
> No BB
> No cable
> even the mobile phone goes dead as I walk in the door!
>
> --
> Noel Paton (MS-MVP 2002-2004, Win9x)
>
> Nil Carborundum Illegitemi
> http://www.btinternet.com/~winnoel/millsrpch.htm
>
> Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
> or
> http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
>
> "Shane" > wrote in message
> ...
> > Can't you get Tiscali/Wanadoo ADSL there, Noel?
> >
> > Shane
> >
> >
> > "Noel Paton" > wrote in message
> > ...
> > > You're not the only one who has to live with 56K connection - so do I!
> > >
> > > You never mentioned that you were running a firewall! - turn NIS off
and
> > see
> > > if that helps!!
> > >
> > > Looking down the list, the following items strike me as 'unusual'
> > >
> > > Running Processes
> > > C:\WINDOWS\SYSTEM\RPCSS.EXE
> > > - see http://cexx.org/rpc.htm
> > >
> > > BHO's, etc
> > > O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
> > > This is UPnP - not related to Windows Plug and Play, it's very
unlikely
> > that
> > > you need it, and it should be uninstalled from Add/Remove
> Programs|Windows
> > > Setup|Communications|Universal Plug and Play
> > >
> > > It looks as if you have Norton set to scan your email - don't bother!!
> > > Norton is bad enough on its own, without the additional overhead and
> bugs
> > > involved in their email scanner.
> > >
> > > O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > > > intranet/sharepoint/
> > > > O15 - Trusted Zone: http://*.kk-intranet
> > > are you aware of the fact that you have the above as a trusted
site?? -
> in
> > > theory, it shouldn't be necessary, if it's on an intranet. The only
> > > references I can find to such a site are in German and relate to warez
> > > sites - always a source of infections of all kinds!
> > >
> > >
> > >
> > >
> > > --
> > > Noel Paton (MS-MVP 2002-2004, Win9x)
> > >
> > > Nil Carborundum Illegitemi
> > > http://www.btinternet.com/~winnoel/millsrpch.htm
> > >
> > > Please read http://dts-l.org/goodpost.htm on how to post messages to
> NG's
> > > or
> > > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > > "Sue" > wrote in message
> > > ...
> > > > Oh and here is that log file I mentioned earlier! I think
> > > > I'm meant to put that on the HiJackThis website, but I've
> > > > not had the time to do that but I will do it...
> > > > sometime... these damn 56k modem connections... they're
> > > > soooo slow!!
> > > >
> > > > Logfile of HijackThis v1.97.7
> > > > Scan saved at 20:15:13, on 10/06/2004
> > > > Platform: Windows ME (Win9x 4.90.3000)
> > > > MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> > > >
> > > > Running processes:
> > > > C:\WINDOWS\SYSTEM\KERNEL32.DLL
> > > > C:\WINDOWS\SYSTEM\MSGSRV32.EXE
> > > > C:\WINDOWS\SYSTEM\mmtask.tsk
> > > > C:\WINDOWS\SYSTEM\MPREXE.EXE
> > > > C:\WINDOWS\SYSTEM\MSTASK.EXE
> > > > C:\WINDOWS\SYSTEM\SSDPSRV.EXE
> > > > C:\WINDOWS\SYSTEM\STIMON.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
> > > > C:\WINDOWS\EXPLORER.EXE
> > > > C:\WINDOWS\TASKMON.EXE
> > > > C:\WINDOWS\SYSTEM\SYSTRAY.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\ADAPTEC
> > > > SHARED\CREATECD\CREATECD50.EXE
> > > > C:\WINDOWS\SYSTEM\WMIEXE.EXE
> > > > C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
> > > > C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5
> > > > \DIRECTCD\DIRECTCD.EXE
> > > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
> > > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
> > > > C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
> > > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\TRAYMON.EXE
> > > > C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
> > > > C:\WINDOWS\SYSTEM\LEXBCES.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-
> > > > LC\SYMLCSVC.EXE
> > > > C:\WINDOWS\SYSTEM\RPCSS.EXE
> > > > C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
> > > > SHARED\WKCALREM.EXE
> > > > C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER
> > > > SOFTWARE\PTS.EXE
> > > > C:\WINDOWS\SYSTEM\LEXPPS.EXE
> > > > C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
> > > > C:\WINDOWS\SYSTEM\RNAAPP.EXE
> > > > C:\WINDOWS\SYSTEM\TAPISRV.EXE
> > > > C:\WINDOWS\TEMP\TD_0005.DIR\HIJACKTHIS.EXE
> > > >
> > > > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
> > > > Page = http://home.iol.ie
> > > > R1 - HKCU\Software\Microsoft\Internet
> > > > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > > > R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
> > > > Page = http://home.iol.ie
> > > > R1 - HKLM\Software\Microsoft\Internet
> > > > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > > > R1 -
> > > > HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
> > > > Settings,ProxyServer = proxy.iolfree.ie:8080
> > > > O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
> > > > 784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0
> > > > \READER\ACTIVEX\ACROIEHELPER.OCX
> > > > O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-
> > > > 298DDF1699E1} - C:\Program Files\Common Files\Symantec
> > > > Shared\AdBlocking\NISShExt.dll
> > > > O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-
> > > > FADC6B084872} - C:\Program Files\Norton Internet
> > > > Security\Norton AntiVirus\NavShExt.dll
> > > > O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-
> > > > A37C9A5676A7} - C:\Program Files\Common Files\Symantec
> > > > Shared\AdBlocking\NISShExt.dll
> > > > O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
> > > > 7859DF00B1D6} - C:\Program Files\Norton Internet
> > > > Security\Norton AntiVirus\NavShExt.dll
> > > > O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-
> > > > 00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
> > > > O4 - HKLM\..\Run: [ScanRegistry]
> > > > C:\WINDOWS\scanregw.exe /autorun
> > > > O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
> > > > O4 - HKLM\..\Run: [PCHealth]
> > > > C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
> > > > O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
> > > > O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
> > > > powrprof.dll,LoadCurrentPwrScheme
> > > > O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common
> > > > Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
> > > > O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program
> > > > Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
> > > > O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program
> > > > Files\Netropa\Multimedia Keyboard\MMKeybd.exe
> > > > O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft
> > > > Works\wkfud.exe
> > > > O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program
> > > > Files\Microsoft Works\WksSb.exe /AllUsers
> > > > O4 - HKLM\..\Run: [Microsoft Works Update Detection]
> > > > C:\Program Files\Microsoft Works\WkDetect.exe
> > > > O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32
> > > > \Drivers\dcfssvc.exe
> > > > O4 - HKLM\..\Run: [LexStart] Lexstart.exe
> > > > O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
> > > > Files\Symantec Shared\ccApp.exe"
> > > > O4 - HKLM\..\Run: [Symantec Core LC] C:\Program
> > > > Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
> > > > start
> > > > O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton
> > > > Internet Security\UrlLstCk.exe
> > > > O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
> > > > powrprof.dll,LoadCurrentPwrScheme
> > > > O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
> > > > O4 - HKLM\..\RunServices: [SSDPSRV]
> > > > C:\WINDOWS\SYSTEM\ssdpsrv.exe
> > > > O4 - HKLM\..\RunServices: [*StateMgr]
> > > > C:\WINDOWS\System\Restore\StateMgr.exe
> > > > O4 - HKLM\..\RunServices: [StillImageMonitor]
> > > > C:\WINDOWS\SYSTEM\STIMON.EXE
> > > > O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program
> > > > Files\Common Files\Symantec Shared\ccEvtMgr.exe"
> > > > O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program
> > > > Files\Common Files\Symantec Shared\ccSetMgr.exe"
> > > > O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program
> > > > Files\Common Files\Symantec Shared\Script
> > > > Blocking\SBServ.exe" -reg
> > > > O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1
> > > > \SYMANT~1\CCPROXY.EXE
> > > > O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1
> > > > \SYMANT~1\SNDSRVC.EXE
> > > > O4 - Startup: Microsoft Office.lnk = C:\Program
> > > > Files\Microsoft Office\Office\OSA9.EXE
> > > > O4 - Startup: MICROSOFT WORKS CALENDAR REMINDERS.LNK =
> > > > C:\Program Files\Common Files\Microsoft Shared\Works
> > > > Shared\wkcalrem.exe
> > > > O4 - Startup: KODAK PICTURE TRANSFER SOFTWARE.LNK =
> > > > C:\Program Files\Kodak\KODAK Picture Transfer
> > > > Software\pts.exe
> > > > O9 - Extra button: Messenger (HKLM)
> > > > O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
> > > > O9 - Extra button: Researcher (HKLM)
> > > > O9 - Extra button: Dell Home (HKCU)
> > > > O9 - Extra button: Mail (HKCU)
> > > > O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1
> > > > \Plugins\NPDocBox.dll
> > > > O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1
> > > > \PLUGINS\npqtplugin.dll
> > > > O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > > > intranet/sharepoint/
> > > > O15 - Trusted Zone: http://*.kk-intranet
> > > > O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
> > > > (Shockwave Flash Object) -
> > > > http://download.macromedia.com/pub/shockwave/cabs/flash/swf
> > > > lash.cab
> > > > O16 - DPF: Ulster Bank AnyTime -
> > > > https://anytime1.ulsterbank.com/asp/AnyTime.cab
> > > >
> > > >
> > >
> > >
> >
> >
>
>
Mike M
June 12th 04, 06:42 PM
LOL
--
MM
Shane > wrote:
> Sounds like you're in a Radon hotspot, Noel!
>
> That'd explain a great deal! ;-)
Noel Paton
June 13th 04, 12:03 AM
Careful!
:)
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Shane" > wrote in message
...
> Sounds like you're in a Radon hotspot, Noel!
>
> That'd explain a great deal! ;-)
>
>
> Shane
>
>
> "Noel Paton" > wrote in message
> ...
> > Can't get F- all here, Shane.
> > No BB
> > No cable
> > even the mobile phone goes dead as I walk in the door!
> >
> > --
> > Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> > Nil Carborundum Illegitemi
> > http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> > Please read http://dts-l.org/goodpost.htm on how to post messages to
NG's
> > or
> > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> >
> > "Shane" > wrote in message
> > ...
> > > Can't you get Tiscali/Wanadoo ADSL there, Noel?
> > >
> > > Shane
> > >
> > >
> > > "Noel Paton" > wrote in message
> > > ...
> > > > You're not the only one who has to live with 56K connection - so do
I!
> > > >
> > > > You never mentioned that you were running a firewall! - turn NIS off
> and
> > > see
> > > > if that helps!!
> > > >
> > > > Looking down the list, the following items strike me as 'unusual'
> > > >
> > > > Running Processes
> > > > C:\WINDOWS\SYSTEM\RPCSS.EXE
> > > > - see http://cexx.org/rpc.htm
> > > >
> > > > BHO's, etc
> > > > O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe
> > > > This is UPnP - not related to Windows Plug and Play, it's very
> unlikely
> > > that
> > > > you need it, and it should be uninstalled from Add/Remove
> > Programs|Windows
> > > > Setup|Communications|Universal Plug and Play
> > > >
> > > > It looks as if you have Norton set to scan your email - don't
bother!!
> > > > Norton is bad enough on its own, without the additional overhead
and
> > bugs
> > > > involved in their email scanner.
> > > >
> > > > O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > > > > intranet/sharepoint/
> > > > > O15 - Trusted Zone: http://*.kk-intranet
> > > > are you aware of the fact that you have the above as a trusted
> site?? -
> > in
> > > > theory, it shouldn't be necessary, if it's on an intranet. The only
> > > > references I can find to such a site are in German and relate to
warez
> > > > sites - always a source of infections of all kinds!
> > > >
> > > >
> > > >
> > > >
> > > > --
> > > > Noel Paton (MS-MVP 2002-2004, Win9x)
> > > >
> > > > Nil Carborundum Illegitemi
> > > > http://www.btinternet.com/~winnoel/millsrpch.htm
> > > >
> > > > Please read http://dts-l.org/goodpost.htm on how to post messages to
> > NG's
> > > > or
> > > > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > > > "Sue" > wrote in message
> > > > ...
> > > > > Oh and here is that log file I mentioned earlier! I think
> > > > > I'm meant to put that on the HiJackThis website, but I've
> > > > > not had the time to do that but I will do it...
> > > > > sometime... these damn 56k modem connections... they're
> > > > > soooo slow!!
> > > > >
> > > > > Logfile of HijackThis v1.97.7
> > > > > Scan saved at 20:15:13, on 10/06/2004
> > > > > Platform: Windows ME (Win9x 4.90.3000)
> > > > > MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
> > > > >
> > > > > Running processes:
> > > > > C:\WINDOWS\SYSTEM\KERNEL32.DLL
> > > > > C:\WINDOWS\SYSTEM\MSGSRV32.EXE
> > > > > C:\WINDOWS\SYSTEM\mmtask.tsk
> > > > > C:\WINDOWS\SYSTEM\MPREXE.EXE
> > > > > C:\WINDOWS\SYSTEM\MSTASK.EXE
> > > > > C:\WINDOWS\SYSTEM\SSDPSRV.EXE
> > > > > C:\WINDOWS\SYSTEM\STIMON.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
> > > > > C:\WINDOWS\EXPLORER.EXE
> > > > > C:\WINDOWS\TASKMON.EXE
> > > > > C:\WINDOWS\SYSTEM\SYSTRAY.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\ADAPTEC
> > > > > SHARED\CREATECD\CREATECD50.EXE
> > > > > C:\WINDOWS\SYSTEM\WMIEXE.EXE
> > > > > C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
> > > > > C:\PROGRAM FILES\ADAPTEC\EASY CD CREATOR 5
> > > > > \DIRECTCD\DIRECTCD.EXE
> > > > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMKEYBD.EXE
> > > > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
> > > > > C:\WINDOWS\SYSTEM32\DRIVERS\DCFSSVC.EXE
> > > > > C:\PROGRAM FILES\NETROPA\MULTIMEDIA KEYBOARD\TRAYMON.EXE
> > > > > C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
> > > > > C:\WINDOWS\SYSTEM\LEXBCES.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-
> > > > > LC\SYMLCSVC.EXE
> > > > > C:\WINDOWS\SYSTEM\RPCSS.EXE
> > > > > C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS
> > > > > SHARED\WKCALREM.EXE
> > > > > C:\PROGRAM FILES\KODAK\KODAK PICTURE TRANSFER
> > > > > SOFTWARE\PTS.EXE
> > > > > C:\WINDOWS\SYSTEM\LEXPPS.EXE
> > > > > C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
> > > > > C:\WINDOWS\SYSTEM\RNAAPP.EXE
> > > > > C:\WINDOWS\SYSTEM\TAPISRV.EXE
> > > > > C:\WINDOWS\TEMP\TD_0005.DIR\HIJACKTHIS.EXE
> > > > >
> > > > > R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
> > > > > Page = http://home.iol.ie
> > > > > R1 - HKCU\Software\Microsoft\Internet
> > > > > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > > > > R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
> > > > > Page = http://home.iol.ie
> > > > > R1 - HKLM\Software\Microsoft\Internet
> > > > > Explorer\Main,Default_Page_URL = http://home.iol.ie
> > > > > R1 -
> > > > > HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
> > > > > Settings,ProxyServer = proxy.iolfree.ie:8080
> > > > > O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-
> > > > > 784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0
> > > > > \READER\ACTIVEX\ACROIEHELPER.OCX
> > > > > O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-
> > > > > 298DDF1699E1} - C:\Program Files\Common Files\Symantec
> > > > > Shared\AdBlocking\NISShExt.dll
> > > > > O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-
> > > > > FADC6B084872} - C:\Program Files\Norton Internet
> > > > > Security\Norton AntiVirus\NavShExt.dll
> > > > > O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-
> > > > > A37C9A5676A7} - C:\Program Files\Common Files\Symantec
> > > > > Shared\AdBlocking\NISShExt.dll
> > > > > O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-
> > > > > 7859DF00B1D6} - C:\Program Files\Norton Internet
> > > > > Security\Norton AntiVirus\NavShExt.dll
> > > > > O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-
> > > > > 00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
> > > > > O4 - HKLM\..\Run: [ScanRegistry]
> > > > > C:\WINDOWS\scanregw.exe /autorun
> > > > > O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
> > > > > O4 - HKLM\..\Run: [PCHealth]
> > > > > C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
> > > > > O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
> > > > > O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
> > > > > powrprof.dll,LoadCurrentPwrScheme
> > > > > O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common
> > > > > Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
> > > > > O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program
> > > > > Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
> > > > > O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program
> > > > > Files\Netropa\Multimedia Keyboard\MMKeybd.exe
> > > > > O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft
> > > > > Works\wkfud.exe
> > > > > O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program
> > > > > Files\Microsoft Works\WksSb.exe /AllUsers
> > > > > O4 - HKLM\..\Run: [Microsoft Works Update Detection]
> > > > > C:\Program Files\Microsoft Works\WkDetect.exe
> > > > > O4 - HKLM\..\Run: [Dcfssvc] C:\WINDOWS\System32
> > > > > \Drivers\dcfssvc.exe
> > > > > O4 - HKLM\..\Run: [LexStart] Lexstart.exe
> > > > > O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common
> > > > > Files\Symantec Shared\ccApp.exe"
> > > > > O4 - HKLM\..\Run: [Symantec Core LC] C:\Program
> > > > > Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
> > > > > start
> > > > > O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton
> > > > > Internet Security\UrlLstCk.exe
> > > > > O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
> > > > > powrprof.dll,LoadCurrentPwrScheme
> > > > > O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
> > > > > O4 - HKLM\..\RunServices: [SSDPSRV]
> > > > > C:\WINDOWS\SYSTEM\ssdpsrv.exe
> > > > > O4 - HKLM\..\RunServices: [*StateMgr]
> > > > > C:\WINDOWS\System\Restore\StateMgr.exe
> > > > > O4 - HKLM\..\RunServices: [StillImageMonitor]
> > > > > C:\WINDOWS\SYSTEM\STIMON.EXE
> > > > > O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program
> > > > > Files\Common Files\Symantec Shared\ccEvtMgr.exe"
> > > > > O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program
> > > > > Files\Common Files\Symantec Shared\ccSetMgr.exe"
> > > > > O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program
> > > > > Files\Common Files\Symantec Shared\Script
> > > > > Blocking\SBServ.exe" -reg
> > > > > O4 - HKLM\..\RunServices: [ccProxy] C:\PROGRA~1\COMMON~1
> > > > > \SYMANT~1\CCPROXY.EXE
> > > > > O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1
> > > > > \SYMANT~1\SNDSRVC.EXE
> > > > > O4 - Startup: Microsoft Office.lnk = C:\Program
> > > > > Files\Microsoft Office\Office\OSA9.EXE
> > > > > O4 - Startup: MICROSOFT WORKS CALENDAR REMINDERS.LNK =
> > > > > C:\Program Files\Common Files\Microsoft Shared\Works
> > > > > Shared\wkcalrem.exe
> > > > > O4 - Startup: KODAK PICTURE TRANSFER SOFTWARE.LNK =
> > > > > C:\Program Files\Kodak\KODAK Picture Transfer
> > > > > Software\pts.exe
> > > > > O9 - Extra button: Messenger (HKLM)
> > > > > O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
> > > > > O9 - Extra button: Researcher (HKLM)
> > > > > O9 - Extra button: Dell Home (HKCU)
> > > > > O9 - Extra button: Mail (HKCU)
> > > > > O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1
> > > > > \Plugins\NPDocBox.dll
> > > > > O12 - Plugin for .qt: C:\PROGRA~1\INTERN~1
> > > > > \PLUGINS\npqtplugin.dll
> > > > > O14 - IERESET.INF: START_PAGE_URL=http://kk-
> > > > > intranet/sharepoint/
> > > > > O15 - Trusted Zone: http://*.kk-intranet
> > > > > O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
> > > > > (Shockwave Flash Object) -
> > > > > http://download.macromedia.com/pub/shockwave/cabs/flash/swf
> > > > > lash.cab
> > > > > O16 - DPF: Ulster Bank AnyTime -
> > > > > https://anytime1.ulsterbank.com/asp/AnyTime.cab
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>
Noel Paton
June 13th 04, 12:04 AM
If I had BB, then yes, it would be a good thing, but I'd like to be able to
get phone calls occasionally!<g>
--
Noel Paton (MS-MVP 2002-2004, Win9x)
Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Mike M" > wrote in message
...
> > even the mobile phone goes dead as I walk in the door!
>
> Surely that's a good thing? :-)
> --
> Mike Maltby MS-MVP
>
>
>
> Noel Paton > wrote:
>
> > Can't get F- all here, Shane.
> > No BB
> > No cable
> > even the mobile phone goes dead as I walk in the door!
>
>
Sue
June 13th 04, 04:34 PM
I turned off email scanning , uninstalled the plug and
play and got rid of the trusted intranet site. There is no
change. The four things spycop are finding are :
1. Hotbar... category: RegKey
2. ieaccess.. category: RegKey
3. Acreate... category: File
4. Free Scratch ... category: File
When I go to open IE it says Page cannot be displayed
>-----Original Message-----
>Sue wrote:
>
>> Hi Again!
>> So I uninstalled SpyBeware as you recommended.
>> Now, I ran ad-aware and it came back squeeky clean! I
ran
>> Shreddar the other night and it came back clean. So I
ran
>> SpyCop tonight and it came back with bugs but to remove
>> them I have to register and that I cannot do because of
>> IE. I tried updating it before I scanned but it
>> says "error connecting to SpyCop server".
>> So will I just reinstall the OS and stop bugging you or
>> have a another solution??!!!
>> A VERY frustrated Irish Gal!
>> Sue
>
>Since I don't like to type any more than I have to, I'm
going to
>cut'n'paste from a reply I made to another poster, who
was also
>wondering about a product which required "registration"
($$$)...
>
>
>
>
>Rick
>
>----------------------------------------------------------
----------
>
>webster72n wrote:
>
> > Now that I did it, I am going to give the results to
you, Rick; there
>were:
>
> > 3 errors Missing DLL/OCX/COMClasses w. 'High'
priority.
>
>No idea... probably ghosts of some of the pests you rid
yourself of a
>couple weeks ago; low priority. If it turns out to be
something you
>need, it'll let you know when you try to run it.
>
>
> > 5 errors Missing Shortcut or Invalid Path
Medium
>
>stuff you've uninstalled which hasn't completely, or
things you've
>deleted, or have fallen off your WMP/etc. MostRecentUsed
Files... *no*
>priority would be a little more accurate.
>
>
>
> > 1 error Connected Drives Missing
Low
>
>sorta weird but if there's nothing wrong, <shrug>...
perhaps a USB drive
>or the CDR/DVD part of the CD drive, maybe a virtual
network drive.
>
> >
> > What I don't understand is, why any of the other
applications didn't
>detect
> > those things.
> > Maybe they are not that important, but three ot them
are supposed to
>be of
> > high priority.
>
>
>If you aren't getting any errors, I certainly wouldn't
worry about any
>of them; looks like standard system hiccups.
>
> > What is your take on that?
>
>
>A half decent registry-cleaner will get rid of most if
not all the
>problem listings. Couple largeish threads on that a few
weeks ago.
>
>.
>
Rick T
June 13th 04, 08:20 PM
Sue wrote:
> I turned off email scanning , uninstalled the plug and
> play and got rid of the trusted intranet site. There is no
> change. The four things spycop are finding are :
> 1. Hotbar... category: RegKey
> 2. ieaccess.. category: RegKey
> 3. Acreate... category: File
> 4. Free Scratch ... category: File
>
> When I go to open IE it says Page cannot be displayed
Try it with S&D
http://www.safer-networking.org/
That will pick up some things Ad-Aware doesn't.
Rick
>
>
>>-----Original Message-----
>>Sue wrote:
>>
>>
>>>Hi Again!
>>>So I uninstalled SpyBeware as you recommended.
>>>Now, I ran ad-aware and it came back squeeky clean! I
>
> ran
>
>>>Shreddar the other night and it came back clean. So I
>
> ran
>
>>>SpyCop tonight and it came back with bugs but to remove
>>>them I have to register and that I cannot do because of
>>>IE. I tried updating it before I scanned but it
>>>says "error connecting to SpyCop server".
>>>So will I just reinstall the OS and stop bugging you or
>>>have a another solution??!!!
>>>A VERY frustrated Irish Gal!
>>>Sue
>>
>>Since I don't like to type any more than I have to, I'm
>
> going to
>
>>cut'n'paste from a reply I made to another poster, who
>
> was also
>
>>wondering about a product which required "registration"
>
> ($$$)...
>
>>
>>
>>
>>Rick
>>
>>----------------------------------------------------------
>
> ----------
>
>>webster72n wrote:
>>
>>
>>>Now that I did it, I am going to give the results to
>
> you, Rick; there
>
>>were:
>>
>>
>>>3 errors Missing DLL/OCX/COMClasses w. 'High'
>
> priority.
>
>>No idea... probably ghosts of some of the pests you rid
>
> yourself of a
>
>>couple weeks ago; low priority. If it turns out to be
>
> something you
>
>>need, it'll let you know when you try to run it.
>>
>>
>>
>>>5 errors Missing Shortcut or Invalid Path
>
> Medium
>
>>stuff you've uninstalled which hasn't completely, or
>
> things you've
>
>>deleted, or have fallen off your WMP/etc. MostRecentUsed
>
> Files... *no*
>
>>priority would be a little more accurate.
>>
>>
>>
>>
>>>1 error Connected Drives Missing
>
> Low
>
>>sorta weird but if there's nothing wrong, <shrug>...
>
> perhaps a USB drive
>
>>or the CDR/DVD part of the CD drive, maybe a virtual
>
> network drive.
>
>>>What I don't understand is, why any of the other
>
> applications didn't
>
>>detect
>>
>>>those things.
>>>Maybe they are not that important, but three ot them
>
> are supposed to
>
>>be of
>>
>>>high priority.
>>
>>
>>If you aren't getting any errors, I certainly wouldn't
>
> worry about any
>
>>of them; looks like standard system hiccups.
>>
>>
>>>What is your take on that?
>>
>>
>>A half decent registry-cleaner will get rid of most if
>
> not all the
>
>>problem listings. Couple largeish threads on that a few
>
> weeks ago.
>
>>.
>>
Victor
June 15th 04, 05:16 PM
No Big Brother? Now that is appalling!
Victor
> Can't get F- all here, Shane.
> No BB
> No cable
> even the mobile phone goes dead as I walk in the door!
>=20
> --=20
> Noel Paton (MS-MVP 2002-2004, Win9x)
>=20
vBulletin® v3.6.4, Copyright ©2000-2024, Jelsoft Enterprises Ltd.