Home computer problems L@@K HERE!

[Shortbus]

Ok ppls I have a problem I've been working on for about two days now.

My system
Windows 98SE
Pentium 3
256MB Mem
Running I.E. 6 with latest patches installed.

Problem is when browsing the net with I.E. I find there are certain sites I cannot load anymore(I can load them from work so I know it is not the site. at home I get a cannot find page, I can't even ping the unloadable sites), some are search engines some are PC stores like best buy and Compusa. Also "windows update" is missing from the "Tools" menu, and sometimes in the open explorer window all text will be blurred out and finally the PC halts and has to be manually shut down and restarted.

Here is what I have done,
Updated ETrust anti-virus and scanned entire system, it found 3 trojan files, I don't recall the names. Ran CWS shredder it found no traces of CWS files. I ran Highjack this and it found windows/system/sr64 which appeared to be some sort of spyware that ad-aware did not catch. If needed I can run Hijack again and post the results up here, but to me I seen nothing else obviously out of place. For kicks I tried Norton, and Mcaffee, also even tried DR.watson, none of these produced any results.

As far as a fire wall I am running black ice defender. I haven't loaded any new software or changed anything, nor have I opened any email attatchments.

Anyone got a fresh idea of what to try next other than blowing it up with some C4 or equivalent? (I'm serious)

thx, John

Oh one last question, I am thinking about getting a new PC and will need to transfer some docs,jpgs,avis,shitload of mpgs and mp3s, and some wmvs . If I do this will I infect the harddrive on the new PC or do the virus's only attach themselves to .exe files?

[YogsVR4]

When you get your new PC, you can transfer your documents and links to your hearts content if you've run them through a virus checker first. Documents can certainly contain viruses and some of the others can have nasty surprises in store, but again, any comercial virus scan should take care of them for you.

As for your current problems. Make sure you've run all the windows updates. Clear out your internet cache and cookies. Take a look at your security levels. You may have turned on certificates or set the security high enough that its blocking those pages.

Your machine is fast enough to move to 2000. That would be the step I would take. Its a lot more stable then 98.

[Shortbus]

Thanks for the info yogs.

Here is the log file I was talking about.

Logfile of HijackThis v1.97.7
Scan saved at 11:24:45 AM, on 4/20/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ICE\BLACKICE\BLACKD.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\USBMONIT.EXE
C:\WINDOWS\SYSTEM\VETMSG9X.EXE
C:\PROGRAM FILES\CA\ETRUST EZ ARMOR\ETRUST EZ ANTIVIRUS\VETTRAY.EXE
C:\PROGRAM FILES\NETWORK ICE\BLACKICE\BLACKICE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.azcentral.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant = ,
R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch = ,
O2 - BHO: (no name) - {0096CC0A-623C-4829-AD9C-19AF0DC9D8FE} - C:\PROGRAM FILES\DAP\DAPIEBAR.DLL (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -off
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE c:\windows\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [USBMonit.exe] "C:\WINDOWS\SYSTEM\USBMonit.exe"
O4 - HKLM\..\Run: [Vet Alert] C:\WINDOWS\System\VetMsg9x.exe
O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VETTRAY.EXE
O4 - HKLM\..\RunServices: [LoadBlackD] C:\Program Files\Network ICE\BlackICE\blackd.exe
O4 - HKLM\..\RunServices: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakLogon
O4 - Startup: BlackICE Utility.lnk = C:\Program Files\Network ICE\BlackICE\blackice.exe
O8 - Extra context menu item: &Google Search - res://C:\WINDOWS\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\WINDOWS\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\WINDOWS\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\WINDOWS\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\WINDOWS\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: AIM (HKLM)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...952.2121296296
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: ChatSpace Java Client 2.1.0.76 - http://irc.f150world.com:8000/Java/cs4ms076.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://cashsearch.biz/sher/x.chm::/load.exe
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...51/mcfscan.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab

[Neutrino]

ok this is the way viruses sometimes block certain sites(ussually antivirus ones so you can't get patches or removal tools)

go here
C:\WINDOWS\system32\drivers\etc

is this folder edit the file: "hosts" with notepad and delete everything that apears under: "127.0.0.1 localhost" if there are site adresses under it those are blocked



Note: all this is under Win XP so this file might be under a slightly different location

[Shortbus]

Originally Posted by Neutrino

ok this is the way viruses sometimes block certain sites(ussually antivirus ones so you can't get patches or removal tools)

go here
C:\WINDOWS\system32\drivers\etc

is this folder edit the file: "hosts" with notepad and delete everything that apears under: "127.0.0.1 localhost" if there are site adresses under it those are blocked



Note: all this is under Win XP so this file might be under a slightly different location

Thanks Neutrino, I went home and checked it out, it was right where you said so I clicked to open it and had notepad open the file and there was nothing below 127.0.0.1

Guess this is a tricky one. Ya know it is probably the most simple ridiculous things to fix though.

I am considering this... keeping old faithful (the PC) and buying XP upgrade. Maybe the virus is gone but it deleted or corrupted some system files to do with I.E. and it just needs them back.

Last resort I guess I will search through the miles of registry files tonight and see if I can find something in there that doesn't look right.

[Neutrino]

Yeah often viruses if caught too late can leave you system messed up even after removal.

An upgrade to Xp IMO is a very good ideea. Xp is far superior system than 98 just make sure all your hardware is suported under it and do a clean install.

Xp properly configured and with proper hardware will not crash period. All my machines running Xp have not crashed in over two years now.


BTW if you only have problems with IE try another browser. I recomend Mozilla or its streamlined brother Mozilla Firefox(pesonally I love to death firefox)

you can get them here:

http://www.mozilla.org/

[Shortbus]

Thank you! I will pickup a copy of XP this weekend providing the old beater can handle it, and do a clean install, well actually while I am at it I'm going to buy a new harddrive so that I have two drives and also I won't have to burn all my files to CD right away, I can just transfer them from drive to drive once I get XP up and running.


Also thank you for the mozilla link. I will give it a try and see if I like it.

[Neutrino]

Originally Posted by Shortbus@AF

Thank you! I will pickup a copy of XP this weekend providing the old beater can handle it, and do a clean install, well actually while I am at it I'm going to buy a new harddrive so that I have two drives and also I won't have to burn all my files to CD right away, I can just transfer them from drive to drive once I get XP up and running.


Also thank you for the mozilla link. I will give it a try and see if I like it.

sounds like fun. As far as hard drives go my recomendation is to get a seagate barracuda V with the 8 meg cache. They are about the most reliable and top quality drives on the market. Their use of fluid bearings is especially a nice touch.

And as a breif overview of mozilla try Ctrl+t and you'll see the joy of tabbed browsing, the option to stop pop ups is built in, and the firefox version has the fastest loading times of any browser out there.

hint(get the firefox version - i bugged all my friends about it and now they all use it and love it)

[Plastic_Fork]

Also, try pinging the sites you're attempting to view from a DOS shell. Sometimes routing or DNS settings on your ISP's side can prevent you from seeing certain sites while you can freely view them from another network (like your workplace). The rest of what I would suggest has been covered already regarding your browser issues.

As for hard drives, I use Western Digital drives and have been very happy with them. Just food for thought - lots of different brands out there.